Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 27.01.2012, 23:35   #1
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Hallo,
also der Titel sagt eigentlich alles.
Habe schon gegoogelt und Malwarebyt sowie CC Cleaner runtergeladen, aber selbst konnte ich das Problem nicht bereinigen.
Die Seite bietet mir übrigens an ein Iphone zu kaufen...

Daher poste ich mal die Logfiles und hoffe, dass ihr mir helfen könnt.
Bin für jede Hilfe dankbar und verzeiht mir bitte, dass ich wenig Erfahrung mit Antiviren Maßnahmen habe...

LOG:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.27.02

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
[Administrator]

Schutz: Aktiviert

27.01.2012 23:31:25
mbam-log-2012-01-27 (23-31-25).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 327814
Laufzeit: 42 Minute(n),

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Windows\assembly\temp\kwrd.dll (PUP.BitMiner) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Also die Datei sollte eigentlich mit MalwareByte gelöscht sein, aber das Problem tritt immer noch auf.

Alt 28.01.2012, 10:50   #2
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



hi,
na da gucken wir doch mal.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________

Alt 28.01.2012, 12:28   #3
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



OTL.Txt
Textbox.[/list]
Code:
ATTFilter
OTL logfile created on: 1/28/2012 12:47:16 PM - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Name\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.91 Gb Total Physical Memory | 2.57 Gb Available Physical Memory | 65.68% Memory free
7.82 Gb Paging File | 6.24 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 434.66 Gb Total Space | 339.79 Gb Free Space | 78.17% Space Free | Partition Type: NTFS
Drive D: | 30.00 Gb Total Space | 3.55 Gb Free Space | 11.83% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: ComputerName | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/01/28 12:44:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe
PRC - [2012/01/03 05:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011/12/24 17:50:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011/12/15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011/12/15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/12/15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011/03/04 12:45:08 | 001,529,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2011/02/24 02:04:54 | 003,402,760 | ---- | M] (Pegatron Corporation) -- C:\Program Files (x86)\PHotkey\POSD.exe
PRC - [2011/02/24 02:04:50 | 000,819,720 | ---- | M] (Pegatron Corporation) -- C:\Program Files (x86)\PHotkey\PHotkey.exe
PRC - [2011/02/17 12:52:09 | 001,997,416 | R--- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2011/02/11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2011/02/11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
PRC - [2011/02/11 20:39:54 | 000,985,424 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
PRC - [2011/02/11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2011/01/17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011/01/17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010/11/29 10:49:34 | 000,075,048 | ---- | M] (cyberlink) -- C:\Program Files (x86)\CyberLink\Shared files\brs.exe
PRC - [2010/11/17 09:53:16 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
PRC - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/11/05 23:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/10/29 04:07:26 | 000,136,488 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
PRC - [2010/09/14 05:45:56 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2010/09/14 05:45:44 | 000,508,264 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2010/02/03 09:08:56 | 000,087,336 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2010/01/13 01:36:00 | 000,117,256 | R--- | M] () -- C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
PRC - [2009/12/18 23:40:48 | 000,104,968 | R--- | M] () -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
PRC - [2009/11/02 22:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/01/11 15:47:18 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\b41e38edbd6dfe20997f6ea7c080aceb\System.Web.ni.dll
MOD - [2012/01/11 15:47:10 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b559a471eef00081f0b5c2719d1d9623\System.Runtime.Remoting.ni.dll
MOD - [2012/01/08 16:54:27 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2011/11/14 20:32:27 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\6aef03034d33721bfbd588d9d7fffe60\IAStorCommon.ni.dll
MOD - [2011/11/14 20:32:26 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsBase.ni.dll
MOD - [2011/11/14 20:32:24 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4ffea70edf9aa81cba6a5be8070d3dd9\IAStorUtil.ni.dll
MOD - [2011/11/14 20:32:21 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll
MOD - [2011/11/14 20:32:13 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll
MOD - [2011/11/14 20:32:04 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll
MOD - [2011/11/14 20:31:59 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll
MOD - [2011/11/14 20:31:57 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll
MOD - [2011/11/14 20:31:47 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll
MOD - [2011/02/10 20:24:37 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2010/11/13 00:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009/11/02 22:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009/11/02 22:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/02/17 04:08:56 | 001,133,568 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV:64bit: - [2011/02/09 12:49:18 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2011/02/05 00:34:20 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:64bit: - [2011/02/05 00:24:24 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:64bit: - [2011/02/05 00:19:50 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:64bit: - [2010/12/17 15:46:34 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg)
SRV:64bit: - [2010/09/23 03:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2012/01/05 11:10:27 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/01/03 05:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/12/15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/12/15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/04 12:45:08 | 001,529,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2011/02/17 12:52:09 | 001,997,416 | R--- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/02/11 20:40:00 | 000,997,712 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2011/02/11 20:39:58 | 001,304,912 | ---- | M] (Intel Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2011/02/11 20:39:54 | 000,907,600 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2010/12/06 12:52:40 | 000,062,464 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\watchmi\TvdService.exe -- (watchmi)
SRV - [2010/11/29 19:49:36 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe -- (CLKMSVC10_38F51D56)
SRV - [2010/11/05 23:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/10/07 01:46:42 | 000,159,752 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\PHotkey\GFNEXSrv.exe -- (GFNEXSrv)
SRV - [2010/09/14 05:45:56 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2010/09/14 05:45:44 | 000,508,264 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/03/18 21:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/12/18 23:40:48 | 000,104,968 | R--- | M] () [Auto | Running] -- C:\Program Files (x86)\PHotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2009/06/10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/12/15 15:00:00 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011/12/15 14:59:59 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/12/15 14:59:59 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/12/10 15:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011/03/11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/06 20:52:22 | 012,264,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/03/04 12:51:50 | 000,306,536 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV:64bit: - [2011/02/24 19:40:20 | 008,591,872 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2011/02/17 12:52:11 | 001,577,600 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011/02/16 22:45:48 | 000,261,632 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) Intel(R) Centrino(R)
DRV:64bit: - [2011/02/16 22:45:48 | 000,261,632 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) Intel(R) Centrino(R)
DRV:64bit: - [2011/02/10 14:52:34 | 000,181,760 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2011/02/10 14:52:34 | 000,082,432 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2011/01/24 10:24:52 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:64bit: - [2011/01/24 10:22:48 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV:64bit: - [2011/01/24 09:56:06 | 000,274,944 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:64bit: - [2010/12/24 08:26:00 | 000,025,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/11/21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010/11/08 14:52:14 | 000,068,608 | ---- | M] (Sentelic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fspad_xp64.sys -- (fspad_xp64)
DRV:64bit: - [2010/11/08 14:52:14 | 000,068,608 | ---- | M] (Sentelic Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\fspad_wlh64.sys -- (fspad_wlh64)
DRV:64bit: - [2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2010/10/29 04:07:44 | 000,031,088 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\clwvd.sys -- (clwvd)
DRV:64bit: - [2010/10/15 00:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/09/23 21:03:06 | 000,129,008 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd)
DRV:64bit: - [2010/09/14 05:45:52 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2010/09/14 05:45:50 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2010/09/14 05:45:48 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2010/09/14 05:45:44 | 000,760,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2010/08/24 17:55:44 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/02/08 08:32:00 | 000,014,992 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CVirtA64.sys -- (CVirtA)
DRV:64bit: - [2009/10/23 16:26:14 | 000,046,592 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmUStor.sys -- (AmUStor)
DRV:64bit: - [2009/08/13 22:10:18 | 000,073,984 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/07/14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/07/14 01:01:09 | 000,679,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xnacc.sys -- (xnacc)
DRV:64bit: - [2009/06/10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2008/11/16 18:39:44 | 000,157,968 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dne64x.sys -- (DNE)
DRV:64bit: - [2008/03/13 08:46:00 | 000,027,136 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ManyCam_x64.sys -- (ManyCam)
DRV - [2009/09/11 22:11:46 | 000,014,344 | R--- | M] (PEGATRON) [Kernel | Auto | Running] -- C:\Program Files (x86)\PHotkey\PEGAGFN.sys -- (PEGAGFN)
DRV - [2009/07/14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\virtualKeyboard@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\KavAntiBanner@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2011\FFExt\linkfilter@kaspersky.ru
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/08 15:58:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/13 23:25:37 | 000,000,000 | ---D | M]
 
[2011/10/15 13:48:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Extensions
[2012/01/27 12:23:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\zcvh1v1u.default\extensions
[2012/01/08 16:48:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/01/08 16:48:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\NAME\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZCVH1V1U.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
[2012/01/08 15:58:48 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/03/14 23:20:01 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011/09/29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/09/29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/09/29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/09/29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/09/29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/09/29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
Hosts file not found
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [fspuip] C:\Program Files\FSP\fspuip.exe (Sentelic Corporation)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
O4 - HKLM..\Run: [YouCam Tray] C:\Program Files (x86)\CyberLink\YouCam\YouCam.exe (CyberLink Corp.)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O9:64bit: - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9:64bit: - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - mmswsock.dll File not found
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - mmswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 134.102.20.20 134.102.200.14
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{08A69B5D-D8A6-445B-ADFE-7E205712D1A7}: DhcpNameServer = 134.102.20.20 134.102.200.14
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/01/28 12:44:40 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe
[2012/01/28 12:25:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F37384EF-94DE-41C3-A6DB-70303AA7A894}
[2012/01/28 12:25:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{76148F61-4269-4822-AB82-2FFB6B3E0BF9}
[2012/01/28 00:19:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{562517D7-ABE5-43A3-B01B-1EAD99AC6739}
[2012/01/28 00:19:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6F85C4C0-0C6D-4905-A87A-FE33ECDBECA1}
[2012/01/27 21:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/01/27 21:55:42 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/01/27 21:12:12 | 000,000,000 | ---D | C] -- C:\Windows\de
[2012/01/27 21:11:19 | 000,000,000 | ---D | C] -- C:\Windows\da
[2012/01/27 21:11:13 | 000,000,000 | ---D | C] -- C:\Windows\el
[2012/01/27 21:11:08 | 000,000,000 | ---D | C] -- C:\Windows\en
[2012/01/27 21:11:03 | 000,000,000 | ---D | C] -- C:\Windows\es
[2012/01/27 21:10:58 | 000,000,000 | ---D | C] -- C:\Windows\fr
[2012/01/27 21:10:52 | 000,000,000 | ---D | C] -- C:\Windows\hu
[2012/01/27 21:10:46 | 000,000,000 | ---D | C] -- C:\Windows\it
[2012/01/27 21:10:41 | 000,000,000 | ---D | C] -- C:\Windows\nl
[2012/01/27 21:10:37 | 000,000,000 | ---D | C] -- C:\Windows\pl
[2012/01/27 21:10:32 | 000,000,000 | ---D | C] -- C:\Windows\sl
[2012/01/27 21:10:26 | 000,000,000 | ---D | C] -- C:\Windows\tr
[2012/01/27 21:01:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C83509EF-EEB2-425D-B45C-35E35041C2CC}
[2012/01/27 21:01:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5DF17BBD-F7D6-4146-A09E-3FB9AB41DDF1}
[2012/01/27 17:01:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{59E925D5-2C77-4D84-A46A-0238AD4219E5}
[2012/01/27 17:01:06 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FE42A2F9-4827-43B7-9D38-FF7B00AA0F64}
[2012/01/27 14:45:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BC5A62B2-E73D-448D-B809-B93533A29EA1}
[2012/01/27 14:44:55 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1CE72B76-3BCC-445D-AB16-586AFA594A89}
[2012/01/27 12:13:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{713D0F20-DBA2-4DF8-A9B3-260C1155D87B}
[2012/01/27 12:12:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3D6F7B15-3BF4-4957-B0A6-4AF9771827A2}
[2012/01/26 19:49:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{79EBF8D7-A99A-4EF8-91A9-5860C5FD8D6A}
[2012/01/26 19:49:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CBE189A0-018F-48FD-8D1F-CFEE034B55CD}
[2012/01/26 18:52:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012/01/26 15:41:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{58A2E041-F89D-47AD-ABD0-B64825D5C32E}
[2012/01/26 15:41:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9F68E7AA-5B57-4A15-9F8C-95BF4E8B826C}
[2012/01/26 11:10:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0B065473-D183-40A9-BF51-D7AF5FE42764}
[2012/01/26 11:10:46 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D47F5E29-69A4-4D2C-BFED-D764588D6BA2}
[2012/01/26 00:46:50 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1B3F01B6-E011-492C-AEE9-E3635988433F}
[2012/01/26 00:46:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{06048322-3C53-446D-9690-BED9DFE5910B}
[2012/01/26 00:35:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Malwarebytes
[2012/01/26 00:35:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/01/26 00:35:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/01/26 00:35:45 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012/01/26 00:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/01/26 00:33:43 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Avira
[2012/01/26 00:21:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2012/01/26 00:21:06 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys
[2012/01/26 00:21:06 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2012/01/26 00:21:06 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2012/01/26 00:21:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2012/01/26 00:21:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2012/01/26 00:20:20 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/01/25 23:57:40 | 000,000,000 | ---D | C] -- C:\Windows\system64
[2012/01/25 16:53:59 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{55997E05-8748-4BBE-A61E-101EC672A13E}
[2012/01/25 16:53:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4580B02E-046F-4F00-8B60-2E966EBE9204}
[2012/01/25 12:32:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4A2FC7A5-3F1C-47A3-9B81-23EE650B22C2}
[2012/01/25 12:31:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9A113D39-BF6B-462A-9CE8-838AD95F5C2E}
[2012/01/25 08:49:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5BA694F6-FE25-4CFC-926F-61B0E1007DF4}
[2012/01/25 08:49:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0DA424CC-4772-40D0-A7D8-CBC67C2DB753}
[2012/01/24 18:14:18 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{075297A6-52EC-4869-BC2A-F235DACD7166}
[2012/01/24 18:12:59 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CF3020A4-E6E7-4E77-9841-E69D31D1F2F4}
[2012/01/24 14:00:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D3741F08-4468-47D9-951D-517A4F3BB7B9}
[2012/01/24 14:00:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{78728ECE-CCE3-4824-9BFA-3FB7B4D21A83}
[2012/01/23 19:41:01 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{53AA79A9-2FBC-42FF-91BB-9775CC4DF73A}
[2012/01/23 19:40:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{681217EE-C521-471D-9108-B1656CD36FF1}
[2012/01/23 19:17:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E10C5C07-2404-4281-A88E-90B0BDF38B40}
[2012/01/23 19:17:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2FE1BBBF-1127-49BD-A67E-EE93B1F22DD4}
[2012/01/23 12:57:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C4E2A4D-C1AC-4F68-AF4B-70AB731C2C56}
[2012/01/23 12:56:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{05B4F51C-1AF2-4987-BD6A-6BACD2CA8BCE}
[2012/01/23 12:38:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{82B55834-90D0-4FC7-8857-A27B01EFF66A}
[2012/01/23 12:38:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C1F4AF55-98A3-4D48-BDDF-D3631E855252}
[2012/01/23 10:21:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{55FD0A3D-F4CB-4DEB-A219-0FE56863EC08}
[2012/01/23 07:38:50 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\InfoManagement
[2012/01/23 07:15:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DC564A1A-0724-4DE4-9DF9-9AD7AEC4B81F}
[2012/01/23 07:15:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{5E3A1586-A524-4419-BFB3-9DC126442A14}
[2012/01/22 21:16:10 | 000,719,872 | ---- | C] (Abysmal Software) -- C:\Windows\SysWow64\devil.dll
[2012/01/22 21:16:10 | 000,369,152 | ---- | C] (The Public) -- C:\Windows\SysWow64\avisynth.dll
[2012/01/22 21:16:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll
[2012/01/22 21:16:10 | 000,070,656 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\i420vfw.dll
[2012/01/22 21:16:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AviSynth 2.5
[2012/01/22 16:46:44 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4FC3DE91-FFD5-4953-89E0-5466FC838C24}
[2012/01/22 11:48:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{01FBE301-6BB0-4DF8-8D52-23D7AA93DA9F}
[2012/01/22 11:48:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{963486C6-53F7-46AF-8A7A-4156C12FB6E3}
[2012/01/21 20:54:41 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\INFO
[2012/01/21 18:20:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{93F2CA55-93A9-4CCF-B9D9-DF6735DD88BA}
[2012/01/21 18:20:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{106EC069-7742-447C-A7AD-03DD96723E8A}
[2012/01/21 11:14:54 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{25B0AE42-E9BF-4925-B6CA-FBB8A49519CA}
[2012/01/21 11:14:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{07F74A73-B078-4A7E-9B55-E25798E0709C}
[2012/01/20 18:34:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{73CDAE95-0805-46A0-8D80-87314BCB3570}
[2012/01/20 18:34:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{552AB41C-93A1-46E0-A8FC-07C0F4543573}
[2012/01/20 13:21:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E1ECC40A-18AC-44E9-A63B-3556D8394113}
[2012/01/20 13:21:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C28D815-1F6A-4BB2-ADF5-D94E91174058}
[2012/01/20 06:38:53 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DCF4C6F0-5B05-430B-AAA4-447B7D8CA0D7}
[2012/01/20 06:37:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{985D0795-93C8-4371-99AB-16B3808E41AE}
[2012/01/19 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D10D66F7-0080-4DD1-A08D-23E7DE6B756E}
[2012/01/19 18:42:34 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{151D36EB-552C-491C-B25E-B15D0910B7DE}
[2012/01/19 11:20:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1EEC3C88-AC13-444E-AE5D-35CB769A95C2}
[2012/01/19 11:20:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7724DAE4-D818-458B-AF77-361918FA1F56}
[2012/01/19 07:13:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{087200FC-0534-46AF-B066-ACA1D34261A3}
[2012/01/19 07:12:55 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{787AA54A-D91D-4D19-AA5E-2646760A815E}
[2012/01/18 17:52:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{90844F29-1B1E-461E-A7D9-B3DEBA8B5DE9}
[2012/01/18 17:51:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{012B8C24-9FD5-416C-B479-93801C1D41B1}
[2012/01/18 11:40:22 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2F6557BE-E42E-478D-BF25-5085C2FEBE1B}
[2012/01/18 06:39:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A36A6840-A6FD-4222-A252-83C40C282E61}
[2012/01/18 06:39:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F47CC142-D76B-49BF-897F-65434E5E0398}
[2012/01/17 19:05:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8F1FDDE2-3EE9-4A8C-8C49-89FAE37F32D8}
[2012/01/17 19:04:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{38467C79-E699-43BD-A221-CB8EA7E3AE23}
[2012/01/17 12:32:06 | 000,000,000 | ---D | C] -- C:\Users\Name\Documents\HausArbeit
[2012/01/17 09:57:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7E91D8B-7BA5-4A63-840D-6EDAFAE2D777}
[2012/01/17 09:57:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{077167FB-1FA7-4B72-96E0-EC8421BE2E9C}
[2012/01/16 12:08:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7C0BED1E-76E3-44B0-9709-51182CC3A83E}
[2012/01/16 12:08:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8BE1B165-CD4E-43B2-9DF7-0C8C4C2F159D}
[2012/01/15 21:42:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7916DC16-26DB-4438-9CB2-CD8247C289AF}
[2012/01/15 14:35:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9DC42DD4-87DC-4428-B4E5-9E940B0289C9}
[2012/01/15 14:34:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A4C128AE-19D2-4504-83DF-F87897698949}
[2012/01/15 10:36:34 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0EB8C83D-640C-4C1B-9A0B-FDF26359D0FA}
[2012/01/15 10:36:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E634D95B-5F7B-41BD-AD93-99E8C2322812}
[2012/01/14 21:26:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FB188AA2-5DE6-44CB-A967-84A3FBC6F242}
[2012/01/14 21:25:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0AC8FFD8-E122-4702-B7ED-DD3113D4A488}
[2012/01/14 20:52:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FB40D128-33A4-49AB-B554-340D437A41A0}
[2012/01/14 20:52:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D258351A-67B6-44E3-9354-3287858EF0EC}
[2012/01/14 19:09:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8DAE6BB2-B5CE-420B-B782-F777CC1D3CF2}
[2012/01/14 19:09:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FDF56268-E58E-456E-BDFB-1C15D137090B}
[2012/01/14 11:55:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{20E4F515-ED4A-440D-AB16-F7F94E23A76E}
[2012/01/14 11:55:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3EBDC3D0-2AAC-4256-8A8F-35F96D11BED0}
[2012/01/14 05:49:51 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EBA2A271-5F55-4DDE-91EB-8C2FE6450321}
[2012/01/14 05:49:25 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9E581844-CA8B-492E-AB2B-76432B1DA5AD}
[2012/01/13 23:23:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FF48B2B2-7C53-4E9A-B1BE-E4B5E1930C02}
[2012/01/13 23:23:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6372E713-5B9E-4123-839F-7E0A93656335}
[2012/01/13 19:48:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{88520896-BCCE-4423-AC61-AD0BF5625CC1}
[2012/01/13 19:47:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{02F8AF4E-3C55-4562-A1ED-89E37D6684F9}
[2012/01/13 07:10:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{734F8B23-D070-41CB-940B-552872630EEF}
[2012/01/13 07:10:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2EC39BD4-ADC1-4B6E-A45C-06F5D60B2630}
[2012/01/12 22:40:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2E7B8048-6900-41C5-81D6-2CB52BE0A027}
[2012/01/12 22:38:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{025C6F73-9BE7-4A90-AC5B-5181525774FB}
[2012/01/12 18:22:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F18A4136-6B86-4534-AB94-2D9ED110D150}
[2012/01/12 18:22:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{65C3F495-58CC-44F7-9F18-8EDC79474148}
[2012/01/12 17:42:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{18362CA8-4972-4734-87B1-2CF56C8581A3}
[2012/01/12 17:41:54 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6DC73EFB-AA91-4924-9EB7-D43EBAEE1E2F}
[2012/01/12 10:23:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7949A92-3568-4DC0-8F7B-480D315A7A7B}
[2012/01/12 10:22:37 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{20B65AFA-15EC-4281-B65B-0200C43DC49D}
[2012/01/11 23:45:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{ABC33DA1-0654-4FC8-A6D9-4199507EF7E3}
[2012/01/11 23:45:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B51AA868-5E49-4BD6-A62E-591E54D16388}
[2012/01/11 17:06:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{F8F34AA7-16A5-4367-A097-F9FC8BAF88CB}
[2012/01/11 17:06:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C455BA2E-DAF2-4259-B104-F35F51C31FD0}
[2012/01/11 10:45:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{08DF7322-17C9-4598-BFD1-0C9472116F32}
[2012/01/11 07:39:45 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{54E378EF-5C9A-4C2F-94BC-DFCEE0261E19}
[2012/01/11 07:39:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7441AA74-3BD9-4A70-A0A7-60C63FACE73D}
[2012/01/10 18:27:16 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B509991A-CC11-4C56-A5B7-593233674755}
[2012/01/10 18:26:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{ECD75FA7-024B-42F5-AE83-ACB9AE40097F}
[2012/01/10 12:24:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0B15927F-1C5A-483E-8BCD-01830B084F8A}
[2012/01/10 12:23:57 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6C47875C-1691-49EF-8236-68BA4E80FF44}
[2012/01/10 07:15:00 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B077F6A3-BD59-4648-9527-C91E3918B795}
[2012/01/10 07:14:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{86EF6E6C-A99A-4EBD-B3F6-47857F0D146D}
[2012/01/09 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\MOLERAT
[2012/01/09 20:04:11 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{870B9006-C093-44EE-A58B-4B58E87D5669}
[2012/01/09 20:03:04 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0F4EE3DC-8152-45CF-87A5-50C469C0F0F5}
[2012/01/09 18:08:41 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1F58D9AF-0B8B-4EBA-80AA-2E54006B34C6}
[2012/01/09 18:05:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{00FD1B36-3362-4021-9E75-688EDA8EF7A6}
[2012/01/09 13:15:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\Babylon
[2012/01/09 13:15:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\Babylon
[2012/01/09 13:15:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/01/09 13:15:02 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\SysWow64\pncrt.dll
[2012/01/09 13:15:02 | 000,216,064 | RHS- | C] (MONOGRAM Multimedia, s.r.o.) -- C:\Windows\SysWow64\nbDX.dll
[2012/01/09 13:15:02 | 000,163,328 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\flvDX.dll
[2012/01/09 13:15:02 | 000,031,232 | RHS- | C] (Hans Mayerl) -- C:\Windows\SysWow64\msfDX.dll
[2012/01/09 13:15:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPER © - by eRightSoft
[2012/01/09 13:15:01 | 000,186,880 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLOgg.ax
[2012/01/09 13:15:01 | 000,179,200 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\DiracSplitter.ax
[2012/01/09 13:15:01 | 000,169,472 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\MatroskaDX.ax
[2012/01/09 13:15:01 | 000,161,792 | RHS- | C] (Gabest) -- C:\Windows\SysWow64\RealMediaDX.ax
[2012/01/09 13:15:01 | 000,123,904 | RHS- | C] (CoreCodec) -- C:\Windows\SysWow64\AVCDX.ax
[2012/01/09 13:15:01 | 000,092,672 | RHS- | C] (RadLight) -- C:\Windows\SysWow64\RLVorbisDec.ax
[2012/01/09 13:15:01 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSSplitter.ax
[2012/01/09 13:15:01 | 000,090,112 | RHS- | C] (-) -- C:\Windows\SysWow64\TTADSDecoder.ax
[2012/01/09 13:15:01 | 000,067,584 | RHS- | C] (RadLight, LLC) -- C:\Windows\SysWow64\RLTheoraDec.ax
[2012/01/09 13:14:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\eRightSoft
[2012/01/09 12:43:31 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\DeepSea
[2012/01/09 10:26:48 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BF9F75C5-A321-4C64-BBCE-8DDF0B22BCD9}
[2012/01/09 10:26:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0738CD8A-9C2E-4B68-99C9-D7AD7D76C36F}
[2012/01/08 22:03:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{28D95278-B083-4544-9B56-E0F6577C35E3}
[2012/01/08 22:03:08 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E3D496DB-F530-4D2B-BDF6-B561AB2F4A8C}
[2012/01/08 17:31:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\OpenOffice.org
[2012/01/08 16:53:49 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2012/01/08 16:50:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3
[2012/01/08 16:42:00 | 000,000,000 | ---D | C] -- C:\Users\Name\Desktop\OpenOffice.org 3.3 (de) Installation Files
[2012/01/08 15:58:20 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{50807FF6-A982-4ADD-8AA9-E6E4EBFEEA40}
[2012/01/08 15:58:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CC7AAC37-5676-4628-A585-5897DFFFA4DF}
[2012/01/08 15:50:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{23231AD8-AA06-47CC-BE53-ED23C814AEB5}
[2012/01/08 14:07:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4A0F40AA-CAC1-4AA1-A06E-BB4152371BCB}
[2012/01/08 14:07:02 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EEB54F66-665A-40EF-A24E-6996A42BE3EA}
[2012/01/08 12:54:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CBE01173-C368-4928-92FB-F447DD190107}
[2012/01/08 12:54:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{79B64606-FEF6-4247-8B3A-BD5B3BBA7677}
[2012/01/08 12:00:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2D17425E-C97F-492F-BE4D-A5AB1533EC16}
[2012/01/08 12:00:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DEC83360-8E55-4DC7-8296-571C18F07E38}
[2012/01/08 09:54:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{EB8CDC76-6033-487A-9AB1-4AD81FE8504F}
[2012/01/08 09:54:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{86A40474-EA77-4206-81EC-27A085E1E19F}
[2012/01/07 23:16:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7695C191-B112-4AED-9156-833505461784}
[2012/01/07 23:16:36 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{AC2D6E26-AB5F-4C98-AA84-1F9162C8404B}
[2012/01/07 20:20:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B220AC42-0E44-44D5-AE64-528A155EE4CF}
[2012/01/07 20:19:50 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3C393523-F8BD-4FC8-B089-BAD47F208A38}
[2012/01/07 18:20:32 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7D3B3BA3-C278-43EA-873A-B06196658B09}
[2012/01/07 18:20:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{2D969B14-6987-4C69-AE6D-413E8C74341B}
[2012/01/07 14:42:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9680E7A0-2C21-4913-B523-120A8276F1CD}
[2012/01/07 14:42:46 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A897B21E-13CA-455E-9110-8D1170184875}
[2012/01/07 12:46:23 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C02B0335-69D9-41CF-A78E-43B58882C9E8}
[2012/01/07 12:46:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{0A67A1C5-2918-4EFA-9524-8DB018F5BE8D}
[2012/01/07 12:34:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{76DF5757-B733-4B81-B188-D6445D696C67}
[2012/01/07 12:33:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{53F89AF4-ADCB-4351-890B-059110DE501C}
[2012/01/07 05:02:27 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A60EA959-597A-497B-8046-D17E2AC4D30A}
[2012/01/07 05:02:13 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DB12A308-6709-49B2-B37A-275B12F02FE5}
[2012/01/06 19:36:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{B02977AA-6CA4-4148-AC3B-0141D334F9E8}
[2012/01/06 19:36:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{57C234F0-FEAC-4614-8F94-D10F9E189B41}
[2012/01/06 19:10:39 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{8585443B-1AEB-45A0-AACA-1CFEAD9361B7}
[2012/01/06 19:10:29 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A7640988-F523-4DEB-910B-48E545D5A004}
[2012/01/06 16:14:30 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{36951613-4487-4014-9E9A-809444EF4FFB}
[2012/01/06 16:14:14 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{4FF8C3C7-C451-4CB3-97C6-C0CDCBDDF974}
[2012/01/06 06:35:52 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{6A5102AD-C5E7-4B5E-836B-669C3F661325}
[2012/01/06 06:35:31 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{7B5240BF-C7A4-4171-AF86-0826AAB3D71D}
[2012/01/05 21:10:03 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DC952AC6-1294-424E-AF05-1FB0BA1D04BE}
[2012/01/05 21:09:53 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{A3CA567C-D758-4570-B622-72EAD11A61E7}
[2012/01/05 16:01:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{BBE989D0-0DC4-40FD-8177-D54683ABA40D}
[2012/01/05 16:01:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1AD9FDC5-6BF8-4668-BB23-6F9E62EA8432}
[2012/01/05 11:28:40 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C5ECFBCE-2832-4BE4-BC18-412E96478ECC}
[2012/01/05 11:28:30 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{C04E954C-9BB5-4B0E-9067-672F5AB38C94}
[2012/01/05 11:14:28 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{1C94CD95-965A-4962-958A-799D6CA4AED8}
[2012/01/05 11:13:47 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9E9B1FB6-5491-4C13-924E-CC7EC5264FF6}
[2012/01/05 11:10:26 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{E23CE3F3-DFD8-40FD-AAC3-5E81372926C4}
[2012/01/05 11:10:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{D967B8A8-5E1F-4DF8-89A5-340AAAD07D2E}
[2012/01/05 07:07:33 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3CDA94B8-1C8E-47D5-9610-071251A181D6}
[2012/01/05 07:07:19 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FCF430D8-E194-4A1F-B826-C0608C24D85A}
[2012/01/04 18:24:48 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DF591C72-05FC-448A-ABC2-5313797A9276}
[2012/01/04 18:24:38 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{3044DD32-66B1-4279-9759-507A944B50A3}
[2012/01/04 17:43:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{083CAB9B-3BA5-4838-A6C6-55C04E423C18}
[2012/01/04 17:43:06 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9AE649B0-AC78-4DC1-804A-F53ED7019065}
[2012/01/04 16:26:14 | 000,000,000 | ---D | C] -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7-Dateien
[2012/01/04 16:24:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{CD2D7ED4-746E-45F2-B42A-03473368C15F}
[2012/01/04 16:24:24 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{72702D23-559C-4E09-A75E-FC325F4FBEF9}
[2012/01/04 15:13:05 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{9499312A-9CA8-49C3-8FF7-7064CF93E7DD}
[2012/01/04 12:56:49 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{AAD8515D-C7E8-4F8F-AC4A-1FA426C2DC7F}
[2012/01/04 12:56:37 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{DB85D1A8-16F6-4C9F-8784-9E2D6FDFE55C}
[2012/01/03 22:01:56 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{780C4619-0864-44E5-B091-B1D8634F562F}
[2012/01/03 22:01:12 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\{FAF94904-E5C3-4B83-BFCD-03859AFA6BD7}
[12 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/01/28 12:44:42 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe
[2012/01/28 12:31:18 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/28 12:31:17 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/28 12:23:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/01/28 12:23:29 | 3151,269,888 | -HS- | M] () -- C:\hiberfil.sys
[2012/01/28 04:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At9.job
[2012/01/28 03:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At7.job
[2012/01/28 02:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At5.job
[2012/01/28 01:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At3.job
[2012/01/28 00:17:36 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At35.job
[2012/01/28 00:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At1.job
[2012/01/27 23:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At47.job
[2012/01/27 22:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At45.job
[2012/01/27 21:59:20 | 000,084,884 | ---- | M] () -- C:\Users\Name\Documents\26.01.2011REG.reg
[2012/01/27 21:55:44 | 000,000,826 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/01/27 21:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At43.job
[2012/01/27 20:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At41.job
[2012/01/27 19:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At39.job
[2012/01/27 18:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At37.job
[2012/01/27 16:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At33.job
[2012/01/27 15:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At31.job
[2012/01/27 13:03:01 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At27.job
[2012/01/26 19:57:19 | 001,008,141 | ---- | M] () -- C:\Users\Name\Desktop\rkill.com
[2012/01/26 11:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At23.job
[2012/01/26 05:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At11.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At29.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At25.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At21.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At19.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At17.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At15.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At13.job
[2012/01/26 00:35:47 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/01/26 00:27:38 | 000,008,213 | ---- | M] () -- C:\ProgramData\22cd857d
[2012/01/26 00:27:38 | 000,008,205 | ---- | M] () -- C:\Users\Name\AppData\Roaming\b9f80375
[2012/01/26 00:27:37 | 000,008,203 | ---- | M] () -- C:\Users\Name\AppData\Local\1f1918cc
[2012/01/26 00:23:26 | 000,000,112 | ---- | M] () -- C:\ProgramData\3buCjUq.dat
[2012/01/26 00:21:12 | 000,002,070 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/01/23 01:08:42 | 000,000,017 | ---- | M] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012/01/13 23:25:38 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/01/11 16:07:56 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2012/01/11 10:50:43 | 001,591,890 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/01/11 10:50:43 | 000,697,314 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/01/11 10:50:43 | 000,652,592 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/01/11 10:50:43 | 000,148,320 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/01/11 10:50:43 | 000,121,266 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/01/11 10:50:32 | 001,591,890 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/01/09 21:39:44 | 000,071,792 | ---- | M] () -- C:\Users\Name\Desktop\DeformierbareKoerperPhysik.pdf
[2012/01/09 17:13:00 | 001,468,127 | ---- | M] () -- C:\Users\Name\Desktop\Presentation.odp
[2012/01/09 13:15:20 | 000,000,237 | ---- | M] () -- C:\user.js
[2012/01/09 10:25:01 | 000,318,144 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/01/08 21:28:06 | 000,011,897 | ---- | M] () -- C:\Users\Name\Documents\TestHA.odt
[2012/01/08 21:27:51 | 000,021,076 | ---- | M] () -- C:\Users\Name\Documents\HAUSARBEIT.odt
[2012/01/08 17:32:01 | 000,001,239 | ---- | M] () -- C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012/01/08 16:53:50 | 000,001,124 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2012/01/05 23:51:26 | 002,332,609 | ---- | M] () -- C:\Users\Name\Desktop\SAILFISHBRAINLOLOLOL.pdf
[2012/01/05 18:15:23 | 000,764,475 | ---- | M] () -- C:\Users\Name\Desktop\Kurs10_Craniota-Auge_vorl.pdf
[2012/01/04 16:26:17 | 000,028,098 | ---- | M] () -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7.htm
[12 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/01/27 21:59:13 | 000,084,884 | ---- | C] () -- C:\Users\Name\Documents\26.01.2011REG.reg
[2012/01/27 21:55:44 | 000,000,826 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012/01/26 19:56:55 | 001,008,141 | ---- | C] () -- C:\Users\Name\Desktop\rkill.com
[2012/01/26 00:35:47 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/01/26 00:21:12 | 000,002,070 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk
[2012/01/26 00:09:00 | 000,000,112 | ---- | C] () -- C:\ProgramData\3buCjUq.dat
[2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At47.job
[2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At45.job
[2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At43.job
[2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At41.job
[2012/01/26 00:08:59 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At39.job
[2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At37.job
[2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At35.job
[2012/01/26 00:08:58 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At33.job
[2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At31.job
[2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At29.job
[2012/01/26 00:08:57 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At27.job
[2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At25.job
[2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At23.job
[2012/01/26 00:08:56 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At21.job
[2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At19.job
[2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At17.job
[2012/01/26 00:08:55 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At15.job
[2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At9.job
[2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At7.job
[2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At13.job
[2012/01/26 00:08:54 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At11.job
[2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At5.job
[2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At3.job
[2012/01/26 00:08:53 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At1.job
[2012/01/25 23:55:09 | 000,008,213 | ---- | C] () -- C:\ProgramData\22cd857d
[2012/01/25 23:55:09 | 000,008,205 | ---- | C] () -- C:\Users\Name\AppData\Roaming\b9f80375
[2012/01/25 23:55:09 | 000,008,203 | ---- | C] () -- C:\Users\Name\AppData\Local\1f1918cc
[2012/01/23 01:08:42 | 000,000,017 | ---- | C] () -- C:\Windows\SysWow64\shortcut_ex.dat
[2012/01/22 21:16:10 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2012/01/13 22:54:17 | 000,002,023 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader X.lnk
[2012/01/09 21:39:44 | 000,071,792 | ---- | C] () -- C:\Users\Name\Desktop\DeformierbareKoerperPhysik.pdf
[2012/01/09 14:04:53 | 001,468,127 | ---- | C] () -- C:\Users\Name\Desktop\Presentation.odp
[2012/01/09 13:15:20 | 000,000,237 | ---- | C] () -- C:\user.js
[2012/01/09 13:15:02 | 000,121,344 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.ax
[2012/01/09 13:15:02 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2012/01/09 13:15:01 | 000,227,328 | RHS- | C] () -- C:\Windows\SysWow64\ac3DX.ax
[2012/01/09 13:15:01 | 000,175,104 | RHS- | C] () -- C:\Windows\SysWow64\CoreAAC.ax
[2012/01/09 13:15:01 | 000,120,832 | RHS- | C] () -- C:\Windows\SysWow64\MPCDx.ax
[2012/01/09 13:15:01 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\RLMPCDec.ax
[2012/01/09 13:15:01 | 000,097,280 | RHS- | C] () -- C:\Windows\SysWow64\FLACDX.ax
[2012/01/09 13:15:01 | 000,081,920 | RHS- | C] () -- C:\Windows\SysWow64\aac_parser.ax
[2012/01/09 13:15:01 | 000,070,656 | RHS- | C] () -- C:\Windows\SysWow64\RLAPEDec.ax
[2012/01/09 13:15:01 | 000,051,712 | RHS- | C] () -- C:\Windows\SysWow64\RLSpeexDec.ax
[2012/01/08 20:37:16 | 000,021,076 | ---- | C] () -- C:\Users\Name\Documents\HAUSARBEIT.odt
[2012/01/08 18:19:28 | 000,011,897 | ---- | C] () -- C:\Users\Name\Documents\TestHA.odt
[2012/01/08 17:32:01 | 000,001,239 | ---- | C] () -- C:\Users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
[2012/01/08 16:53:50 | 000,001,124 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk
[2012/01/05 23:51:26 | 002,332,609 | ---- | C] () -- C:\Users\Name\Desktop\SAILFISHBRAINLOLOLOL.pdf
[2012/01/05 18:15:23 | 000,764,475 | ---- | C] () -- C:\Users\Name\Desktop\Kurs10_Craniota-Auge_vorl.pdf
[2012/01/04 16:26:13 | 000,028,098 | ---- | C] () -- C:\Users\Name\Documents\Hochschule Bremen - Windows 7.htm
[2011/10/24 16:44:43 | 001,591,890 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/15 14:27:57 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2011/03/29 13:09:39 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011/03/29 13:09:38 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011/03/29 13:09:36 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2009/07/14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2012/01/09 13:15:03 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Babylon
[2011/10/17 20:33:41 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ManyCam
[2012/01/08 17:31:26 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org
[2012/01/26 05:07:21 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\SoftGrid Client
[2011/10/24 16:45:48 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TP
[2012/01/28 00:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At1.job
[2012/01/26 05:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At11.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At13.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At15.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At17.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At19.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At21.job
[2012/01/26 11:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At23.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At25.job
[2012/01/27 13:03:01 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At27.job
[2012/01/26 00:44:11 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At29.job
[2012/01/28 01:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At3.job
[2012/01/27 15:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At31.job
[2012/01/27 16:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At33.job
[2012/01/28 00:17:36 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At35.job
[2012/01/27 18:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At37.job
[2012/01/27 19:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At39.job
[2012/01/27 20:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At41.job
[2012/01/27 21:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At43.job
[2012/01/27 22:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At45.job
[2012/01/27 23:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At47.job
[2012/01/28 02:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At5.job
[2012/01/28 03:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At7.job
[2012/01/28 04:03:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At9.job
[2012/01/26 19:47:01 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/01/11 00:39:47 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2012/01/28 00:17:21 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2011/10/15 13:09:28 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011/03/29 13:22:47 | 000,000,000 | ---D | M] -- C:\Intel
[2011/12/18 00:09:50 | 000,000,000 | ---D | M] -- C:\LOSTVIKING
[2011/11/25 19:03:07 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2011/10/15 14:45:15 | 000,000,000 | ---D | M] -- C:\Musica
[2012/01/27 21:55:42 | 000,000,000 | R--D | M] -- C:\Program Files
[2012/01/27 22:01:33 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012/01/26 00:35:46 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2011/10/15 13:09:29 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012/01/28 12:49:09 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/01/11 00:39:38 | 000,000,000 | R--D | M] -- C:\Users
[2012/01/28 00:17:35 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\system64\drivers\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\system64\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\system64\drivers\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\system64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\system64\cngaudit.dll
[2009/07/14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/02/25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2011/01/16 15:55:21 | 000,255,488 | ---- | M] () MD5=3C33B26F2F7FA61D882515F2D6078691 -- C:\Users\Name\AppData\Local\Temp\RarSFX0\procs\explorer.exe
[2010/11/21 04:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/02/25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2005/08/16 01:54:58 | 000,001,536 | ---- | M] () MD5=ABC6379205DE2618851C4FCBF72112EB -- C:\Users\Name\AppData\Local\Temp\RarSFX0\h\explorer.exe
[2010/11/21 04:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\drivers\iaStor.sys
[2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\SysNative\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys
[2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\system64\drivers\iaStor.sys
[2010/11/06 07:45:48 | 000,438,808 | ---- | M] (Intel Corporation) MD5=D7921D5A870B11CC1ADAB198A519D50A -- C:\Windows\system64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_710b330fb3531234\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\system64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/21 04:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 07:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\system64\drivers\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\system64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 07:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\system64\netlogon.dll
[2010/11/21 04:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010/11/21 04:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 07:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\system64\drivers\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\system64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 07:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\system64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/21 04:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010/11/21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010/11/21 04:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\system64\scecli.dll
[2010/11/21 04:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/21 04:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\system64\user32.dll
[2010/11/21 04:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/21 04:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/05/26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Name\AppData\Local\Temp\RarSFX0\userinit.exe
[2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\system64\userinit.exe
[2010/11/21 04:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\system64\winlogon.exe
[2010/11/21 04:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/05/26 18:47:22 | 000,031,232 | ---- | M] (NirSoft) MD5=AC6094297CD882B8626466CDEB64F19F -- C:\Users\Name\AppData\Local\Temp\RarSFX0\winlogon.exe
[2011/12/24 17:50:20 | 000,182,856 | ---- | M] () MD5=B382935AB01B27D0E14F267DBF288896 -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\system64\drivers\ws2ifsl.sys
[2009/07/14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009/07/14 02:14:57 | 000,070,144 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\atl.dll
[2011/10/24 04:30:22 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2011/10/24 04:30:22 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
[2011/10/24 04:30:22 | 000,118,784 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\iepeers.dll
[12 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2012/01/28 12:48:49 | 001,572,864 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT
[2012/01/28 12:48:49 | 000,262,144 | -HS- | M] () -- C:\Users\Name\ntuser.dat.LOG1
[2011/10/15 13:16:29 | 000,000,000 | -HS- | M] () -- C:\Users\Name\ntuser.dat.LOG2
[2011/10/15 14:31:38 | 000,065,536 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011/10/15 14:31:38 | 000,524,288 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011/10/15 14:31:38 | 000,524,288 | -HS- | M] () -- C:\Users\Name\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011/10/15 13:16:29 | 000,000,020 | -HS- | M] () -- C:\Users\Name\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=consrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[C:\Windows\system64] -> \systemroot\system32 -> Mount Point

< End of report >
         
__________________

Alt 28.01.2012, 12:31   #4
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Extras.Txt

Code:
ATTFilter
OTL Extras logfile created on: 1/28/2012 12:47:16 PM - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\Name\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.91 Gb Total Physical Memory | 2.57 Gb Available Physical Memory | 65.68% Memory free
7.82 Gb Paging File | 6.24 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 434.66 Gb Total Space | 339.79 Gb Free Space | 78.17% Space Free | Partition Type: NTFS
Drive D: | 30.00 Gb Total Space | 3.55 Gb Free Space | 11.83% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: ELKARAJO | User Name: Name | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{19F09425-3C20-4730-9E2A-FC2E17C9F362}" = Windows Live Remote Service Resources
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1EB2CFC3-E1C5-4FC4-B1F8-549DD6242C67}" = Windows Live Remote Service Resources
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java(TM) 6 Update 24 (64-bit)
"{2F304EF4-0C31-47F4-8557-0641AAE4197C}" = Windows Live Remote Client Resources
"{456FB9B5-AFBC-4761-BBDC-BA6BAFBB818F}" = Windows Live Remote Client Resources
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5151E2DB-0748-4FD1-86A2-72E2F94F8BE7}" = Windows Live Remote Service Resources
"{5E2CD4FB-4538-4831-8176-05D653C3E6D4}" = Windows Live Remote Service Resources
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}" = Cisco Systems VPN Client 5.0.07.0440
"{5FEAD3E5-A158-4B66-B92B-0C959D7CF838}" = Windows Live Remote Service Resources
"{656DEEDE-F6AC-47CA-A568-A1B4E34B5760}" = Windows Live Remote Service Resources
"{692CCE55-9EAE-4F57-A834-092882E7FE0B}" = Windows Live Remote Client Resources
"{6C9D3F1D-DBBE-46F9-96A0-726CC72935AF}" = Windows Live Remote Service Resources
"{6CBFDC3C-CF21-4C02-A6DC-A5A2707FAF55}" = Windows Live Remote Service Resources
"{794E5C90-96E5-4413-B3F5-C803205AE30C}" = Intel(R) PROSet/Wireless WiFi Software
"{821B4CA1-D404-4CCA-AEA4-C7D3F40841B1}" = Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed
"{847B0532-55E3-4AAF-8D7B-E3A1A7CD17E5}" = Windows Live Remote Client Resources
"{850B8072-2EA7-4EDC-B930-7FE569495E76}" = Windows Live Remote Client Resources
"{8970AE69-40BE-4058-9916-0ACB1B974A3D}" = Windows Live Remote Client Resources
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8EB588BD-D398-40D0-ADF7-BE1CEEF7C116}" = Windows Live Remote Client Resources
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A679FBE4-BA2D-4514-8834-030982C8B31A}" = Windows Live Remote Service Resources
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 266.39
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 266.39
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B750FA38-7AB0-42CB-ACBB-E7DBE9FF603F}" = Windows Live Remote Client Resources
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C7B40C35-85AE-4303-9EEA-1A1EA779664D}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{C9F05151-95A9-4B9B-B534-1760E2D014A5}" = Windows Live Remote Client Resources
"{D1C1556C-7FF3-48A3-A5D6-7126F0FAFB66}" = Windows Live Remote Client Resources
"{D3E4F422-7E0F-49C7-8B00-F42490D7A385}" = Windows Live Remote Service Resources
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319
"{DBEDAF67-C5A3-4C91-951D-31F3FE63AF3F}" = Windows Live Remote Client Resources
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{E86906FF-C63D-4EAF-ACE7-5F8D55FBEA9A}" = Finger Sensing Pad Driver
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6CB2C5F-B2C1-4DF1-BF44-39D0DC06FE6F}" = Windows Live Remote Service Resources
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"ProInst" = Intel PROSet Wireless
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00884F14-05BD-4D8E-90E5-1ABF78948CA4}" = Windows Live Mesh
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{04668DF2-D32F-4555-9C7E-35523DCD6544}" = Control ActiveX de Windows Live Mesh para conexiones remotas
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05E379CC-F626-4E7D-8354-463865B303BF}" = Windows Live UX Platform Language Pack
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{09922FFE-D153-44AE-8B60-EA3CB8088F93}" = Windows Live UX Platform Language Pack
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0D261C88-454B-46FE-B43B-640E621BDA11}" = Windows Live Mail
"{0EC0B576-90F9-43C3-8FAD-A4902DF4B8F4}" = Galeria de Fotografias do Windows Live
"{10186F1A-6A14-43DF-A404-F0105D09BB07}" = Windows Live Mail
"{1203DC60-D9BD-44F9-B372-2B8F227E6094}" = Windows Live Temel Parçalar
"{14B441B7-774D-4170-98EA-A13667AE6218}" = Windows Live Writer Resources
"{17F99FCE-8F03-4439-860A-25C5A5434E18}" = Windows Live Essentials
"{198EA334-8A3F-4CB2-9D61-6C10B8168A6F}" = Windows Live Writer
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D6C2068-807F-4B76-A0C2-62ED05656593}" = Windows Live Writer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Medion Home Cinema
"{1FC83EAE-74C8-4C72-8400-2D8E40A017DE}" = Windows Live Writer
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{25A381E1-0AB9-4E7A-ACCE-BA49D519CF4E}" = Windows Live Mail
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2A07C35B-8384-4DA4-9A95-442B6C89A073}" = Windows Live Essentials
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2AD2DD70-27F7-4343-BB4E-DE50A32D854B}" = Windows Live Messenger
"{2F54E453-8C93-4B3B-936A-233C909E6CAC}" = Windows Live Messenger
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3125D9DE-8D7A-4987-95F3-8A42389833D8}" = Windows Live Writer Resources
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34319F1F-7CF2-4CC9-B357-1AE7D2FF3AC5}" = Windows Live
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{370F888E-42A7-4911-9E34-7D74632E17EB}" = Windows Live Photo Common
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3B9A92DA-6374-4872-B646-253F18624D5F}" = Windows Live Writer
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3F4143A1-9C21-4011-8679-3BC1014C6886}" = Windows Live Mesh
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{40BFD84C-64CD-42CC-9909-8734C50429C6}" = Windows Live UX Platform Language Pack
"{410DF0AA-882D-450D-9E1B-F5397ACFFA80}" = Windows Live Essentials
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{429DF1A0-3610-4E9E-8ACE-3C8AC1BA8FCA}" = Windows Live Photo Gallery
"{443B561F-DE1B-4DEF-ADD9-484B684653C7}" = Windows Live Messenger
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = CyberLink PowerRecover
"{46872828-6453-4138-BE1C-CE35FBF67978}" = Windows Live Mesh
"{48106FE4-B1AF-4941-BF3D-83E6C4B7CAF3}" = Alcor Micro USB Card Reader
"{48294D95-EE9A-4377-8213-44FC4265FB27}" = Windows Live Messenger
"{488F0347-C4A7-4374-91A7-30818BEDA710}" = Galerie de photos Windows Live
"{48C0DC5E-820A-44F2-890E-29B68EDD3C78}" = Windows Live Writer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B28D47A-5FF0-45F8-8745-11DC2A1C9D0F}" = Windows Live Writer
"{4B744C85-DBB1-4038-B989-4721EB22C582}" = Windows Live Messenger
"{4D141929-141B-4605-95D6-2B8650C1C6DA}" = Windows Live UX Platform Language Pack
"{506FC723-8E6C-4417-9CFF-351F99130425}" = Windows Live UX Platform Language Pack
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{523DF2BB-3A85-4047-9898-29DC8AEB7E69}" = Windows Live UX Platform Language Pack
"{5275D81E-83AD-4DE4-BC2B-6E6BA3A33244}" = Windows Live Writer Resources
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{55D003F4-9599-44BF-BA9E-95D060730DD3}" = Contrôle ActiveX Windows Live Mesh pour connexions à distance
"{57220148-3B2B-412A-A2E0-82B9DF423696}" = Windows Live Mesh ActiveX-objekt til fjernforbindelser
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{58D335B6-B3C6-4465-AEC3-6442BC323723}" = SharpKeys
"{5CF5B1A5-CBC3-42F0-8533-5A5090665862}" = Windows Live Mesh
"{5D273F60-0525-48BA-A5FB-D0CAA4A952AE}" = Windows Live Movie Maker
"{60C3C026-DB53-4DAB-8B97-7C1241F9A847}" = Windows Live Movie Maker
"{62687B11-58B5-4A18-9BC3-9DF4CE03F194}" = Windows Live Writer Resources
"{63CF7D0C-B6E7-4EE9-8253-816B613CC437}" = Windows Live Mail
"{640798A0-A4FB-4C52-AC72-755134767F1E}" = Windows Live Movie Maker
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{677AAD91-1790-4FC5-B285-0E6A9D65F7DC}" = Windows Live Mail
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE832B-A5C7-44C1-B697-3E123B7B4D5B}" = Windows Live Mesh
"{6B556C37-8919-4991-AC34-93D018B9EA49}" = Windows Live Photo Common
"{6DEC8BD5-7574-47FA-B080-492BBBE2FEA3}" = Windows Live Movie Maker
"{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}" = Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz
"{6E8AFC13-F7B8-41D8-88AB-F1D0CFC56305}" = Windows Live Messenger
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A81378-79D5-40CC-9BDC-380642D1A87F}" = Windows Live Writer
"{71C95134-F6A9-45E7-B7B3-07CA6012BF2A}" = Windows Live Mesh
"{7272F232-A7E0-4B2B-A5D2-71B7C5E2379C}" = Windows Live Fotótár
"{73FC3510-6421-40F7-9503-EDAE4D0CF70D}" = Windows Live Photo Common
"{7496FD31-E5CB-4AE4-82D3-31099558BF6A}" = Windows Live Mesh
"{74E8A7F6-575D-42C7-9178-E87D1B3BEFE8}" = Windows Live UX Platform Language Pack
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77477AEA-5757-47D8-8B33-939F43D82218}" = Windows Live UX Platform Language Pack
"{78DAE910-CA72-450E-AD22-772CB1A00678}" = Windows Live Mesh
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7BA19818-F717-4DFB-BC11-FAF17B2B8AEE}" = Pošta Windows Live
"{7D1C7B9F-2744-4388-B128-5C75B8BCCC84}" = Windows Live Essentials
"{7E017923-16F8-4E32-94EF-0A150BD196FE}" = Windows Live Writer
"{7E90B133-FF47-48BB-91B8-36FC5A548FE9}" = Windows Live Writer Resources
"{827D3E4A-0186-48B7-9801-7D1E9DD40C07}" = Windows Live Essentials
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{841F1FB4-FDF8-461C-A496-3E1CFD84C0B5}" = Windows Live Mesh
"{84267681-BF16-40B6-9564-27BC57D7D71C}" = Windows Live Photo Common
"{85373DA7-834E-4850-8AF5-1D99F7526857}" = Windows Live Photo Common
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF3891F-01B5-4A71-BFCD-20761890471C}" = Windows Live Messenger
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{93E464B3-D075-4989-87FD-A828B5C308B1}" = Windows Live Writer Resources
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BD262D0-B788-4546-A0A5-F4F56EC3834B}" = Windows Live Photo Common
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D3D8C60-A55F-4fed-B2B9-173F09590E16}" = REALTEK Wireless LAN Driver
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9FAE6E8D-E686-49F5-A574-0A58DFD9580C}" = Windows Live Mail
"{A0C91188-C88F-4E86-93E6-CD7C9A266649}" = Windows Live Mesh
"{A101F637-2E56-42C0-8E08-F1E9086BFAF3}" = Windows Live Movie Maker
"{A41A708E-3BE6-4561-855D-44027C1CF0F8}" = Windows Live Photo Common
"{A60B3BF0-954B-42AF-B8D8-2C1D34B613AA}" = Windows Live Photo Gallery
"{A7056D45-C63A-4FE4-A69D-FB54EF9B21BB}" = Windows Live Messenger
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA4D1C5E-116A-4FF4-AA91-28F526868203}" = watchmi
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{AB61A2E9-37D3-485D-9085-19FBDF8CEF4A}" = Windows Live Messenger
"{AC76BA86-7AD7-5464-3428-A00000000004}" = Spelling Dictionaries Support For Adobe Reader X
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X (10.1.2) MUI
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADE85655-8D1E-4E4B-BF88-5E312FB2C74F}" = Windows Live Mail
"{ADFE4AED-7F8E-4658-8D6E-742B15B9F120}" = Windows Live Photo Common
"{AFF7E080-1974-45BF-9310-10DE1A1F5ED0}" = Adobe AIR
"{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}" = Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B2E90616-C50D-4B89-A40D-92377AC669E5}" = Windows Live Messenger
"{B618C3BF-5142-4630-81DD-F96864F97C7E}" = Windows Live Essentials
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{BD695C2F-3EA0-4DA4-92D5-154072468721}" = Windows Live Fotoğraf Galerisi
"{BF022D76-9F72-4203-B8FA-6522DC66DFDA}" = Windows Live Movie Maker
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{C00C2A91-6CB3-483F-80B3-2958E29468F1}" = Συλλογή φωτογραφιών του Windows Live
"{C29FC15D-E84B-4EEC-8505-4DED94414C59}" = Windows Live Writer Resources
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C32CE55C-12BA-4951-8797-0967FDEF556F}" = Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}" = Windows Live Mesh ActiveX Control for Remote Connections
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C8421D85-CA0E-4E93-A9A9-B826C4FB88EA}" = Windows Live Mail
"{C893D8C0-1BA0-4517-B11C-E89B65E72F70}" = Windows Live Photo Common
"{CA227A9D-09BE-4BFB-9764-48FED2DA5454}" = Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CB7224D9-6DCA-43F1-8F83-6B1E39A00F92}" = Windows Live Movie Maker
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF671BFE-6BA3-44E7-98C1-500D9C51D947}" = Windows Live Photo Gallery
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D588365A-AE39-4F27-BDAE-B4E72C8E900C}" = Windows Live Mail
"{D6F25CF9-4E87-43EB-B324-C12BE9CDD668}" = Windows Live UX Platform Language Pack
"{DAEF48AD-89C8-4A93-B1DD-45B7E4FB6071}" = Windows Live Movie Maker
"{DB1208F4-B2FE-44E9-BFE6-8824DBD7891B}" = Windows Live Movie Maker
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{DE7C13A6-E4EA-4296-B0D5-5D7E8AD69501}" = Windows Live Writer
"{DE8F99FD-2FC7-4C98-AA67-2729FDE1F040}" = Windows Live Writer Resources
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DEF91E0F-D266-453D-B6F2-1BA002B40CB6}" = Windows Live Essentials
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E50C224A-BBF2-428D-9DCF-DBF9DF85C40E}" = PHotkey
"{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}" = Controlo ActiveX do Windows Live Mesh para Ligações Remotas
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E59969EA-3B5B-4B24-8B94-43842A7FBFE9}" = Fotogalerija Windows Live
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E5DD4723-FE0B-436E-A815-DC23CF902A0B}" = Windows Live UX Platform Language Pack
"{E727A662-AF9F-4DEE-81C5-F4A1686F3DFC}" = Windows Live Writer Resources
"{E8524B28-3BBB-4763-AC83-0E83FE31C350}" = Windows Live Writer
"{E85A4EFC-82F2-4CEE-8A8E-62FDAD353A66}" = Galería fotográfica de Windows Live
"{E9AD2143-26D5-4201-BED1-19DCC03B407D}" = Windows Live Messenger
"{E9D98402-21AB-4E9F-BF6B-47AF36EF7E97}" = Windows Live Writer Resources
"{ED16B700-D91F-44B0-867C-7EB5253CA38D}" = Raccolta foto di Windows Live
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}" = Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FCDE76CB-989D-4E32-9739-6A272D2B0ED7}" = Windows Live Mesh
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FEEF7F78-5876-438B-B554-C4CC426A4302}" = Windows Live Essentials
"{FF3DFA01-1E98-46B4-A065-DA8AD47C9598}" = Windows Live Movie Maker
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AmUStor" = Alcor Micro USB Card Reader
"Avira AntiVir Desktop" = Avira Free Antivirus
"ESET Online Scanner" = ESET Online Scanner v3
"GOM Player" = GOM Player
"GomTVStreamer" = GOMTV Streamer
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Medion Home Cinema
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = CyberLink PowerRecover
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10
"InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}" = CyberLink PowerDVD Copy
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.0.1800
"ManyCam" = ManyCam 2.6.60 (remove only)
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"muCommander" = muCommander (remove only)
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"StarCraft II" = StarCraft II
"Steam App 72850" = The Elder Scrolls V: Skyrim
"WinLiveSuite" = Windows Live Essentials
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 1/26/2012 1:51:57 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 1/26/2012 2:47:11 PM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description = 
 
Error - 1/26/2012 2:50:13 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 1/26/2012 2:57:53 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 1/26/2012 2:57:53 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 1/26/2012 2:57:56 PM | Computer Name = ElKarajo | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\Name\Downloads\esetsmartinstaller_enu.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 1/27/2012 7:09:36 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
 nicht initialisiert werden.  Details: Could not query the status of the EventSystem
 service.  System Error: Der Computer wird heruntergefahren.  .
 
Error - 1/27/2012 7:10:35 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description = 
 
Error - 1/27/2012 9:43:27 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description = 
 
Error - 1/27/2012 11:59:29 AM | Computer Name = ElKarajo | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 1/27/2012 11:19:43 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 1/27/2012 11:44:48 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 1/27/2012 11:57:54 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 1/27/2012 11:58:02 AM | Computer Name = ElKarajo | Source = DCOM | ID = 10010
Description = 
 
Error - 1/27/2012 11:59:18 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 1/27/2012 11:59:18 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Computerbrowser" wurde mit folgendem Fehler beendet:   %%1060
 
Error - 1/27/2012 11:59:20 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist 
von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 1/27/2012 11:59:20 AM | Computer Name = ElKarajo | Source = Service Control Manager | ID = 7003
Description = Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig:
 BFE. Dieser Dienst ist eventuell nicht installiert.
 
Error - 1/27/2012 11:59:34 AM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
Error - 1/27/2012 12:00:10 PM | Computer Name = ElKarajo | Source = Microsoft-Windows-DNS-Client | ID = 1012
Description = Fehler beim Lesen der Datei für lokale Hosts.
 
 
< End of report >
         
Hab meinen richtigen Namen jeweils mit "Name" ersetzt.

Alt 28.01.2012, 14:33   #5
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 28.01.2012, 16:26   #6
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Code:
ATTFilter
ComboFix 12-01-28.01 - Name 28.01.2012  16:49:00.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4007.2514 [GMT 1:00]
ausgeführt von:: c:\users\Name\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Outdated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\programdata\Roaming
c:\windows\assembly\temp\@
c:\windows\assembly\temp\bckfg.tmp
c:\windows\assembly\temp\cfg.ini
c:\windows\security\Database\tmp.edb
c:\windows\system32\java.exe
c:\windows\System64
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-12-28 bis 2012-01-28  ))))))))))))))))))))))))))))))
.
.
2012-01-28 15:54 . 2012-01-28 15:54	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2012-01-28 15:54 . 2012-01-28 15:54	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-01-27 20:55 . 2012-01-27 20:55	--------	d-----w-	c:\program files\CCleaner
2012-01-27 20:12 . 2012-01-27 20:12	--------	d-----w-	c:\windows\de
2012-01-27 20:11 . 2012-01-27 20:11	--------	d-----w-	c:\windows\da
2012-01-27 20:11 . 2012-01-27 20:11	--------	d-----w-	c:\windows\el
2012-01-27 20:11 . 2012-01-27 20:11	--------	d-----w-	c:\windows\en
2012-01-27 20:11 . 2012-01-27 20:11	--------	d-----w-	c:\windows\es
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\fr
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\hu
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\it
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\nl
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\pl
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\sl
2012-01-27 20:10 . 2012-01-27 20:10	--------	d-----w-	c:\windows\tr
2012-01-27 20:07 . 2012-01-27 20:07	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-01-27 20:04 . 2012-01-27 20:04	15712	----a-w-	c:\program files (x86)\Common Files\Windows Live\.cache\d667ecb91ccdd2e01\MeshBetaRemover.exe
2012-01-26 17:52 . 2012-01-26 17:52	--------	d-----w-	c:\program files (x86)\ESET
2012-01-25 23:35 . 2012-01-25 23:35	--------	d-----w-	c:\users\Name\AppData\Roaming\Malwarebytes
2012-01-25 23:35 . 2012-01-25 23:35	--------	d-----w-	c:\programdata\Malwarebytes
2012-01-25 23:35 . 2012-01-25 23:35	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-25 23:35 . 2011-12-10 14:24	23152	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-01-25 23:33 . 2012-01-25 23:33	--------	d-----w-	c:\users\Name\AppData\Roaming\Avira
2012-01-25 23:21 . 2011-12-15 14:00	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-01-25 23:21 . 2011-12-15 13:59	97312	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-01-25 23:21 . 2011-12-15 13:59	130760	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-01-25 23:21 . 2012-01-25 23:21	--------	d-----w-	c:\programdata\Avira
2012-01-25 23:21 . 2012-01-25 23:21	--------	d-----w-	c:\program files (x86)\Avira
2012-01-24 13:04 . 2012-01-06 05:15	8602168	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D77F066C-8EBF-4B68-9581-0F0B0884E8EC}\mpengine.dll
2012-01-22 20:16 . 2009-09-27 08:39	369152	----a-w-	c:\windows\SysWow64\avisynth.dll
2012-01-22 20:16 . 2005-07-14 11:31	32256	----a-w-	c:\windows\SysWow64\AVSredirect.dll
2012-01-22 20:16 . 2004-02-22 09:11	719872	----a-w-	c:\windows\SysWow64\devil.dll
2012-01-22 20:16 . 2004-01-24 23:00	70656	----a-w-	c:\windows\SysWow64\yv12vfw.dll
2012-01-22 20:16 . 2004-01-24 23:00	70656	----a-w-	c:\windows\SysWow64\i420vfw.dll
2012-01-22 20:16 . 2012-01-22 20:16	--------	d-----w-	c:\program files (x86)\AviSynth 2.5
2012-01-11 19:02 . 2012-01-11 19:02	0	----a-w-	c:\windows\SysWow64\sho17C8.tmp
2012-01-11 06:46 . 2011-10-26 05:25	1572864	----a-w-	c:\windows\system32\quartz.dll
2012-01-11 06:46 . 2011-10-26 05:25	366592	----a-w-	c:\windows\system32\qdvd.dll
2012-01-11 06:46 . 2011-10-26 04:32	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2012-01-11 06:46 . 2011-10-26 04:32	1328128	----a-w-	c:\windows\SysWow64\quartz.dll
2012-01-11 06:46 . 2011-11-17 06:41	1731920	----a-w-	c:\windows\system32\ntdll.dll
2012-01-11 06:46 . 2011-11-17 05:38	1292080	----a-w-	c:\windows\SysWow64\ntdll.dll
2012-01-11 06:46 . 2011-11-19 14:58	77312	----a-w-	c:\windows\system32\packager.dll
2012-01-11 06:46 . 2011-11-19 14:01	67072	----a-w-	c:\windows\SysWow64\packager.dll
2012-01-10 23:46 . 2012-01-10 23:46	0	----a-w-	c:\windows\SysWow64\sho43E9.tmp
2012-01-10 23:39 . 2012-01-10 23:39	--------	d-----w-	c:\users\Hallo
2012-01-09 12:14 . 2012-01-09 12:14	--------	d-----w-	c:\program files (x86)\eRightSoft
2012-01-08 16:31 . 2012-01-08 16:31	--------	d-----w-	c:\users\Name\AppData\Roaming\OpenOffice.org
2012-01-08 15:50 . 2012-01-08 15:51	--------	d-----w-	c:\program files (x86)\OpenOffice.org 3
2012-01-08 15:48 . 2011-03-14 22:20	472808	----a-w-	c:\program files (x86)\Mozilla Firefox\Plugins\npdeployJava1.dll
2012-01-08 14:58 . 2012-01-08 14:58	626688	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-08 14:58 . 2012-01-08 14:58	548864	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-08 14:58 . 2012-01-08 14:58	479232	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-08 14:58 . 2012-01-08 14:58	43992	----a-w-	c:\program files (x86)\Mozilla Firefox\mozutils.dll
2012-01-03 13:10 . 2012-01-03 13:10	182672	----a-w-	c:\program files (x86)\Mozilla Firefox\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-25 22:57 . 2011-11-29 11:17	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-12-20 13:41 . 2011-12-20 13:41	0	----a-w-	c:\windows\SysWow64\sho1B4F.tmp
2011-12-07 19:06 . 2011-12-07 19:06	0	----a-w-	c:\windows\SysWow64\sho2B0D.tmp
2011-11-29 00:10 . 2011-11-29 00:10	0	----a-w-	c:\windows\SysWow64\sho4330.tmp
2011-11-28 01:08 . 2011-11-28 01:08	0	----a-w-	c:\windows\SysWow64\sho9FEB.tmp
2011-11-27 20:01 . 2011-11-27 20:01	0	----a-w-	c:\windows\SysWow64\sho4300.tmp
2011-11-24 04:52 . 2011-12-14 17:24	3145216	----a-w-	c:\windows\system32\win32k.sys
2011-11-20 04:29 . 2011-11-20 04:29	0	----a-w-	c:\windows\SysWow64\sho3630.tmp
2011-11-16 19:03 . 2011-11-16 19:03	0	----a-w-	c:\windows\SysWow64\sho56D8.tmp
2011-11-15 13:29 . 2010-11-21 03:27	270720	------w-	c:\windows\system32\MpSigStub.exe
2011-11-14 00:44 . 2011-11-14 00:44	0	----a-w-	c:\windows\SysWow64\shoE6D8.tmp
2011-11-05 05:32 . 2011-12-14 17:24	2048	----a-w-	c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-14 17:24	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-14 19:02	2309120	----a-w-	c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-14 19:02	1390080	----a-w-	c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-14 19:02	1493504	----a-w-	c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-14 19:02	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-14 19:02	1798144	----a-w-	c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-14 19:02	1427456	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-14 19:02	1127424	----a-w-	c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-14 19:02	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
2011-11-03 01:30 . 2011-11-03 01:30	0	----a-w-	c:\windows\SysWow64\sho8B9F.tmp
2006-05-03 11:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 12:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 14:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 23:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2011-11-11 1242448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-05 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"YouCam Tray"="c:\program files (x86)\CyberLink\YouCam\YouCam.exe" [2010-10-29 224352]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2010-02-03 87336]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared files\brs.exe" [2010-11-29 75048]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-01-03 35736]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
c:\users\Hallo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\users\Name\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
watchmi tray.lnk - c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe [2011-10-15 300416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 CLKMSVC10_38F51D56;CyberLink Product - 2011/02/22 13:10;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [2010-11-29 241648]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 AMPPALP;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-02-11 1304912]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [x]
R3 fspad_xp64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_xp64;c:\windows\system32\drivers\fspad_xp64.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-02-04 340240]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMPPALR3;Intel® Centrino® Bluetooth 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-02-17 1133568]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-02-11 907600]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-02-11 997712]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-02-09 134928]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [x]
S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe [2010-10-07 159752]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-11-05 13336]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-02-17 1997416]
S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys [2009-09-11 14344]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
S3 AMPPAL;Intel(R) Centrino(R) Bluetooth 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
S3 fspad_wlh64;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh64;c:\windows\system32\DRIVERS\fspad_wlh64.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [x]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\DRIVERS\ManyCam_x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - CLKMDRV10_38F51D56
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-10 418840]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-02-04 1933584]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-02-11 10361616]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-02-17 316032]
"combofix"="c:\combofix\CF29404.3XE" [2010-11-21 345088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=MDND&bmod=MDND
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 134.102.20.20 134.102.200.14
FF - ProfilePath - c:\users\Name\AppData\Roaming\Mozilla\Firefox\Profiles\zcvh1v1u.default\
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=101641
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - fa252e12000000000000dca971048b17
FF - user.js: extensions.BabylonToolbar_i.hardId - fa252e12000000000000dca971048b17
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15348
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1713:15
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
HKLM-Run-fspuip - c:\program files (x86)\FSP\fspuip.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\PHotkey\ASLDRSrv.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe
c:\program files (x86)\PHotkey\PHotkey.exe
c:\program files (x86)\PHotkey\MsgTranAgt.exe
c:\program files (x86)\PHotkey\POSD.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-28  17:01:46 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-01-28 16:01
.
Vor Suchlauf: 8 Verzeichnis(se), 364.905.734.144 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 364.337.516.544 Bytes frei
.
- - End Of File - - A0679081370C63F0B448A92F5E29CA64
         
Danke für die schnelle Hilfe! Hab mich erstmal erschreckt, als nach dem Logfile sich kein Programm wegen fehlenden Registryschlüssel öffenen wollte, aber nach dem Neustart läuft wieder alles rund.

War es das erstmal? Was war denn das überhaupt für ein Werbungsvirus/Trojaner, kann man das sagen?

Alt 28.01.2012, 16:34   #7
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



hi, machst du mit dem pc onlinebanking, einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches?
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 28.01.2012, 16:38   #8
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Ja an sich schon, aber seit dem Virenbefall hab ich es nicht mehr gemacht.
Was gibt es zu beachten?

Alt 28.01.2012, 16:51   #9
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



hi,
1. bank anrufen, die notfall nummer für das wochenende sollte
116 116
sein.
lasse das banking wegen zero access rootkit sperren.
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neuinstallieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 28.01.2012, 17:10   #10
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Ok, hab das mit der Bank erledigt. Pc kann ich leider erst ab Montag formatieren, weil ich dummerweise die Recovery CD nicht bei mir habe...

Kann ich in der Zeit den PC für Recherche verwenden? Bzw. die Passwörter auch hier ändern, oder nur wenn das System formatiert ist?

Alt 28.01.2012, 17:15   #11
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



ne, was sollte es bringen von einem infiziertem pc aus die passwörter zu endern?
die müssen nach formatierung geendert werden, der pc sollte nur ans netz wenn es unbedingt nötig ist, passwörter sollte man am besten keine mehr eingeben.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 28.01.2012, 17:17   #12
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Ok, verdammt hätte nicht gedacht, dass dies so schwerwiegend ist.
Danke für die schnelle Hilfe, melde mich sobald ich das System formatiert habe.

Alt 28.01.2012, 17:19   #13
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



naja, wir haben es rechtzeitig festgestellt und dir ist kein schaden entstanden, das ist doch positiv
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 28.01.2012, 17:24   #14
HelpM3
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



Stimmt. Also vielen Dank nochmal! Wirklich sehr kompetente Hilfe!

Alt 28.01.2012, 17:26   #15
markusg
/// Malware-holic
 
Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Standard

Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch



kein problem, und trotz alle dem, nen schönes wochenende
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch
administrator, anti-malware, antiviren, automatisch, autostart, bietet, cleaner, dateien, dateisystem, explorer, firefox, gelöscht, heuristiks/extra, heuristiks/shuriken, logfiles, maßnahme, problem, quarantäne, seite, service, speicher, start, temp, test, version, werbeseite, wiederholt, öffnet



Ähnliche Themen: Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch


  1. Firefox 38.0.5 öffnet sich automatisch bei Windows-8.1-Start mit MSN-Deutschland-Website mit sonderbarer URL
    Plagegeister aller Art und deren Bekämpfung - 24.06.2015 (20)
  2. Nach Neuinstallation: Bei Firefox start öffnen sich immer WOT und Noscript automatisch
    Antiviren-, Firewall- und andere Schutzprogramme - 20.02.2015 (18)
  3. Bei jedem Rechner-Start öffnet sich automatisch Firefox mit Farmaster.Net-Seite
    Log-Analyse und Auswertung - 21.09.2014 (11)
  4. Firefox öffnet knapp 300 Tabs beim Start - Win 7,64 bit
    Plagegeister aller Art und deren Bekämpfung - 07.08.2014 (1)
  5. Firefox öffnet Werbeseite auf 123srv und zeigt Werbung von onlinebrowseradvertising
    Log-Analyse und Auswertung - 22.04.2014 (14)
  6. Nachdem Start öffnet sich Internet Explorer wiederholt und die Lautstärke geht nach unten...
    Plagegeister aller Art und deren Bekämpfung - 09.01.2014 (19)
  7. Beim Start von Firefox öffnet sich Nationzoom mit zusätzlichen Werbefenstern
    Log-Analyse und Auswertung - 27.12.2013 (3)
  8. Firefox Tab öffnet sich automatisch
    Log-Analyse und Auswertung - 25.10.2011 (17)
  9. Firefox öffnet ständig Werbefenster beim Start
    Log-Analyse und Auswertung - 29.08.2010 (8)
  10. Virus: Beim Start Grauer Bildschirm, Öffnet Werbung in Firefox und IE
    Plagegeister aller Art und deren Bekämpfung - 10.04.2010 (5)
  11. Werbeseite öffnet sich automatisch
    Log-Analyse und Auswertung - 27.08.2009 (2)
  12. cmd.exe öffnet sich beim start
    Plagegeister aller Art und deren Bekämpfung - 23.12.2008 (0)
  13. Firefox öffnet automatisch neue seiten beim surfen...
    Plagegeister aller Art und deren Bekämpfung - 07.11.2007 (3)
  14. Internet Explorer startet beim Start von Firefox automatisch
    Log-Analyse und Auswertung - 02.10.2007 (2)
  15. IE7, beim Start öffnet sich automatisch ein neuer Reiter
    Log-Analyse und Auswertung - 02.03.2007 (2)
  16. Programmordner öffnet sich bei jedem Start automatisch!!!
    Alles rund um Windows - 06.08.2006 (14)
  17. IExplorer bzw. SlimBrowser öffnet sich automatisch nach dem Start
    Log-Analyse und Auswertung - 01.09.2005 (13)

Zum Thema Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch - Hallo, also der Titel sagt eigentlich alles. Habe schon gegoogelt und Malwarebyt sowie CC Cleaner runtergeladen, aber selbst konnte ich das Problem nicht bereinigen. Die Seite bietet mir übrigens an - Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch...
Archiv
Du betrachtest: Werbeseite öffnet sich wiederholt beim Start von Firefox automatisch auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.