Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Windows security center meldung verlang 100 euro innerhalt von 24 stunden

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 05.02.2012, 21:33   #1
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hallo community,
ich hab seit gestern abend das gleiche problem wie schon einige vor mir hier im forum.
seit gestern habe ich ein ( ich denke was ich bis jetzt so herausfinden konnte ) trojaner auf meinem laptop.
bei jedem start von windows kommt nach kurzer zeit ein fenster über weißem hintergrund, was verlangt dass ich 100 euro bezahle, weil ich eine angeblich nicht lizensierte version von windows verwende.
ich habe windows vista 32 bit und befinde mich gerade im abgesicherten modus mit netzwerkverbindung, habe aber auch noch einen 2. laptop ( unbefallen ) neben mir, mit internetverbindung, falls das eine hilfe sein kann.
ich habe gelesen, dass ich mit otl eine analyse machen kann, und diese dann hier reinposte. das werde ich nun versuche.
ich wäre euch sehr dankbar, wenn ihr / einer sich meines problems annehmen könnte.
Vielen Dank schonmal

Alt 05.02.2012, 21:36   #2
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hi,
neustarten, f8 drücken abgesicherter modus mit netzwerk wählen.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________

Alt 05.02.2012, 21:57   #3
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



das ist der text aus der OTL.Txt . wo genau finde ich die Extra.Txt ?
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 05.02.2012 21:38:11 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\nils\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,50 Gb Available Physical Memory | 83,61% Memory free
6,18 Gb Paging File | 5,89 Gb Available in Paging File | 95,24% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 49,35 Gb Free Space | 34,25% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
Drive E: | 3,46 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: NILS-PC | User Name: nils | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.05 21:23:15 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
PRC - [2010.04.29 18:10:36 | 000,308,560 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2006.10.22 15:29:48 | 000,014,456 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32Info.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2007.05.10 16:50:00 | 000,017,024 | ---- | M] () -- C:\Programme\Adobe\Reader 8.0\Reader\ViewerPS.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.02 14:07:38 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.12.02 14:07:38 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2011.01.08 08:17:46 | 000,087,336 | ---- | M] (Dassault Systèmes SolidWorks Corp.) [On_Demand | Stopped] -- C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe -- (CoordinatorServiceHost)
SRV - [2010.06.02 15:58:20 | 000,246,520 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.04.29 18:10:36 | 000,308,560 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe -- (BgLiveSvc)
SRV - [2010.04.29 18:10:35 | 000,079,184 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsMain.dll -- (BgMainSvc)
SRV - [2010.03.16 16:01:22 | 000,132,464 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\System32\SUPDSvc.exe -- (Samsung UPD Service)
SRV - [2010.02.24 02:55:00 | 003,506,124 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2010.02.15 16:54:48 | 000,341,328 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsFire.dll -- (BsFire)
SRV - [2009.04.16 13:20:18 | 000,087,376 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsMailProxy.dll -- (BsMailProxy)
SRV - [2009.04.06 11:32:54 | 000,132,432 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsFileScan.dll -- (BsFileScan)
SRV - [2008.05.23 06:11:56 | 000,819,200 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008.05.23 05:43:52 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008.05.12 22:12:56 | 000,069,632 | ---- | M] (Ralink Technology, Corp.) [Auto | Stopped] -- C:\Programme\Hama\Common\RalinkRegistryWriter.exe -- (RalinkRegistryWriter)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2005.09.23 07:01:16 | 002,799,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.09.17 04:00:58 | 000,535,552 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.02.15 16:54:49 | 000,318,488 | R--- | M] (Agnitum Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AfwCore.sys -- (afwcore)
DRV - [2010.02.15 16:54:49 | 000,029,208 | R--- | M] (Agnitum Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\Afw.sys -- (afw)
DRV - [2009.12.30 11:49:55 | 000,039,808 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\Antirootkit\trufos.sys -- (Trufos)
DRV - [2009.12.30 11:49:54 | 000,014,720 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\Antirootkit\profos.sys -- (Profos)
DRV - [2009.12.08 19:19:22 | 000,113,664 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009.12.07 18:53:18 | 000,103,168 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.10.12 14:22:56 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009.04.22 13:28:06 | 000,009,728 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2009.04.22 13:28:06 | 000,003,072 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2009.01.23 14:48:56 | 000,055,504 | ---- | M] (BullGuard Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\BdFileSpy.sys -- (BdFileSpy)
DRV - [2008.12.29 05:57:54 | 000,003,205 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Users\nils\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS -- (ADDMEM)
DRV - [2008.07.31 12:27:00 | 000,641,024 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2008.07.27 04:24:00 | 007,548,000 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.05.20 20:36:12 | 003,663,360 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008.04.05 06:56:26 | 000,242,560 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmc302.sys -- (VMC302)
DRV - [2008.01.21 03:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007.09.13 07:17:58 | 000,755,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.05.23 09:13:10 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2006.11.28 08:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.02 08:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.6
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..keyword.URL: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.02 18:43:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.02 18:43:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{380AE6CB-09B9-4373-B360-D01C2462A6E7}: C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin [2011.02.28 02:56:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter [2011.02.28 02:56:41 | 000,000,000 | ---D | M]
 
[2008.12.26 14:10:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Extensions
[2012.02.05 21:32:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions
[2011.02.27 18:26:27 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009.09.09 17:40:43 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.04.24 15:36:15 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.06.18 18:15:31 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.31 19:29:11 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.08.31 18:59:51 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.06.24 13:51:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009.06.30 22:35:19 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\moveplayer@movenetworks.com
[2010.06.24 13:51:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\staged-xpis
[2012.02.01 22:02:48 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-1.xml
[2012.02.02 18:44:45 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-10.xml
[2010.08.07 16:53:16 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-2.xml
[2011.08.20 17:22:51 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-3.xml
[2011.09.03 19:00:20 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-4.xml
[2011.09.03 22:22:09 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-5.xml
[2011.10.30 16:55:44 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-6.xml
[2011.11.12 15:37:32 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-7.xml
[2011.11.13 15:23:25 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-8.xml
[2011.12.22 15:33:59 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-9.xml
[2010.06.25 20:12:58 | 000,001,056 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin.xml
[2011.07.25 12:03:40 | 000,000,358 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\winamp-search.xml
[2012.02.05 21:22:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.08.31 18:57:38 | 000,000,000 | ---D | M] (No name found) -- C:\PROGRAM FILES\COMMON FILES\DVDVIDEOSOFT\DLL\FFCONTEXTMENUY
[2009.02.17 17:45:38 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009.01.13 12:55:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009.01.15 18:22:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009.04.14 10:29:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.10.17 10:14:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009.12.04 09:51:16 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2011.01.06 09:46:10 | 000,258,560 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll
[2010.12.09 11:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2011.10.30 16:53:21 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.30 16:53:21 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.30 16:53:21 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.30 16:53:21 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.30 16:53:21 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe (BullGuard Ltd.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe (BullGuard Ltd.)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent File not found
O4 - HKCU..\Run: [vasja] C:\Users\nils\AppData\Local\Temp\0.20489175344035382.exe (Orb Networks)
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\nils\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - Reg Error: Value error. File not found
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A931EFA-EA32-42CA-843C-6BE2E974766F}: DhcpNameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20774398-3B2C-4368-810F-8C870350B212}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71281C8E-D8ED-45FB-AB21-6D57BFCB3BCB}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C5B74180-5A65-4DE2-96F9-18E00103AFCE}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DECB8486-47A8-4DB0-A326-AAD9748969B5}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\nils\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\nils\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{52ed63a8-82a7-11de-a6be-001377a946a6}\Shell\AutoRun\command - "" = F:\Toshiba\more4you.exe
O33 - MountPoints2\{77f80d2c-a5b0-11df-bc2c-001377a946a6}\Shell - "" = AutoRun
O33 - MountPoints2\{77f80d2c-a5b0-11df-bc2c-001377a946a6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{9a0f7241-e41b-11e0-ac18-854de3baf686}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f7241-e41b-11e0-ac18-854de3baf686}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9a0f7251-e41b-11e0-ac18-001e101ffb86}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f7251-e41b-11e0-ac18-001e101ffb86}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9a0f72e2-e41b-11e0-ac18-001e101f0781}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f72e2-e41b-11e0-ac18-001e101f0781}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ba1d55a0-29ff-11df-ad96-001377a946a6}\Shell - "" = AutoRun
O33 - MountPoints2\{ba1d55a0-29ff-11df-ad96-001377a946a6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{ddfc4793-b430-11df-821b-001377a946a6}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe SCHULNB1-PC05.vbs
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.06 03:41:22 | 000,201,288 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012.02.06 03:41:22 | 000,125,728 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2012.02.06 03:41:22 | 000,079,304 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012.02.06 03:41:22 | 000,040,488 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2012.02.06 03:41:22 | 000,035,240 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012.02.06 03:41:22 | 000,033,800 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2012.02.06 03:41:21 | 000,599,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vsp1cln.exe
[2012.02.06 03:41:20 | 000,054,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmProv.dll
[2012.02.06 03:41:20 | 000,001,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WsmCl.dll
[2012.02.06 03:41:17 | 000,114,688 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcod130.dll
[2012.02.06 03:41:16 | 000,113,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\LANGWRBK.DLL
[2012.02.05 21:23:06 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
[2012.02.05 20:13:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.02.05 20:13:30 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.02.05 18:54:13 | 000,000,000 | ---D | C] -- C:\Users\nils\AppData\Roaming\Skype
[2012.02.05 18:34:54 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.30 17:19:19 | 000,000,000 | R--D | C] -- C:\Users\nils\AppData\Roaming\Brother
[2012.01.18 21:21:05 | 000,000,000 | ---D | C] -- C:\Users\nils\Desktop\Filme von Clemens
[2012.01.12 03:19:49 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll
[2012.01.12 03:15:15 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll
[2012.01.12 03:15:08 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2012.01.12 03:14:17 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll
[2012.01.12 03:14:16 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll
[2012.01.07 14:47:49 | 000,000,000 | ---D | C] -- C:\Users\nils\Desktop\Belegarbeit-Greifer
[2006.11.24 06:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll
[2006.11.24 06:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.05 21:23:15 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
[2012.02.05 21:21:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.05 21:09:18 | 000,054,932 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.02.05 21:06:57 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\SupBackGroundTask.job
[2012.02.05 21:06:56 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 21:06:56 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 20:13:32 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.05 18:49:28 | 000,406,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.02.05 18:38:19 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5C27050C-199D-47BD-9FE4-97A1BFD3F44A}.job
[2012.02.05 18:18:06 | 000,001,178 | ---- | M] () -- C:\Windows\System32\dmlg.dat
[2012.02.05 01:23:16 | 000,063,488 | ---- | M] () -- C:\Users\nils\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.02 22:58:53 | 000,012,216 | ---- | M] () -- C:\Users\nils\Desktop\50471_231200326965769_1126273900_n.jpg
[2012.02.02 19:51:35 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.02.02 18:14:15 | 000,685,712 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.02 18:14:15 | 000,642,704 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.02 18:14:15 | 000,149,980 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.02 18:14:15 | 000,121,592 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.27 22:43:42 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.27 00:21:24 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.05 20:13:32 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.02 22:58:50 | 000,012,216 | ---- | C] () -- C:\Users\nils\Desktop\50471_231200326965769_1126273900_n.jpg
[2011.12.22 16:41:07 | 000,000,272 | ---- | C] () -- C:\Users\nils\AppData\Roaming\.backup.dm
[2011.12.02 14:30:41 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2011.09.28 22:24:36 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.09.28 22:24:36 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BXD7030.DAT
[2011.02.26 20:47:54 | 000,014,640 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2010.09.06 20:39:00 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2010.09.06 20:31:23 | 000,260,464 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2010.09.06 20:31:20 | 000,026,624 | ---- | C] () -- C:\Windows\System32\spd__l.dll
[2010.09.06 20:31:19 | 000,282,624 | ---- | C] () -- C:\Windows\System32\DscPnt.dll
[2010.03.06 00:04:39 | 000,054,932 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.03.05 23:03:10 | 000,054,932 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.03.04 03:31:06 | 000,000,680 | ---- | C] () -- C:\Users\nils\AppData\Local\d3d9caps.dat
[2009.09.11 15:58:58 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.11 15:58:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.06 18:41:18 | 001,663,488 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2009.08.06 18:41:18 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2009.08.06 18:41:18 | 000,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2009.08.06 18:41:18 | 000,009,728 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2009.08.06 18:41:18 | 000,003,072 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2009.02.17 17:51:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.01.24 19:29:10 | 000,001,178 | ---- | C] () -- C:\Windows\System32\dmlg.dat
[2008.12.26 14:27:53 | 000,063,488 | ---- | C] () -- C:\Users\nils\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.12.24 18:48:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.07.09 07:09:20 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.07.08 15:50:18 | 000,000,684 | ---- | C] () -- C:\Windows\HotFixList.ini
[2008.07.08 15:32:17 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2008.07.08 15:31:32 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2008.07.08 15:31:32 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2008.07.08 15:18:03 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe
[2008.07.08 15:18:02 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe
[2008.07.08 13:54:14 | 000,685,712 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.07.08 13:54:14 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.07.08 13:54:14 | 000,149,980 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.07.08 13:54:14 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.07.08 13:45:50 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.02.09 17:03:07 | 000,024,576 | ---- | C] () -- C:\Windows\System32\drivers\Marker.exe
[2007.02.26 08:49:12 | 006,139,774 | ---- | C] () -- C:\Windows\System32\imagine digital freedom.dat
[2007.02.15 08:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll
[2006.11.29 09:00:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\MAWebControl.exe
[2006.11.29 09:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,406,352 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,642,704 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,121,592 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.09 02:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll
[2005.01.17 08:10:16 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL
[2004.08.09 08:00:42 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI
[2001.11.14 04:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

< End of report >
         
--- --- ---
__________________

Alt 05.02.2012, 22:20   #4
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



entschuldigung, fehler meinerseits.
hier nochmals die dateien:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 05.02.2012 22:00:36 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\nils\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 81,04% Memory free
6,18 Gb Paging File | 5,87 Gb Available in Paging File | 94,94% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 49,28 Gb Free Space | 34,20% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
Drive E: | 3,46 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: NILS-PC | User Name: nils | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.05 21:23:15 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
PRC - [2010.04.29 18:10:36 | 000,308,560 | ---- | M] (BullGuard Ltd.) -- C:\Programme\BullGuard Ltd\BullGuard\BullGuardUpdate.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.09.16 19:18:06 | 000,132,608 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.02 14:07:38 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.12.02 14:07:38 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2011.01.08 08:17:46 | 000,087,336 | ---- | M] (Dassault Systèmes SolidWorks Corp.) [On_Demand | Stopped] -- C:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe -- (CoordinatorServiceHost)
SRV - [2010.06.02 15:58:20 | 000,246,520 | ---- | M] () [Auto | Stopped] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.04.29 18:10:36 | 000,308,560 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Program Files\BullGuard Ltd\BullGuard\BullGuardUpdate.exe -- (BgLiveSvc)
SRV - [2010.04.29 18:10:35 | 000,079,184 | ---- | M] (BullGuard Ltd.) [Auto | Running] -- C:\Programme\BullGuard Ltd\BullGuard\BsMain.dll -- (BgMainSvc)
SRV - [2010.03.16 16:01:22 | 000,132,464 | ---- | M] (Samsung Electronics CO., LTD.) [On_Demand | Stopped] -- C:\Windows\System32\SUPDSvc.exe -- (Samsung UPD Service)
SRV - [2010.02.24 02:55:00 | 003,506,124 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2010.02.15 16:54:48 | 000,341,328 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsFire.dll -- (BsFire)
SRV - [2009.04.16 13:20:18 | 000,087,376 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsMailProxy.dll -- (BsMailProxy)
SRV - [2009.04.06 11:32:54 | 000,132,432 | ---- | M] (BullGuard Ltd.) [Auto | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\BsFileScan.dll -- (BsFileScan)
SRV - [2008.05.23 06:11:56 | 000,819,200 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV - [2008.05.23 05:43:52 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV - [2008.05.12 22:12:56 | 000,069,632 | ---- | M] (Ralink Technology, Corp.) [Auto | Stopped] -- C:\Programme\Hama\Common\RalinkRegistryWriter.exe -- (RalinkRegistryWriter)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2005.09.23 07:01:16 | 002,799,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.09.17 04:00:58 | 000,535,552 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.02.15 16:54:49 | 000,318,488 | R--- | M] (Agnitum Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AfwCore.sys -- (afwcore)
DRV - [2010.02.15 16:54:49 | 000,029,208 | R--- | M] (Agnitum Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\Afw.sys -- (afw)
DRV - [2009.12.30 11:49:55 | 000,039,808 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\Antirootkit\trufos.sys -- (Trufos)
DRV - [2009.12.30 11:49:54 | 000,014,720 | ---- | M] (BitDefender S.R.L.) [Kernel | On_Demand | Stopped] -- C:\Programme\BullGuard Ltd\BullGuard\Antirootkit\profos.sys -- (Profos)
DRV - [2009.12.08 19:19:22 | 000,113,664 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009.12.07 18:53:18 | 000,103,168 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009.10.12 14:22:56 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009.04.22 13:28:06 | 000,009,728 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2009.04.22 13:28:06 | 000,003,072 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2009.01.23 14:48:56 | 000,055,504 | ---- | M] (BullGuard Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\BdFileSpy.sys -- (BdFileSpy)
DRV - [2008.12.29 05:57:54 | 000,003,205 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Users\nils\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS -- (ADDMEM)
DRV - [2008.07.31 12:27:00 | 000,641,024 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2008.07.27 04:24:00 | 007,548,000 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.05.20 20:36:12 | 003,663,360 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008.04.05 06:56:26 | 000,242,560 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmc302.sys -- (VMC302)
DRV - [2008.01.21 03:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2007.09.13 07:17:58 | 000,755,712 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.05.23 09:13:10 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2006.11.28 08:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.02 08:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:2.2.0.102
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.6
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1
FF - prefs.js..keyword.URL: "hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player:  File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.02.02 18:43:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.26\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.02.02 18:43:50 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{380AE6CB-09B9-4373-B360-D01C2462A6E7}: C:\Program Files\BullGuard Ltd\BullGuard\backup\thunderbirdbkplugin [2011.02.28 02:56:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Thunderbird\Extensions\\{0E810812-F4BB-4309-942A-755587587A5E}: C:\Program Files\BullGuard Ltd\BullGuard\antispam\tbspamfilter [2011.02.28 02:56:41 | 000,000,000 | ---D | M]
 
[2008.12.26 14:10:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Extensions
[2012.02.05 21:32:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions
[2011.02.27 18:26:27 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009.09.09 17:40:43 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.04.24 15:36:15 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2010.06.18 18:15:31 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.08.31 19:29:11 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.08.31 18:59:51 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.06.24 13:51:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009.06.30 22:35:19 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\moveplayer@movenetworks.com
[2010.06.24 13:51:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\nils\AppData\Roaming\mozilla\Firefox\Profiles\leb9tht1.default\extensions\staged-xpis
[2012.02.01 22:02:48 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-1.xml
[2012.02.02 18:44:45 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-10.xml
[2010.08.07 16:53:16 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-2.xml
[2011.08.20 17:22:51 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-3.xml
[2011.09.03 19:00:20 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-4.xml
[2011.09.03 22:22:09 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-5.xml
[2011.10.30 16:55:44 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-6.xml
[2011.11.12 15:37:32 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-7.xml
[2011.11.13 15:23:25 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-8.xml
[2011.12.22 15:33:59 | 000,000,950 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin-9.xml
[2010.06.25 20:12:58 | 000,001,056 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\icqplugin.xml
[2011.07.25 12:03:40 | 000,000,358 | ---- | M] () -- C:\Users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\searchplugins\winamp-search.xml
[2012.02.05 21:53:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.08.31 18:57:38 | 000,000,000 | ---D | M] (No name found) -- C:\PROGRAM FILES\COMMON FILES\DVDVIDEOSOFT\DLL\FFCONTEXTMENUY
[2009.02.17 17:45:38 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{B13721C7-F507-4982-B2E5-502A71474FED}
[2009.01.13 12:55:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2009.01.15 18:22:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
[2009.04.14 10:29:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
[2009.10.17 10:14:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2009.12.04 09:51:16 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2011.01.06 09:46:10 | 000,258,560 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll
[2010.12.09 11:47:06 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2011.10.30 16:53:21 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.30 16:53:21 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.30 16:53:21 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.30 16:53:21 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.30 16:53:21 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe (BullGuard Ltd.)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [BullGuard] C:\Program Files\BullGuard Ltd\BullGuard\bullguard.exe (BullGuard Ltd.)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent File not found
O4 - HKCU..\Run: [vasja] C:\Users\nils\AppData\Local\Temp\0.20489175344035382.exe (Orb Networks)
O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\nils\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Save YouTube Video as MP3 - Reg Error: Value error. File not found
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\Windows\System32\BGLsp.dll (BullGuard Ltd.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A931EFA-EA32-42CA-843C-6BE2E974766F}: DhcpNameServer = 193.189.244.225 193.189.244.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{20774398-3B2C-4368-810F-8C870350B212}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{71281C8E-D8ED-45FB-AB21-6D57BFCB3BCB}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C5B74180-5A65-4DE2-96F9-18E00103AFCE}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DECB8486-47A8-4DB0-A326-AAD9748969B5}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\nils\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\nils\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{52ed63a8-82a7-11de-a6be-001377a946a6}\Shell\AutoRun\command - "" = F:\Toshiba\more4you.exe
O33 - MountPoints2\{77f80d2c-a5b0-11df-bc2c-001377a946a6}\Shell - "" = AutoRun
O33 - MountPoints2\{77f80d2c-a5b0-11df-bc2c-001377a946a6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{9a0f7241-e41b-11e0-ac18-854de3baf686}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f7241-e41b-11e0-ac18-854de3baf686}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9a0f7251-e41b-11e0-ac18-001e101ffb86}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f7251-e41b-11e0-ac18-001e101ffb86}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{9a0f72e2-e41b-11e0-ac18-001e101f0781}\Shell - "" = AutoRun
O33 - MountPoints2\{9a0f72e2-e41b-11e0-ac18-001e101f0781}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ba1d55a0-29ff-11df-ad96-001377a946a6}\Shell - "" = AutoRun
O33 - MountPoints2\{ba1d55a0-29ff-11df-ad96-001377a946a6}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{ddfc4793-b430-11df-821b-001377a946a6}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe SCHULNB1-PC05.vbs
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0.3
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3BC20F2F-E0DC-1DDB-C740-9434FE16260C} - Java (Sun)
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5BE73DB6-2752-F124-87EE-F6D495AE6A17} - Microsoft Windows Media Player
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {BF2A1710-171F-D39F-19BD-4F32CCC0E20F} - Adobe Shockwave Director 11.0.3
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {D58F814F-D015-8ECD-A75F-ED817FD311A2} - Browser Customizations
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {DF24C517-6DB9-5D94-CE9F-EE3202EAB2F9} - Java (Sun)
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F03E6F3B-BB2D-67FC-9564-252A88703FB0} - Java (Sun)
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.06 03:41:22 | 000,201,288 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfehidk.sys
[2012.02.06 03:41:22 | 000,125,728 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\Mpfp.sys
[2012.02.06 03:41:22 | 000,079,304 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfeavfk.sys
[2012.02.06 03:41:22 | 000,040,488 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfesmfk.sys
[2012.02.06 03:41:22 | 000,035,240 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mfebopk.sys
[2012.02.06 03:41:22 | 000,033,800 | ---- | C] (McAfee, Inc.) -- C:\Windows\System32\drivers\mferkdk.sys
[2012.02.05 21:23:06 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
[2012.02.05 20:13:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.02.05 20:13:30 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.02.05 18:54:13 | 000,000,000 | ---D | C] -- C:\Users\nils\AppData\Roaming\Skype
[2012.02.05 18:34:54 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.30 17:19:19 | 000,000,000 | R--D | C] -- C:\Users\nils\AppData\Roaming\Brother
[2012.01.18 21:21:05 | 000,000,000 | ---D | C] -- C:\Users\nils\Desktop\Filme von Clemens
[2012.01.07 14:47:49 | 000,000,000 | ---D | C] -- C:\Users\nils\Desktop\Belegarbeit-Greifer
[2006.11.24 06:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll
[2006.11.24 06:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.05 21:44:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.05 21:42:42 | 000,054,932 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.02.05 21:42:40 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 21:42:40 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.05 21:42:40 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\SupBackGroundTask.job
[2012.02.05 21:23:15 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\nils\Desktop\OTL.exe
[2012.02.05 20:13:32 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.02.05 18:49:28 | 000,406,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.02.05 18:38:19 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{5C27050C-199D-47BD-9FE4-97A1BFD3F44A}.job
[2012.02.05 18:18:06 | 000,001,178 | ---- | M] () -- C:\Windows\System32\dmlg.dat
[2012.02.05 01:23:16 | 000,063,488 | ---- | M] () -- C:\Users\nils\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.02 19:51:35 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI
[2012.02.02 18:14:15 | 000,685,712 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.02.02 18:14:15 | 000,642,704 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.02.02 18:14:15 | 000,149,980 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.02.02 18:14:15 | 000,121,592 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.27 22:43:42 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.05 20:13:32 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.22 16:41:07 | 000,000,272 | ---- | C] () -- C:\Users\nils\AppData\Roaming\.backup.dm
[2011.12.02 14:30:41 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2011.09.28 22:24:36 | 000,000,432 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.09.28 22:24:36 | 000,000,034 | ---- | C] () -- C:\Windows\System32\BXD7030.DAT
[2011.02.26 20:47:54 | 000,014,640 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2010.09.06 20:39:00 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2010.09.06 20:31:23 | 000,260,464 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2010.09.06 20:31:20 | 000,026,624 | ---- | C] () -- C:\Windows\System32\spd__l.dll
[2010.09.06 20:31:19 | 000,282,624 | ---- | C] () -- C:\Windows\System32\DscPnt.dll
[2010.03.06 00:04:39 | 000,054,932 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.03.05 23:03:10 | 000,054,932 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.03.04 03:31:06 | 000,000,680 | ---- | C] () -- C:\Users\nils\AppData\Local\d3d9caps.dat
[2009.09.11 15:58:58 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.11 15:58:57 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.06 18:41:18 | 001,663,488 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2009.08.06 18:41:18 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2009.08.06 18:41:18 | 000,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2009.08.06 18:41:18 | 000,009,728 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2009.08.06 18:41:18 | 000,003,072 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2009.02.17 17:51:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2009.01.24 19:29:10 | 000,001,178 | ---- | C] () -- C:\Windows\System32\dmlg.dat
[2008.12.26 14:27:53 | 000,063,488 | ---- | C] () -- C:\Users\nils\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.12.24 18:48:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.07.09 07:09:20 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.07.08 15:50:18 | 000,000,684 | ---- | C] () -- C:\Windows\HotFixList.ini
[2008.07.08 15:32:17 | 000,307,200 | ---- | C] () -- C:\Windows\SetDisplayResolution.exe
[2008.07.08 15:31:32 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2008.07.08 15:31:32 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2008.07.08 15:18:03 | 000,040,960 | ---- | C] () -- C:\Windows\System32\IhDEV.exe
[2008.07.08 15:18:02 | 000,024,576 | ---- | C] () -- C:\Windows\System32\IhINF.exe
[2008.07.08 13:54:14 | 000,685,712 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.07.08 13:54:14 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.07.08 13:54:14 | 000,149,980 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.07.08 13:54:14 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2008.07.08 13:45:50 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.02.09 17:03:07 | 000,024,576 | ---- | C] () -- C:\Windows\System32\drivers\Marker.exe
[2007.02.26 08:49:12 | 006,139,774 | ---- | C] () -- C:\Windows\System32\imagine digital freedom.dat
[2007.02.15 08:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll
[2006.11.29 09:00:30 | 000,045,056 | ---- | C] () -- C:\Windows\System32\MAWebControl.exe
[2006.11.29 09:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,406,352 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,642,704 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,121,592 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.09 02:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll
[2005.01.17 08:10:16 | 000,045,056 | ---- | C] () -- C:\Windows\System32\BRTCPCON.DLL
[2004.08.09 08:00:42 | 000,000,114 | ---- | C] () -- C:\Windows\System32\BRLMW03A.INI
[2001.11.14 04:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll
 
========== LOP Check ==========
 
[2010.02.21 04:19:24 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\BullGuard
[2011.12.02 14:24:33 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\DassaultSystemes
[2011.12.22 15:53:30 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\DVDVideoSoft
[2011.12.22 15:53:17 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.07.26 21:30:08 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\ICQ
[2010.03.01 19:17:57 | 000,000,000 | -H-D | M] -- C:\Users\nils\AppData\Roaming\ijjigame
[2010.08.13 17:47:20 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\MAGIX
[2009.01.13 12:58:16 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\OpenOffice.org
[2010.01.23 14:13:48 | 000,000,000 | ---D | M] -- C:\Users\nils\AppData\Roaming\PDF Writer
[2012.01.27 22:43:43 | 000,032,534 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.02.05 21:42:40 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\SupBackGroundTask.job
[2012.02.05 18:38:19 | 000,000,416 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{5C27050C-199D-47BD-9FE4-97A1BFD3F44A}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2008.12.24 17:50:33 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2008.07.08 15:56:07 | 000,000,000 | ---D | M] -- C:\avs contents
[2010.03.03 21:22:56 | 000,000,000 | -HSD | M] -- C:\Boot
[2012.01.12 03:15:56 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.12.24 17:46:27 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.05.02 12:26:44 | 000,000,000 | ---D | M] -- C:\Games
[2010.02.27 14:45:26 | 000,000,000 | ---D | M] -- C:\ijji
[2008.07.08 15:11:45 | 000,000,000 | ---D | M] -- C:\Intel
[2009.01.20 12:36:05 | 000,000,000 | ---D | M] -- C:\maxga
[2008.07.08 15:39:12 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2008.07.08 15:26:32 | 000,000,000 | ---D | M] -- C:\MyWorks
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.02.05 20:13:30 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.02 14:24:33 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.12.24 17:46:27 | 000,000,000 | -HSD | M] -- C:\Programme
[2008.07.08 15:36:25 | 000,000,000 | ---D | M] -- C:\Samsung
[2011.12.02 11:53:39 | 000,000,000 | ---D | M] -- C:\SolidWorks Admin
[2011.12.02 14:25:45 | 000,000,000 | ---D | M] -- C:\SolidWorks Data
[2012.02.05 06:25:00 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.02.02 19:34:21 | 000,000,000 | ---D | M] -- C:\Temp
[2008.12.24 17:47:11 | 000,000,000 | R--D | M] -- C:\Users
[2012.02.05 21:17:05 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2008.06.16 13:38:28 | 000,396,312 | ---- | M] (Intel Corporation) MD5=DB0C1076AB442C09D2A3AB0410DBEA0D -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2008.06.16 13:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2008.06.16 13:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\drivers\iaStor.sys
[2008.06.16 13:38:10 | 000,318,488 | ---- | M] (Intel Corporation) MD5=F263A9036F8897FFA2AE54685E03AD60 -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_3506096f\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.02.05 22:00:40 | 002,883,584 | -HS- | M] () -- C:\Users\nils\ntuser.dat
[2012.02.05 22:00:40 | 000,262,144 | -H-- | M] () -- C:\Users\nils\ntuser.dat.LOG1
[2012.02.05 18:58:04 | 000,262,144 | -H-- | M] () -- C:\Users\nils\ntuser.dat.LOG2
[2011.07.25 10:02:25 | 000,065,536 | -HS- | M] () -- C:\Users\nils\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2011.07.25 10:02:25 | 000,524,288 | -HS- | M] () -- C:\Users\nils\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2008.12.24 17:51:25 | 000,524,288 | -HS- | M] () -- C:\Users\nils\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2012.02.05 18:58:04 | 001,048,576 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167b-b6ac-11e0-9d60-001377a946a6}.TxR.0.regtrans-ms
[2012.02.05 18:58:04 | 001,048,576 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167b-b6ac-11e0-9d60-001377a946a6}.TxR.1.regtrans-ms
[2012.02.05 18:58:04 | 001,048,576 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167b-b6ac-11e0-9d60-001377a946a6}.TxR.2.regtrans-ms
[2012.02.05 18:58:04 | 000,065,536 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167b-b6ac-11e0-9d60-001377a946a6}.TxR.blf
[2012.02.05 21:41:48 | 000,065,536 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167c-b6ac-11e0-9d60-001377a946a6}.TM.blf
[2012.02.05 21:41:48 | 000,524,288 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167c-b6ac-11e0-9d60-001377a946a6}.TMContainer00000000000000000001.regtrans-ms
[2011.07.26 22:17:10 | 000,524,288 | -HS- | M] () -- C:\Users\nils\ntuser.dat{a171167c-b6ac-11e0-9d60-001377a946a6}.TMContainer00000000000000000002.regtrans-ms
[2008.12.24 17:47:12 | 000,000,020 | -HS- | M] () -- C:\Users\nils\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 05.02.2012 22:00:36 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Users\nils\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 81,04% Memory free
6,18 Gb Paging File | 5,87 Gb Available in Paging File | 94,94% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 49,28 Gb Free Space | 34,20% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
Drive E: | 3,46 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
 
Computer Name: NILS-PC | User Name: nils | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{141FF6EE-440B-4104-9C9B-3369F0BCD85A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{185F36FF-DF12-4C80-B87B-932981201BE8}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{2488FE67-F639-42CF-88E0-21CEA3204226}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{38575506-895F-4413-BE73-B973DE82D3C7}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{475208E7-9E1D-4851-9D0A-0A0F3E91FA9A}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{4EBD0B76-9588-4B8B-A763-D7146986A403}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{6C4784A5-9A4C-4C9B-A659-317697B7F6D4}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{860528C0-1C43-451D-BB79-49790F51A20E}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{86190AC8-E4DA-41B8-AA22-5A4CF0E5A4C9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{8751C9CD-D6DF-4EE7-80FF-C6FB9922D016}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A18703DC-527B-451F-9C41-E15F326FC28B}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{A9BFADCA-0D2E-40B6-AC45-B43234D5942D}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{AE696883-3542-40D3-9D6D-216B0A379D2A}" = rport=2869 | protocol=6 | dir=out | app=system | 
"{C30047AA-07A1-497F-A899-45B80CEC457B}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{C989783A-DA0D-46C7-95FA-615DD2489CD8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D19306E4-D8F7-49FD-9D9B-29A492D45B30}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{E0F18376-F1E7-4603-81C9-6688EDF26ACA}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{E72EF419-FBBE-420A-B987-5785C2D17AE2}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{F6D87FAA-CA91-482B-AAD8-1CBCE14FC4E1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A935A0C-C61E-4DD5-9A9F-35C240E3668D}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{0EFFE7DA-6598-435E-985B-FAE032875D23}" = protocol=6 | dir=in | app=c:\maxga\snowboundonline\run.exe | 
"{10704E8D-02CE-4E10-92A4-BA7A1344DEE4}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{1495F092-7D7A-448F-AC72-75784B2910D2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{14EAC7F6-0134-47A4-82FB-E65CB7F4BB46}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 | 
"{196773AA-49A9-4B58-BFF2-6A1BA4A9EAA5}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{1D7C0C64-9346-4936-B750-C0A0705BB1F0}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{209C3DF0-8AEC-4323-B9A6-3C99627362B6}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{2D0875AE-C3C5-49F8-B9FD-2994DF515F49}" = protocol=6 | dir=in | app=c:\program files\sony ericsson\sony ericsson media manager\mediamanager.exe | 
"{2E4FDADB-6153-4F70-BF99-AFD3CC7CD7A6}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{3AE2D719-D33C-4E33-884C-9C31778CF204}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360.exe | 
"{3DBA18CF-5362-433F-BD54-6A1E41BBED12}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{3E92350D-3700-4499-B71D-1A908D01A0C3}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{462AEB86-A03B-4736-B855-FCD70C78A43E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4C7F3CB9-9E24-4F84-833B-7EF447B38F40}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{503EB0FA-6B0D-4E45-95AF-29E21F88EAE5}" = protocol=6 | dir=in | app=c:\users\nils\appdata\local\temp\ijjioptimizer.exe | 
"{5170543D-9218-4247-863F-BBDA0DF72870}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5636680B-D459-43C5-86E1-989D1BD323D8}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{57ED2525-8DD7-4B9F-ABE8-06EBBF6BCB16}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{5AE64403-2552-4E8D-BD30-923284E49167}" = protocol=17 | dir=in | app=c:\windows\system32\supdsvc.exe | 
"{6364E920-4FF8-49E5-B8DC-5904D0E827E9}" = protocol=17 | dir=in | app=c:\users\nils\appdata\local\temp\ijjioptimizer.exe | 
"{64079E3C-9504-4808-89E3-BD56A43AA764}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{6461EFE5-746A-4C50-B0B9-09FE0C89BE8D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{6B5CC2A6-709B-46A5-976F-AEBD792D2F43}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{7151FA63-E21E-4624-846F-3ADA2C468777}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{76FC2AD6-9496-48B4-96CB-58F5E174F481}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe | 
"{79193300-A056-4CBD-B171-4D4FB2276CE4}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{926C5344-843F-45C2-8A3D-C2A0A37D3C4F}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360_cl.exe | 
"{9D671733-40C0-4729-A584-F1845F98DD4D}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{A1CCECD6-62AB-4997-AEA0-350EAD45B23E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{A3B70277-0845-411C-96C7-EE39D6EC5E13}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{A8AA275F-E76B-4946-BC04-33F08B9759D4}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{ACB8FEF2-2A31-48DC-A592-FA761E13B584}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{AF5B1FB2-2057-43A4-BADC-656BC51C6BA7}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{B6EE4F9E-B63A-4B09-8C02-F23F0F133F82}" = protocol=17 | dir=in | app=c:\program files\sony ericsson\sony ericsson media manager\mediamanager.exe | 
"{BACA9EFC-C174-42A2-98B3-61EA7FD52CBA}" = protocol=6 | dir=in | app=c:\windows\system32\supdsvc.exe | 
"{BC33200C-19C8-4685-81B6-CC75CD526767}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe | 
"{C718037D-353E-4E72-A88C-344B6FE93FBB}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360_cl.exe | 
"{D021ABE2-A5D4-48A3-8B02-A2E5F4BECA2B}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360.exe | 
"{E75CBF35-506F-418D-825D-14AC26E40972}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{F0EC05AC-D0F0-4489-9C40-76BE0ADA1E70}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe | 
"{F2424CFD-2348-439B-87C6-CD8BFB84BC26}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{F380E143-EAD1-4358-AC45-D41ADF51CB81}" = protocol=17 | dir=in | app=c:\maxga\snowboundonline\run.exe | 
"{FFE802C9-B147-4651-9BE1-5B48A6CDC045}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"TCP Query User{30C37985-F13C-4CF0-A83A-2CF9A9F0D69C}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{53A59862-B6B4-4637-86ED-BC8AD8A08A38}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=6 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe | 
"TCP Query User{804AD4FA-E4EA-4360-8BA4-D41849F60114}C:\ijji\english\u_sf\soldierfront.exe" = protocol=6 | dir=in | app=c:\ijji\english\u_sf\soldierfront.exe | 
"TCP Query User{826A26B8-A0ED-4A07-B2F8-E91996D53E26}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{83926536-31B4-4E7C-A69A-D54C5ADA8CDF}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"TCP Query User{9BC956CF-2FA8-452B-8A95-9001C07FEAF4}C:\ijji\english\ava\binaries\ava.exe" = protocol=6 | dir=in | app=c:\ijji\english\ava\binaries\ava.exe | 
"TCP Query User{A0FD0CC1-B390-4D3A-AFB2-57D52AC24602}C:\ijji\english\gunz\gunz.exe" = protocol=6 | dir=in | app=c:\ijji\english\gunz\gunz.exe | 
"TCP Query User{AE810332-2C6F-4653-B672-0A16DAB16C11}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{20734C5D-8AB0-4A54-90D7-086F91E829E7}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
"UDP Query User{316E9153-ED10-4E00-AAA2-7CAF57F51978}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{680C69C9-9359-459F-9034-4BC1DE30A413}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"UDP Query User{7CF8D1B6-680F-48DA-ADDA-3EFC8B860384}C:\ijji\english\u_sf\soldierfront.exe" = protocol=17 | dir=in | app=c:\ijji\english\u_sf\soldierfront.exe | 
"UDP Query User{7F35DC3C-9558-4B49-AFFE-C821B94094C5}C:\program files\ijji\ijji reactor\reactor.exe" = protocol=17 | dir=in | app=c:\program files\ijji\ijji reactor\reactor.exe | 
"UDP Query User{8FA99EC5-B995-4E6C-B006-921ED7414BBF}C:\ijji\english\gunz\gunz.exe" = protocol=17 | dir=in | app=c:\ijji\english\gunz\gunz.exe | 
"UDP Query User{C79B2BB1-8299-4FBC-B394-4B9E2ADAA939}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
"UDP Query User{FFEE6738-CF51-44E7-991F-33C992CCD547}C:\ijji\english\ava\binaries\ava.exe" = protocol=17 | dir=in | app=c:\ijji\english\ava\binaries\ava.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 17
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{582D2A53-F426-4C5E-A2E6-43C1AB36B907}" = Safari
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{67C6633B-5A12-4955-A5E4-98D703F9AFA3}" = SolidWorks eDrawings 2011 SP02
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7E910FDA-CBBE-4451-8728-235E6A4DE162}" = Sony Ericsson Media Manager 1.1
"{7EC19307-7C22-47A8-922B-3FA965291260}" = OpenOffice.org 3.0
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}" = Hama Wireless LAN Adapter
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99ECF41F-5CCA-42BD-B8B8-A8333E2E2944}" = iTunes
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A51B8787-B1C1-4A24-856C-D79BD4F6ADFC}" = SolidWorks 2011 German Resources
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BA5F3E0E-8F3E-47BD-88E4-AD3EB5225F51}" = Intel(R) PROSet/Wireless WiFi-Software
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{C337BDAF-CB4E-47E2-BE1A-CB31BB7DD0E3}" = Apple Mobile Device Support
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0D3BFE5-5215-41BD-B82E-81D7FB6A9166}" = SolidWorks 2011 SP02
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"BullGuard" = BullGuard 8.7
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1136
"Business Contact Manager für Outlook 2007" = Business Contact Manager für Outlook 2007
"CCleaner" = CCleaner
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 4.0 Home Edition
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206
"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70
"ICQToolbar" = ICQ Toolbar
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.26)" = Mozilla Firefox (3.6.26)
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"PROHYBRIDR" = 2007 Microsoft Office system
"ProInst" = Intel PROSet Wireless
"Samsung Universal Print Driver" = Samsung Universal Print Driver
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SolidWorks Installation Manager 20110-40200-1100-200" = SolidWorks 2011 SP02
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.0.1
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.01.2012 11:36:42 | Computer Name = nils-PC | Source = Microsoft Office 12 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Outlook.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 17190
Description = Fehler beim Initialisieren des FallBack-Zertifikats. Fehlercode: 4.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 26015
Description = Das vom Benutzer angegebene Zertifikat kann nicht geladen werden. 
Da die Verbindungsverschlüsselung erforderlich ist, wird vom Server keine Verbindung
 akzeptiert. Überprüfen Sie, ob das Zertifikat richtig installiert ist. Lesen Sie
 'Konfigurieren eines Zertifikats zur Verwendung durch SSL' in der Onlinedokumentation.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
 0x80.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
 0x1.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 17826
Description = Aufgrund eines internen Fehlers in einer Netzwerkbibliothek konnte
 die Netzwerkbibliothek nicht gestartet werden. Überprüfen Sie zum Bestimmen der
 Ursache die diesem Fehler unmittelbar vorhergehenden Fehler im Fehlerprotokoll.
 
Error - 24.01.2012 22:20:00 | Computer Name = nils-PC | Source = MSSQL$MSSMLBIZ | ID = 17120
Description = SQL Server konnte den Thread FRunCM nicht erzeugen. Suchen Sie im 
SQL Server-Fehlerprotokoll und in den Windows-Ereignisprotokollen nach Informationen
 zu möglichen verwandten Problemen.
 
Error - 24.01.2012 22:20:39 | Computer Name = nils-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 26.01.2012 18:09:30 | Computer Name = nils-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung plugin-container.exe, Version 1.9.2.4363, Zeitstempel
 0x4ee68bf9, fehlerhaftes Modul ntdll.dll, Version 6.0.6002.18541, Zeitstempel 0x4ec3e3d5,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00048762,  Prozess-ID 0x1698, Anwendungsstartzeit
 01ccdb54b563acf0.
 
Error - 27.01.2012 11:33:17 | Computer Name = nils-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung plugin-container.exe, Version 1.9.2.4363, Zeitstempel
 0x4ee68bf9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00000000,  Prozess-ID 0x15e0, Anwendungsstartzeit
 01ccdc7786de2490.
 
[ System Events ]
Error - 05.02.2012 16:21:53 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:22:04 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:22:58 | Computer Name = nils-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 05.02.2012 16:22:58 | Computer Name = nils-PC | Source = Service Control Manager | ID = 7026
Description = 
 
Error - 05.02.2012 16:44:32 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:44:41 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:44:44 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:44:53 | Computer Name = nils-PC | Source = DCOM | ID = 10005
Description = 
 
Error - 05.02.2012 16:45:38 | Computer Name = nils-PC | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 05.02.2012 16:45:38 | Computer Name = nils-PC | Source = Service Control Manager | ID = 7026
Description = 
 
 
< End of report >
         
--- --- ---

Alt 06.02.2012, 11:39   #5
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
ATTFilter
:OTL
O4 - HKCU..\Run: [vasja] C:\Users\nils\AppData\Local\Temp\0.20489175344035382.exe (Orb Networks)
 :Files
C:\Users\nils\AppData\Local\Temp\0.20489175344035382.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 06.02.2012, 19:56   #6
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hey, system läuft jetzt im normalen modus.
erstmal die otl datei:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vasja deleted successfully.
C:\Users\nils\AppData\Local\Temp\0.20489175344035382.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 41044 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: nils
->Flash cache emptied: 3808217 bytes

User: Public

Total Flash Files Cleaned = 4,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: nils
->Temp folder emptied: 528081341 bytes
->Temporary Internet Files folder emptied: 5055329 bytes
->Java cache emptied: 76861350 bytes
->FireFox cache emptied: 50981863 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

Alt 06.02.2012, 20:02   #7
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



danke dir für den upload.
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 06.02.2012, 20:02   #8
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



ich habe die movedfiles.zip datei mit dem uploadchannel hochgeladen.
hoffe das hat geklappt.
wie mache ich weiter?
ist der trojaner entfernt?
ich hatte bis jetzt meinen pc mit bullguard geschützt. reicht das aus?
vielen vielen dank für deine hilfe bis hier hin.

Alt 06.02.2012, 20:45   #9
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hi, zum schutz kommen wir am ende :-)
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 06.02.2012, 20:59   #10
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



das ergebnis der combofix ist:

Combofix Logfile:
Code:
ATTFilter
ComboFix 12-02-02.02 - nils 06.02.2012  20:16:28.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3066.2016 [GMT 1:00]
ausgeführt von:: c:\users\nils\Desktop\ComboFix.exe
AV: BullGuard Antivirus *Disabled/Outdated* {504FFF66-3028-EB7E-2E60-62B19ADD791C}
FW: BullGuard Firewall *Disabled* {68747E43-7A47-EA26-053F-CB84640E3E67}
SP: BullGuard Antispyware *Disabled/Outdated* {EB2E1E82-1612-E4F0-14D0-59C3E15A33A1}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
c:\windows\system32\drivers\etc\hosts.ics
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-01-06 bis 2012-02-06  ))))))))))))))))))))))))))))))
.
.
2012-02-06 19:08 . 2012-02-06 19:08	--------	d-----w-	c:\users\nils\AppData\Local\Babylon
2012-02-06 19:08 . 2012-02-06 19:08	--------	d-----w-	c:\users\nils\AppData\Roaming\Babylon
2012-02-06 19:08 . 2012-02-06 19:08	--------	d-----w-	c:\programdata\Babylon
2012-02-06 18:44 . 2012-02-06 18:56	--------	d-----w-	C:\_OTL
2012-02-06 02:43 . 2012-02-06 02:43	--------	d-----w-	c:\windows\system32\wbem\en-US
2012-02-06 02:41 . 2007-07-24 03:02	33800	----a-w-	c:\windows\system32\drivers\mferkdk.sys
2012-02-06 02:41 . 2007-07-23 22:40	79304	----a-w-	c:\windows\system32\drivers\mfeavfk.sys
2012-02-06 02:41 . 2007-07-21 00:08	40488	----a-w-	c:\windows\system32\drivers\mfesmfk.sys
2012-02-06 02:41 . 2007-07-21 00:08	35240	----a-w-	c:\windows\system32\drivers\mfebopk.sys
2012-02-06 02:41 . 2007-07-21 00:08	201288	----a-w-	c:\windows\system32\drivers\mfehidk.sys
2012-02-06 02:41 . 2007-07-13 00:21	125728	----a-w-	c:\windows\system32\drivers\Mpfp.sys
2012-02-06 02:41 . 2008-01-21 02:23	599552	----a-w-	c:\windows\system32\vsp1cln.exe
2012-02-06 02:41 . 2008-01-21 02:24	54784	----a-w-	c:\windows\system32\WsmProv.dll
2012-02-06 02:41 . 2008-01-21 02:24	1536	----a-w-	c:\windows\system32\WsmCl.dll
2012-02-06 02:41 . 2008-06-08 22:23	114688	----a-w-	c:\windows\system32\nvcod130.dll
2012-02-06 02:41 . 2006-11-02 09:46	113664	----a-w-	c:\windows\system32\LANGWRBK.DLL
2012-02-05 19:13 . 2012-02-05 19:13	--------	d-----w-	c:\program files\CCleaner
2012-02-05 17:54 . 2012-02-06 18:48	--------	d-----w-	c:\users\nils\AppData\Roaming\Skype
2012-02-03 10:55 . 2012-02-03 10:55	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D0CD3117-EC96-4995-A4C7-78725B702AB1}\offreg.dll
2012-02-03 10:34 . 2012-01-06 04:19	6557240	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{D0CD3117-EC96-4995-A4C7-78725B702AB1}\mpengine.dll
2012-01-30 16:19 . 2012-01-30 16:19	--------	d-----r-	c:\users\nils\AppData\Roaming\Brother
2012-01-22 18:45 . 2011-11-17 06:48	440192	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-01-22 18:45 . 2011-11-16 16:23	278528	----a-w-	c:\windows\system32\schannel.dll
2012-01-22 18:45 . 2011-11-16 16:23	377344	----a-w-	c:\windows\system32\winhttp.dll
2012-01-22 18:45 . 2011-11-16 16:23	72704	----a-w-	c:\windows\system32\secur32.dll
2012-01-22 18:45 . 2011-11-16 16:21	1259008	----a-w-	c:\windows\system32\lsasrv.dll
2012-01-22 18:45 . 2011-11-16 14:12	9728	----a-w-	c:\windows\system32\lsass.exe
2012-01-12 02:19 . 2011-10-14 16:00	23552	----a-w-	c:\windows\system32\mciseq.dll
2012-01-12 02:19 . 2011-10-14 16:03	189952	----a-w-	c:\windows\system32\winmm.dll
2012-01-12 02:19 . 2011-11-18 20:23	1205064	----a-w-	c:\windows\system32\ntdll.dll
2012-01-12 02:15 . 2011-11-18 17:47	66560	----a-w-	c:\windows\system32\packager.dll
2012-01-12 02:15 . 2011-11-25 15:59	376320	----a-w-	c:\windows\system32\winsrv.dll
2012-01-12 02:14 . 2011-12-01 15:21	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2012-01-12 02:14 . 2011-10-25 15:58	1314816	----a-w-	c:\windows\system32\quartz.dll
2012-01-12 02:14 . 2011-10-25 15:58	497152	----a-w-	c:\windows\system32\qdvd.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:21 . 2009-12-30 14:28	237072	------w-	c:\windows\system32\MpSigStub.exe
2011-11-23 13:37 . 2011-12-14 21:07	2043904	----a-w-	c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2010-07-28 1267024]
.
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-03-17 2289664]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-02-04 23975720]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\bullguard.exe" [2010-04-29 304464]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-17 6111232]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 40048]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"BullGuard"="c:\program files\BullGuard Ltd\BullGuard\bullguard.exe" [2010-04-29 304464]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-27 13548064]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-27 92704]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-2-12 723496]
Hama Wireless LAN Utility.lnk - c:\program files\Hama\Common\RaUI.exe [2011-2-26 1597440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BgMainSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
R3 ADDMEM;ADDMEM;c:\users\nils\AppData\Local\Temp\__Samsung_Update\ADDMEM.SYS [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
BullGuard	REG_MULTI_SZ   	BgMainSvc BsFileScan BsMailProxy BsFire
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-03-17 08:56	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-06 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-10-27 12:26]
.
2012-02-06 c:\windows\Tasks\User_Feed_Synchronization-{5C27050C-199D-47BD-9FE4-97A1BFD3F44A}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Free YouTube to Mp3 Converter - c:\users\nils\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Save YouTube Video as MP3
LSP: c:\windows\system32\BGLsp.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\nils\AppData\Roaming\Mozilla\Firefox\Profiles\leb9tht1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - google.de
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Skype extension for Firefox: {B13721C7-F507-4982-B2E5-502A71474FED} - c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - %profile%\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: DVDVideoSoftTB Toolbar: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - %profile%\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: yahoo.homepage.dontask - true
FF - user.js: browser.sessionstore.resume_from_crash - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-ICQ - c:\program files\ICQ6.5\ICQ.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-02-06 20:40
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(4460)
c:\windows\system32\btmmhook.dll
c:\program files\BullGuard Ltd\BullGuard\BackupShellHook.dll
c:\windows\system32\btncopy.dll
.
Zeit der Fertigstellung: 2012-02-06  20:48:11
ComboFix-quarantined-files.txt  2012-02-06 19:48
.
Vor Suchlauf: 16 Verzeichnis(se), 50.312.773.632 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 50.191.224.832 Bytes frei
.
- - End Of File - - 60C120909FBFFCB43A81A7924F0EF61A
         
--- --- ---

Alt 06.02.2012, 21:05   #11
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.

wenn fertig, melden bitte
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 06.02.2012, 21:42   #12
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



habe alle windows updates die ich finden konnte installiert und die einstellungen geändert.
es waren 2 wichtige updates und 2 zusätzliche.
der pc wurde einmal neu gestartet.

Alt 07.02.2012, 11:39   #13
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 07.02.2012, 20:04   #14
chriss-cross
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



habe den scan laufen lassen. hat recht lange gedauert und bei der entfernung der datei musste der pc neugestartet werden. dannach ging das internet nicht mehr. habe ( wie widows mir gesagt hat ) den router mal aus und wieder eingeschaltet und das funktioniert jetzt wieder.
kann ich bullguard ( welches is wegen der combofix ausgeschaltet hatte ) wieder aktivieren ?
LG



Malwarebytes Anti-Malware (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.07.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
nils :: NILS-PC [Administrator]

Schutz: Aktiviert

07.02.2012 17:44:26
mbam-log-2012-02-07 (17-44-26).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 340139
Laufzeit: 1 Stunde(n), 51 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\_OTL\MovedFiles\02062012_194425\C_Users\nils\AppData\Local\Temp\0.20489175344035382.exe (Trojan.VUPX.ON1) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Alt 07.02.2012, 20:08   #15
markusg
/// Malware-holic
 
Windows security center meldung verlang 100 euro innerhalt von 24 stunden - Standard

Windows security center meldung verlang 100 euro innerhalt von 24 stunden



hi, geht das internet wieder?
av software kannst du einschalten.
wenn das internet geht:

lade den CCleaner standard:
CCleaner Download - CCleaner 3.15.1643
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Windows security center meldung verlang 100 euro innerhalt von 24 stunden
32 bit, abgesicherten, analyse, angeblich, befallen, center, euro, fenster, herausfinden, hintergrund, interne, internetverbindung, meldung, modus, netzwerkverbindung, problem, schonmal, security, start, start von windows, trojaner, version, vista, vista 32 bit, windows, windows security center, windows vista



Ähnliche Themen: Windows security center meldung verlang 100 euro innerhalt von 24 stunden


  1. Windows Security Center - PC gesperrt - 100 Euro bezahlen
    Plagegeister aller Art und deren Bekämpfung - 30.03.2012 (1)
  2. Windows Security Center - PC gesperrt - 100 Euro bezahlen
    Alles rund um Windows - 30.03.2012 (1)
  3. Windows Security Center. Auch bei mir 100 Euro
    Log-Analyse und Auswertung - 25.03.2012 (24)
  4. Windows Security Center - PC gesperrt - 100 Euro bezahlen - Ukash
    Log-Analyse und Auswertung - 21.03.2012 (3)
  5. Windows Security Center - PC gesperrt - 100 Euro bezahlen - Ukash
    Plagegeister aller Art und deren Bekämpfung - 16.03.2012 (11)
  6. Windows Security Center - PC gesperrt - 100 Euro bezahlen - Ukash
    Plagegeister aller Art und deren Bekämpfung - 19.02.2012 (9)
  7. Windows Security Center: PC blockiert, soll 100 Euro zahlen
    Plagegeister aller Art und deren Bekämpfung - 13.02.2012 (16)
  8. Windows Security Center - PC gesperrt - 100 Euro bezahlen - Ukash
    Plagegeister aller Art und deren Bekämpfung - 11.02.2012 (12)
  9. Windows security center meldung verlangt 100 euro innerhalb von 24 h ...
    Plagegeister aller Art und deren Bekämpfung - 08.02.2012 (1)
  10. Windows security center meldung verlang 100 euro innerhalt von 24 stunden
    Plagegeister aller Art und deren Bekämpfung - 06.02.2012 (1)
  11. Windows Security Center Meldung
    Log-Analyse und Auswertung - 05.02.2012 (1)
  12. Windows security meldung beim surfen im internet , 100 euro oder 24 stunden alles gelöscht
    Plagegeister aller Art und deren Bekämpfung - 04.02.2012 (9)
  13. 100 Euro Windows Security Center-Verzweiflungsscheisse
    Log-Analyse und Auswertung - 04.02.2012 (6)
  14. windows security center : Computer ist gesperrt!100 Euro U kash
    Log-Analyse und Auswertung - 03.02.2012 (1)
  15. Windows security meldung, 100 euro oder 24 stunden alles gelösch
    Plagegeister aller Art und deren Bekämpfung - 03.02.2012 (4)
  16. Windows Security Center: PC blockiert, soll 100 Euro zahlen
    Plagegeister aller Art und deren Bekämpfung - 03.02.2012 (5)
  17. Windows Security Center Virus, mit Zahlungsaufforderung von 100 Euro via U-Cash/Paysafe
    Log-Analyse und Auswertung - 02.02.2012 (5)

Zum Thema Windows security center meldung verlang 100 euro innerhalt von 24 stunden - hallo community, ich hab seit gestern abend das gleiche problem wie schon einige vor mir hier im forum. seit gestern habe ich ein ( ich denke was ich bis jetzt - Windows security center meldung verlang 100 euro innerhalt von 24 stunden...
Archiv
Du betrachtest: Windows security center meldung verlang 100 euro innerhalt von 24 stunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.