Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: OTLPE.txt wie geht es nun weiter?

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 26.02.2012, 22:46   #1
yankee102
 
OTLPE.txt wie geht es nun weiter? - Standard

OTLPE.txt wie geht es nun weiter?



Hi,

habe gerade per reatogo einen otlpe-scan meines System gemacht. Leider weiß ich jetzt nicht, wie es weiter geht. ich habe gelesen, dass ich das entstandene txt.file hier posten soll.

Der Laptop fährt nicht mehr hoch und zeigt einen weißen Bildschirm an....


Helft mir!!! BitteOTL Logfile:
Code:
ATTFilter
OTL logfile created on: 2/26/2012 11:03:09 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 92.80 Mb Total Space | 68.63 Mb Free Space | 73.95% Space Free | Partition Type: NTFS
Drive D: | 105.91 Gb Total Space | 19.85 Gb Free Space | 18.74% Space Free | Partition Type: NTFS
Drive E: | 346.75 Gb Total Space | 226.86 Gb Free Space | 65.42% Space Free | Partition Type: NTFS
Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/06/11 07:27:26 | 000,868,896 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2010/03/30 04:02:08 | 000,189,304 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\nwtsrv.exe -- (nwtsrv)
SRV:64bit: - [2010/03/30 04:01:06 | 000,143,224 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\certsrv.exe -- (certsrv)
SRV:64bit: - [2010/03/30 03:59:54 | 000,335,224 | ---- | M] (AVM Berlin) [Auto] -- D:\Program Files\FRITZ!Fernzugang\avmike.exe -- (avmike)
SRV:64bit: - [2010/01/28 18:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/06/06 12:54:34 | 001,054,960 | ---- | M] ( ) [Auto] -- D:\Windows\System32\DKabcoms.exe -- (dkab_device)
SRV - [2012/02/23 02:28:45 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand] -- D:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/02/16 08:27:25 | 000,024,576 | ---- | M] (Realtek Semiconductor.) [Auto] -- D:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe -- (SetupARService)
SRV - [2012/01/13 08:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011/10/15 03:53:00 | 002,253,120 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2011/09/12 02:58:19 | 000,688,648 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto] -- D:\Program Files (x86)\StarMoney Business 5.0 Deutsche Bank Edition\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney Business 5.0 OnlineUpdate)
SRV - [2011/07/17 06:22:26 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/10 03:50:16 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/02/18 11:30:32 | 002,435,592 | ---- | M] (Check Point Software Technologies LTD) [Auto] -- D:\Windows\SysWOW64\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2011/02/02 05:00:32 | 000,052,288 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- D:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll -- (nosGetPlusHelper) getPlus(R)
SRV - [2010/07/16 11:23:30 | 006,638,080 | ---- | M] () [On_Demand] -- D:\Program Files (x86)\Samsung\SAMSUNG PC Share Manager\WiselinkPro.exe -- (AllShare)
SRV - [2010/07/13 06:59:30 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand] -- D:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/06/28 08:23:06 | 000,255,744 | ---- | M] (NewTech Infosystems, Inc.) [Auto] -- D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/06/22 01:34:48 | 000,321,104 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010/05/26 21:41:06 | 000,305,520 | ---- | M] (Egis Technology Inc.) [On_Demand] -- D:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe -- (MWLService)
SRV - [2010/04/13 11:57:58 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/17 23:57:02 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010/03/17 23:56:56 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/01/08 08:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009/09/23 14:59:36 | 001,037,824 | ---- | M] (Hewlett-Packard Co.) [Auto] -- D:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/06 12:54:36 | 000,603,376 | ---- | M] ( ) [Auto] -- D:\Windows\SysWow64\DKabcoms.exe -- (dkab_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/12/10 09:24:08 | 000,023,152 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand] -- D:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011/08/02 10:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/07/17 06:22:27 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/17 06:22:27 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/07/07 18:21:28 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2011/02/16 11:23:46 | 000,074,240 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV:64bit: - [2010/11/20 06:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/06/17 04:18:28 | 000,246,376 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/05/15 10:30:52 | 000,458,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- D:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)
DRV:64bit: - [2010/05/15 07:48:28 | 000,384,040 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010/05/11 05:11:38 | 002,229,608 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/03/30 04:00:16 | 000,412,024 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- D:\Windows\System32\drivers\avmnwim.sys -- (NWIM)
DRV:64bit: - [2009/09/17 00:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/08/21 03:52:09 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009/07/13 19:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/13 19:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/02 21:15:30 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2009/06/02 21:15:30 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2009/06/02 21:15:30 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2009/01/09 08:02:08 | 000,031,744 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RimSerial_AMD64.sys -- (RimVSerPort)
DRV:64bit: - [2008/09/26 11:06:24 | 000,045,320 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System] -- D:\Windows\System32\drivers\uimx64.sys -- (UimBus)
DRV:64bit: - [2008/09/26 11:06:24 | 000,037,392 | ---- | M] (Paragon Software Group) [Kernel | Boot] -- D:\Windows\System32\drivers\hotcore3.sys -- (hotcore3)
DRV - [2010/05/15 10:30:52 | 000,458,840 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System] -- D:\Windows\SysWOW64\drivers\vsdatant.sys -- (Vsdatant)
DRV - [2006/07/24 09:05:00 | 000,005,632 | ---- | M] () [File_System | System] -- D:\Windows\SysWow64\drivers\StarOpen.sys -- (StarOpen)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\christoph.utess_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\christoph.utess_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\christoph.utess_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\christoph.utess_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\Gast_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\Gast_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\Gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Gast_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
 
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_5742g&r=273610109925l04f4z175v47422962
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: support@lastpass.com:1.72.0
FF - prefs.js..extensions.enabledItems: verify-u@cybits.de:1.2
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3
FF - prefs.js..network.proxy.type: 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@checkpoint.com/FFApi: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: D:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: E:\Programme\Firefox\components [2012/02/20 13:26:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: E:\Programme\Firefox\plugins [2011/12/20 13:23:15 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: E:\Programme\Firefox\components [2012/02/20 13:26:58 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: E:\Programme\Firefox\plugins [2011/12/20 13:23:15 | 000,000,000 | ---D | M]
 
[2010/10/16 09:07:36 | 000,000,000 | ---D | M] (No name found) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Extensions
[2012/02/15 09:24:49 | 000,000,000 | ---D | M] (No name found) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions
[2011/12/20 13:24:10 | 000,000,000 | ---D | M] (Garmin Communicator) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2012/02/15 09:24:49 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011/07/31 11:31:00 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/01/30 16:16:00 | 000,000,000 | ---D | M] (LastPass) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\support@lastpass.com
[2011/12/27 16:26:28 | 000,000,000 | ---D | M] ([verify-U]-Add-on) -- D:\Users\christoph.utess\AppData\Roaming\Mozilla\Firefox\Profiles\w335bmxi.default\extensions\verify-u_2@cybits.de
File not found (No name found) -- 
() (No name found) -- D:\USERS\CHRISTOPH.UTESS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\W335BMXI.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
 
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\christoph.utess_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\christoph.utess_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKU\Gast_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\Gast_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKU\UpdatusUser_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\UpdatusUser_ON_D\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Acer ePower Management] D:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [mwlDaemon] D:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [PLFSetI] D:\Windows\PLFSetI.exe ()
O4:64bit: - HKLM..\Run: [XboxStat] D:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [APSDaemon] D:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BackupManagerTray] D:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (NewTech Infosystems, Inc.)
O4 - HKLM..\Run: [EgisTecPMMUpdate] D:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] D:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LexwareInfoService] D:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PDFPrint] E:\Programme\pdf24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] D:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited)
O4 - HKLM..\Run: [SMB50StarMoneyRunEntry] D:\Program Files (x86)\StarMoney Business 5.0 Deutsche Bank Edition\app\oflagent.exe (Star Finanz - Software Entwicklung und Vertriebs GmbH)
O4 - HKLM..\Run: [SuiteTray] D:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] D:\Program Files (x86)\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKU\christoph.utess_ON_D..\Run: [m29dAlvRev1yx2E] D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O4 - HKU\christoph.utess_ON_D..\Run: [Steam] E:\Programme\Steam\Steam.exe (Valve Corporation)
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\UpdatusUser_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\UpdatusUser_ON_D..\RunOnce: [ScrSav] D:\Program Files (x86)\Acer\Screensaver\run_Acer.exe ()
O4 - Startup: D:\Users\christoph.utess\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\christoph.utess\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandenes PDF anfügen - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\christoph.utess\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - E:\Programme\ICQ7.4\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\christoph.utess_ON_D Winlogon: Shell - (C:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe) - D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/02/26 15:22:45 | 000,302,592 | ---- | C] (Cutting Edge Software Inc.) -- D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe
[2012/02/20 13:44:31 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\CAPCOM
[2012/02/20 13:41:39 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\CAPCOM
[2012/02/17 07:33:34 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sega
[2012/02/17 05:54:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Roaming\DAEMON Tools Lite
[2012/02/17 05:54:04 | 000,000,000 | ---D | C] -- D:\ProgramData\DAEMON Tools Lite
[2012/02/17 05:46:52 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Games for Windows - LIVE Demos
[2012/02/17 05:45:27 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2012/02/16 15:55:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Rockstar Games
[2012/02/16 15:19:09 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\Rockstar Games
[2012/02/16 15:17:04 | 000,000,000 | -HSD | C] -- D:\ProgramData\SecuROM
[2012/02/16 15:13:19 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Microsoft Games for Windows - LIVE
[2012/02/16 14:30:54 | 000,634,880 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msvcrt.dll
[2012/02/16 14:30:40 | 000,702,464 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\msfeeds.dll
[2012/02/16 14:30:40 | 000,599,552 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\msfeeds.dll
[2012/02/16 14:30:39 | 000,247,808 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\ieui.dll
[2012/02/16 14:30:38 | 000,176,640 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\ieui.dll
[2012/02/16 14:30:38 | 000,097,280 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\mshtmled.dll
[2012/02/16 14:30:38 | 000,067,072 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\mshtmled.dll
[2012/02/16 14:30:36 | 000,134,144 | ---- | C] (Microsoft Corporation) -- D:\Windows\System32\url.dll
[2012/02/16 14:30:36 | 000,132,096 | ---- | C] (Microsoft Corporation) -- D:\Windows\SysWow64\url.dll
[2012/02/16 09:05:20 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\76561198058820333
[2012/02/16 08:48:34 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Common Files\Steam
[2012/02/16 08:48:32 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Verlauf
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Temporary Internet Files
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Videos
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Musik
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\Documents\Eigene Bilder
[2012/02/16 07:53:24 | 000,000,000 | -HSD | C] -- D:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
[2012/02/16 07:53:24 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\LocalLow
[2012/02/16 07:53:23 | 000,000,000 | --SD | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft
[2012/02/16 07:53:23 | 000,000,000 | R--D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2012/02/16 07:53:23 | 000,000,000 | R--D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Temp
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Roaming
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Microsoft Help
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local\Microsoft
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Roaming\Media Center Programs
[2012/02/16 07:53:23 | 000,000,000 | ---D | C] -- D:\Users\UpdatusUser\AppData\Local
[2012/02/16 07:53:15 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\NVIDIA Corporation
[2012/02/16 07:52:24 | 000,539,456 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhotkey.dll
[2012/02/16 07:52:24 | 000,137,536 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvshext.dll
[2012/02/16 07:52:23 | 005,067,584 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvsvc64.dll
[2012/02/16 07:52:22 | 003,074,368 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvsvcr.dll
[2012/02/16 07:52:20 | 010,406,208 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcpl.dll
[2012/02/16 07:52:20 | 000,837,952 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\easyupdatusapiu64.dll
[2012/02/16 07:52:20 | 000,222,528 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvmctray.dll
[2012/02/16 07:46:49 | 001,452,648 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhdagenco6420102.dll
[2012/02/16 07:46:49 | 000,174,184 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\drivers\nvhda64v.sys
[2012/02/16 07:46:49 | 000,029,288 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvhdap64.dll
[2012/02/16 07:46:44 | 008,791,360 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvwgf2umx.dll
[2012/02/16 07:46:44 | 007,041,856 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvwgf2um.dll
[2012/02/16 07:46:44 | 000,068,928 | ---- | C] (Khronos Group) -- D:\Windows\System32\OpenCL.dll
[2012/02/16 07:46:44 | 000,061,248 | ---- | C] (Khronos Group) -- D:\Windows\SysWow64\OpenCL.dll
[2012/02/16 07:46:43 | 024,796,992 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcompiler.dll
[2012/02/16 07:46:43 | 024,742,720 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvoglv64.dll
[2012/02/16 07:46:43 | 018,871,616 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvoglv32.dll
[2012/02/16 07:46:43 | 017,248,576 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcompiler.dll
[2012/02/16 07:46:43 | 015,693,120 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvd3dumx.dll
[2012/02/16 07:46:43 | 013,205,312 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvd3dum.dll
[2012/02/16 07:46:43 | 007,581,504 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuda.dll
[2012/02/16 07:46:43 | 005,578,560 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuda.dll
[2012/02/16 07:46:43 | 002,808,128 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvapi64.dll
[2012/02/16 07:46:43 | 002,542,912 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuvid.dll
[2012/02/16 07:46:43 | 002,458,432 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvapi.dll
[2012/02/16 07:46:43 | 002,401,088 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuvid.dll
[2012/02/16 07:46:43 | 002,232,128 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvcuvenc.dll
[2012/02/16 07:46:43 | 002,099,520 | ---- | C] (NVIDIA Corporation) -- D:\Windows\SysWow64\nvcuvenc.dll
[2012/02/16 07:46:43 | 001,533,248 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvdispco64.dll
[2012/02/16 07:46:43 | 001,454,400 | ---- | C] (NVIDIA Corporation) -- D:\Windows\System32\nvgenco64.dll
[2012/02/15 15:08:58 | 000,000,000 | ---D | C] -- D:\Program Files\Windows XP Mode
[2012/02/15 14:54:25 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Local\kaneandlynch
[2012/02/15 14:16:02 | 000,000,000 | ---D | C] -- D:\Windows\SysWow64\xlive
[2012/02/13 13:26:43 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warmux
[2012/02/13 13:26:23 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\Documents\Warmux
[2012/02/13 13:26:23 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Warmux
[2012/02/13 09:56:29 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAMSUNG
[2012/02/09 17:05:59 | 000,000,000 | ---D | C] -- D:\Users\christoph.utess\AppData\Roaming\Malwarebytes
[2012/02/09 17:05:55 | 000,023,152 | ---- | C] (Malwarebytes Corporation) -- D:\Windows\System32\drivers\mbam.sys
[2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012/02/09 17:05:55 | 000,000,000 | ---D | C] -- D:\ProgramData\Malwarebytes
[2010/10/18 02:16:22 | 001,056,768 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabserv.dll
[2010/10/18 02:16:22 | 000,802,816 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcomc.dll
[2010/10/18 02:16:22 | 000,446,464 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabhcp.dll
[2010/10/18 02:16:22 | 000,376,832 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcomm.dll
[2010/10/18 02:16:21 | 000,603,376 | ---- | C] ( ) -- D:\Windows\SysWow64\dkabcoms.exe
[2010/08/25 14:32:59 | 000,051,712 | ---- | C] ( ) -- D:\Windows\AutosetFrequency.exe
[4 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ]
[1 D:\Windows\System32\drivers\*.tmp files -> D:\Windows\System32\drivers\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/02/26 15:34:03 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2012/02/26 15:28:21 | 3113,254,912 | -HS- | M] () -- D:\hiberfil.sys
[2012/02/26 15:25:29 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/26 15:22:45 | 000,302,592 | ---- | M] (Cutting Edge Software Inc.) -- D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe
[2012/02/26 14:42:09 | 000,009,920 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 14:42:09 | 000,009,920 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 07:29:00 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/25 16:22:36 | 000,017,408 | ---- | M] () -- D:\Users\christoph.utess\AppData\Local\WebpageIcons.db
[2012/02/22 14:30:10 | 000,657,676 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2012/02/22 14:30:10 | 000,618,912 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2012/02/22 14:30:10 | 000,131,016 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2012/02/22 14:30:10 | 000,107,232 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2012/02/21 04:12:42 | 000,147,608 | ---- | M] () -- D:\Users\christoph.utess\Desktop\72C2A6331B.pdf
[2012/02/20 13:41:00 | 000,000,000 | R--D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/02/17 07:33:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sega
[2012/02/17 05:45:27 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2012/02/17 05:45:08 | 000,001,342 | ---- | M] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2012/02/17 04:52:37 | 000,486,472 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT
[2012/02/16 18:34:09 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2012/02/16 09:05:09 | 000,466,456 | ---- | M] (Creative Labs) -- D:\Windows\System32\wrap_oal.dll
[2012/02/16 09:05:09 | 000,444,952 | ---- | M] (Creative Labs) -- D:\Windows\SysWow64\wrap_oal.dll
[2012/02/16 09:05:09 | 000,122,904 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\System32\OpenAL32.dll
[2012/02/16 09:05:09 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- D:\Windows\SysWow64\OpenAL32.dll
[2012/02/16 08:48:36 | 000,000,656 | ---- | M] () -- D:\Users\Public\Desktop\Steam.lnk
[2012/02/16 08:48:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
[2012/02/15 14:55:48 | 000,001,024 | RH-- | M] () -- D:\Users\Public\Documents\NTIMMV9Acer.dll
[2012/02/15 14:55:07 | 000,001,024 | RH-- | M] () -- D:\Users\Public\Documents\NTILiveUpdateV9.dll
[2012/02/15 14:47:51 | 000,000,000 | RH-- | M] () -- D:\Windows\SysWow64\NTIMMV9Acer.dll
[2012/02/15 14:47:49 | 000,000,000 | RH-- | M] () -- D:\Windows\SysWow64\NTILiveUpdateV9.dll
[2012/02/13 13:26:44 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warmux
[2012/02/13 09:56:47 | 000,002,046 | ---- | M] () -- D:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk
[2012/02/13 09:56:29 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\SAMSUNG
[2012/02/13 05:48:54 | 000,060,018 | ---- | M] () -- D:\Users\christoph.utess\Documents\11_Excel BWA Jahresübersicht per 31 12 2011_540.pdf
[2012/02/11 05:46:06 | 000,002,675 | ---- | M] () -- D:\Users\Public\Desktop\QuickSteuer 2012.lnk
[2012/02/11 05:46:06 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware
[2012/02/11 05:39:02 | 000,080,787 | ---- | M] () -- D:\Users\christoph.utess\Documents\QuickSteuer_2012_Dasi.zip
[2012/02/10 13:21:35 | 000,351,542 | ---- | M] () -- D:\Users\christoph.utess\Desktop\20120208_DISQ-n-tv_Shopping-Clubs_Dokumentation.pdf
[2012/02/09 17:10:46 | 000,002,054 | ---- | M] () -- D:\Users\christoph.utess\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012/02/09 17:10:46 | 000,001,983 | ---- | M] () -- D:\Users\christoph.utess\Desktop\Avira DE-Cleaner.lnk
[2012/02/09 17:05:55 | 000,001,117 | ---- | M] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/02/09 17:05:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/02/08 17:52:49 | 000,465,795 | ---- | M] () -- D:\Users\christoph.utess\Desktop\FLT_1BEYGA1072_0.pdf
[4 D:\Windows\SysWow64\*.tmp files -> D:\Windows\SysWow64\*.tmp -> ]
[1 D:\Windows\System32\drivers\*.tmp files -> D:\Windows\System32\drivers\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/02/21 04:12:42 | 000,147,608 | ---- | C] () -- D:\Users\christoph.utess\Desktop\72C2A6331B.pdf
[2012/02/17 05:45:08 | 000,001,342 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live ID.lnk
[2012/02/16 08:48:36 | 000,000,656 | ---- | C] () -- D:\Users\Public\Desktop\Steam.lnk
[2012/02/16 07:53:23 | 000,000,290 | ---- | C] () -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2012/02/16 07:53:23 | 000,000,272 | ---- | C] () -- D:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/02/15 14:47:51 | 000,000,000 | RH-- | C] () -- D:\Windows\SysWow64\NTIMMV9Acer.dll
[2012/02/15 14:47:49 | 000,000,000 | RH-- | C] () -- D:\Windows\SysWow64\NTILiveUpdateV9.dll
[2012/02/13 09:56:47 | 000,002,046 | ---- | C] () -- D:\Users\Public\Desktop\SAMSUNG PC Share Manager.lnk
[2012/02/13 05:48:53 | 000,060,018 | ---- | C] () -- D:\Users\christoph.utess\Documents\11_Excel BWA Jahresübersicht per 31 12 2011_540.pdf
[2012/02/11 05:39:00 | 000,080,787 | ---- | C] () -- D:\Users\christoph.utess\Documents\QuickSteuer_2012_Dasi.zip
[2012/02/10 13:21:34 | 000,351,542 | ---- | C] () -- D:\Users\christoph.utess\Desktop\20120208_DISQ-n-tv_Shopping-Clubs_Dokumentation.pdf
[2012/02/09 17:10:46 | 000,002,054 | ---- | C] () -- D:\Users\christoph.utess\Desktop\Entfernen des Avira DE-Cleaners.lnk
[2012/02/09 17:10:46 | 000,001,983 | ---- | C] () -- D:\Users\christoph.utess\Desktop\Avira DE-Cleaner.lnk
[2012/02/09 17:05:55 | 000,001,117 | ---- | C] () -- D:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012/02/08 17:52:49 | 000,465,795 | ---- | C] () -- D:\Users\christoph.utess\Desktop\FLT_1BEYGA1072_0.pdf
[2012/01/22 05:26:34 | 000,003,584 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/06 18:57:09 | 000,000,000 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\{4768C36A-57F7-4532-BA64-9D51C13EB6F0}
[2011/10/15 06:09:21 | 001,500,444 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2011/10/15 06:08:03 | 000,000,000 | ---- | C] () -- D:\ProgramData\LauncherAccess.dt
[2011/10/15 06:05:02 | 000,005,632 | ---- | C] () -- D:\Windows\SysWow64\drivers\StarOpen.sys
[2011/09/28 11:44:14 | 000,179,271 | ---- | C] () -- D:\Windows\SysWow64\xlive.dll.cat
[2011/06/23 05:11:00 | 000,252,928 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2011/03/17 05:48:57 | 000,002,560 | ---- | C] () -- D:\Windows\_MSRSTRT.EXE
[2011/02/27 05:18:04 | 000,017,408 | ---- | C] () -- D:\Users\christoph.utess\AppData\Local\WebpageIcons.db
[2011/02/13 04:23:12 | 000,000,432 | ---- | C] () -- D:\Windows\BRWMARK.INI
[2011/02/13 04:23:12 | 000,000,034 | ---- | C] () -- D:\Windows\SysWow64\BD2030.DAT
[2010/10/23 02:14:35 | 000,000,034 | ---- | C] () -- D:\Windows\cdplayer.ini
[2010/10/18 02:33:19 | 000,266,152 | ---- | C] () -- D:\Windows\hpwins23.dat
[2010/10/17 02:27:29 | 000,004,096 | ---- | C] () -- D:\Windows\d3dx.dat
[2010/10/16 09:07:32 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat
[2010/08/25 14:32:59 | 000,206,208 | ---- | C] () -- D:\Windows\PLFSetI.exe
[2010/08/25 14:32:59 | 000,000,637 | ---- | C] () -- D:\Windows\AutoSetFrequency.ini
[2010/08/25 14:32:59 | 000,000,378 | ---- | C] () -- D:\Windows\PidList.ini
[2010/07/13 06:45:37 | 000,131,984 | ---- | C] () -- D:\ProgramData\FullRemove.exe
[2010/07/13 06:16:01 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.dll
[2010/07/13 06:15:32 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.exe
[2009/11/06 04:17:18 | 000,001,843 | ---- | C] () -- D:\Windows\hpwmdl23.dat
[2009/09/30 05:05:48 | 000,290,816 | ---- | C] () -- D:\Windows\SysWow64\nsldap32v60.dll
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat
[2008/10/30 11:00:22 | 000,048,640 | ---- | C] () -- D:\Windows\SysWow64\nsldapssl32v60.dll
[2008/10/30 10:59:24 | 000,025,088 | ---- | C] () -- D:\Windows\SysWow64\nsldappr32v60.dll
[2006/04/21 04:08:22 | 000,253,952 | ---- | C] () -- D:\Windows\SysWow64\HtmlHelp.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldapssl32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldappr32v50.dll
[2004/12/14 10:55:22 | 000,000,019 | ---- | C] () -- D:\Windows\SysWow64\nsldap32v50.dll
 
========== LOP Check ==========
 
[2010/07/13 06:55:11 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer
[2010/10/17 02:28:23 | 000,000,000 | ---D | M] -- D:\ProgramData\AirportMania
[2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2011/07/31 04:54:58 | 000,000,000 | ---D | M] -- D:\ProgramData\AVM
[2010/07/13 07:02:48 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager
[2012/02/09 17:34:38 | 000,000,000 | ---D | M] -- D:\ProgramData\boost_interprocess
[2011/02/04 17:07:33 | 000,000,000 | ---D | M] -- D:\ProgramData\CheckPoint
[2010/12/11 11:52:55 | 000,000,000 | ---D | M] -- D:\ProgramData\Codemasters
[2012/02/17 05:54:14 | 000,000,000 | ---D | M] -- D:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/10/12 16:41:49 | 000,000,000 | ---D | M] -- D:\ProgramData\EA Core
[2010/08/25 14:23:17 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS
[2011/10/12 16:41:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Electronic Arts
[2010/07/13 06:44:08 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi
[2010/10/16 04:31:55 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2011/05/21 06:07:52 | 000,000,000 | ---D | M] -- D:\ProgramData\Garmin
[2012/01/22 16:04:43 | 000,000,000 | ---D | M] -- D:\ProgramData\Haufe
[2012/01/23 05:47:23 | 000,000,000 | ---D | M] -- D:\ProgramData\Lexware
[2011/09/09 07:11:40 | 000,000,000 | ---D | M] -- D:\ProgramData\MSScanAppDataDir
[2010/10/16 04:34:33 | 000,000,000 | ---D | M] -- D:\ProgramData\oem
[2012/02/09 16:50:19 | 000,000,000 | ---D | M] -- D:\ProgramData\Origin
[2011/03/12 23:15:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Partner
[2011/10/23 07:16:37 | 000,000,000 | ---D | M] -- D:\ProgramData\Research In Motion
[2011/05/26 10:34:51 | 000,000,000 | ---D | M] -- D:\ProgramData\StarMoney Business 5.0
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2010/10/16 04:31:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2010/10/17 02:28:25 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2010/10/16 04:31:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2011/04/04 04:13:35 | 000,000,000 | ---D | M] -- D:\ProgramData\ZoneFiveSoftware
[2011/10/16 04:35:39 | 000,000,000 | ---D | M] -- D:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2012/02/01 01:56:25 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 144 bytes -> D:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 143 bytes -> D:\ProgramData\Temp:CDFF58FE
< End of report >
         
--- --- ---

Alt 27.02.2012, 10:12   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
OTLPE.txt wie geht es nun weiter? - Standard

OTLPE.txt wie geht es nun weiter?



Funktioniert noch der abgesicherte Modus mit Netzwerktreibern? Mit Internetverbindung?



Abgesicherter Modus zur Bereinigung
  • Windows mit F8-Taste beim Start in den abgesicherten Modus bringen.
  • Starte den Rechner in den abgesicherten Modus mit Netzwerktreibern:

    Windows im abgesicherten Modusstarten
__________________

__________________

Alt 27.02.2012, 19:26   #3
yankee102
 
OTLPE.txt wie geht es nun weiter? - Standard

OTLPE.txt wie geht es nun weiter?



Nee, leider geht der auch nicht...es ist alles weiß :-(
__________________

Alt 27.02.2012, 20:48   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
OTLPE.txt wie geht es nun weiter? - Standard

OTLPE.txt wie geht es nun weiter?



Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
ATTFilter
:OTL
O4 - HKU\christoph.utess_ON_D..\Run: [m29dAlvRev1yx2E] D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\christoph.utess_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKU\christoph.utess_ON_D Winlogon: Shell - (C:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe) - D:\Users\christoph.utess\AppData\Roaming\hw654ustqq.exe (Cutting Edge Software Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{5736d7b1-850c-11e0-9c12-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{722a70e6-20a8-11e1-bd00-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c5752c14-b07c-11df-b8aa-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Autorun.exe
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{e449e5f8-d92d-11df-8e0e-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell - "" = AutoRun
O33 - MountPoints2\{f9cfe870-594c-11e1-b020-88ae1d7eea68}\Shell\AutoRun\command - "" = F:\Autorun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
@Alternate Data Stream - 144 bytes -> D:\ProgramData\Temp:5D7E5A8F
@Alternate Data Stream - 143 bytes -> D:\ProgramData\Temp:CDFF58FE
:Files
D:\Users\christoph.utess\AppData\Roaming\*.exe
D:\Users\christoph.utess\AppData\Local\76561198058820333
:Commands
[resethosts]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu OTLPE.txt wie geht es nun weiter?
alternate, antivir, autorun, avira, bho, bildschirm, bonjour, converter, defender, desktop, deutsche bank, disabletaskmgr, entfernen, error, excel, explorer, firefox, format, google earth, helper, home, launch, locker, logfile, mbamservice.exe, mp3, mywinlocker, nvidia, pmmupdate.exe, realtek, registry, software, starmoney, studio, system, version=1.0, windows xp



Ähnliche Themen: OTLPE.txt wie geht es nun weiter?


  1. Bundes Trojaner, abgesicherter Modus geht nicht, OTLPE Scan durchgefuehrt
    Log-Analyse und Auswertung - 17.02.2014 (9)
  2. Bundes Trojaner, abgesicherter Modus geht nicht, OTLPE Scan durchgefuehrt
    Log-Analyse und Auswertung - 04.11.2013 (3)
  3. Hallo ich komme mit otlpe wieder an meinen Rechner, aber wie geht es weiter
    Log-Analyse und Auswertung - 17.06.2013 (5)
  4. OTLPE.TEX erstellt - wie weiter?
    Log-Analyse und Auswertung - 14.03.2013 (12)
  5. GVU Trojaner, Booten nur noch über REATOGO, OTLPE ist gelaufen, wie gehts weiter?
    Log-Analyse und Auswertung - 26.01.2013 (11)
  6. Virenprotokoll - Wie geht es weiter?
    Log-Analyse und Auswertung - 27.07.2012 (1)
  7. PC sauber? Wie geht´s weiter?
    Log-Analyse und Auswertung - 28.06.2012 (1)
  8. OTLPE scan durchgeführt wie gehts weiter
    Log-Analyse und Auswertung - 04.05.2012 (5)
  9. BKA Trojaner - OTLPE geht irgendwie nicht
    Plagegeister aller Art und deren Bekämpfung - 23.04.2012 (18)
  10. BKA/Virus/OTLPE installiert wie gehts weiter
    Log-Analyse und Auswertung - 02.04.2012 (1)
  11. GEMA Trojaner - OTLPE Logs erstellt - wie geht es weiter?
    Plagegeister aller Art und deren Bekämpfung - 28.03.2012 (11)
  12. OTLPE.txt wie geht es nun weiter?
    Mülltonne - 27.02.2012 (1)
  13. 50 euro trojaner :-( und wie geht es weiter?
    Mülltonne - 20.02.2012 (1)
  14. sbcvvhost win86 OTLPE läuft, wie weiter?
    Plagegeister aller Art und deren Bekämpfung - 28.12.2011 (8)
  15. BKA-Trojaner - Eilig Abschlussarbeit in Gefahr - OTLPE geht nicht
    Plagegeister aller Art und deren Bekämpfung - 23.06.2011 (40)
  16. Escan Log - Wie geht es weiter?
    Plagegeister aller Art und deren Bekämpfung - 24.10.2005 (1)
  17. Wie Geht´s Weiter? - Problem mit Viren
    Log-Analyse und Auswertung - 03.02.2005 (18)

Zum Thema OTLPE.txt wie geht es nun weiter? - Hi, habe gerade per reatogo einen otlpe-scan meines System gemacht. Leider weiß ich jetzt nicht, wie es weiter geht. ich habe gelesen, dass ich das entstandene txt.file hier posten soll. - OTLPE.txt wie geht es nun weiter?...
Archiv
Du betrachtest: OTLPE.txt wie geht es nun weiter? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.