Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Spamhaus fordert 2 Euro zur Entsperrung meiner IP

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 25.05.2012, 11:40   #1
Nanchi
 
Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Standard

Spamhaus fordert 2 Euro zur Entsperrung meiner IP



Guten Tag!
Ich habe ein großes Problem mit Spamhaus, was mir vorher nie passiert ist.
Als ich vor einer Woche zufällig auf Google gegangen bin, erschien plötzlich eine Seite in der ich aufgefordert wurde 2 Euro zu bezahlen. Ich werde natürlich keine 2 Euro zahlen, wollte jedoch Fragen wie ich das Problem wieder lösen kann. (Wie es aussieht blockiert es bei mir auch Facebook und Youtube, die Spamhaus.org Seite lässt sich genauso wenig öffnen da sie von Spamhaus ebenfals blockiert wird)
Hätte jemand eine Idee?

Vielen Dank für jede Hilfe

Gruß Nanchi
Angehängte Grafiken
Dateityp: png SPAMHAUS.png (61,6 KB, 174x aufgerufen)

Alt 25.05.2012, 13:20   #2
markusg
/// Malware-holic
 
Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Standard

Spamhaus fordert 2 Euro zur Entsperrung meiner IP



hi
klappt dies:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________

__________________

Alt 25.05.2012, 16:09   #3
Nanchi
 
Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Standard

Spamhaus fordert 2 Euro zur Entsperrung meiner IP



Beim ersten Versuch hat er nicht zu Ende gescannt, da kam eine Fehlermeldung, habe also ein 2 Mal probiert und dann ging es.

OTL.txt:
Code:
ATTFilter
OTL logfile created on: 2012/05/25 16:29:34 - Run 1
OTL by OldTimer - Version 3.2.43.1     Folder = C:\Users\Nanchi\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000411 | Country: Japan | Language: JPN | Date Format: yyyy/MM/dd
 
3.86 Gb Total Physical Memory | 2.52 Gb Available Physical Memory | 65.29% Memory free
7.71 Gb Paging File | 6.24 Gb Available in Paging File | 80.90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.07 Gb Total Space | 129.64 Gb Free Space | 45.16% Space Free | Partition Type: NTFS
Drive G: | 100.00 Mb Total Space | 71.06 Mb Free Space | 71.07% Space Free | Partition Type: NTFS
Drive H: | 2.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
 
Computer Name: NANCHI-PC | User Name: Nanchi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/05/25 15:27:38 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Nanchi\Desktop\OTL.exe
PRC - [2012/05/22 15:32:30 | 001,081,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2012/05/17 18:59:53 | 005,156,864 | ---- | M] (FS2YOU) -- C:\Program Files (x86)\GridService\peer.exe
PRC - [2012/05/08 20:58:47 | 000,493,056 | ---- | M] (Nakido) -- C:\Program Files (x86)\Nakido\nakido.exe
PRC - [2012/04/16 19:30:46 | 000,175,616 | ---- | M] () -- C:\Users\Nanchi\AppData\Roaming\Dyix\izyb.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/05/05 16:16:20 | 008,797,856 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
MOD - [2012/04/21 03:16:53 | 001,952,696 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012/04/16 19:30:46 | 000,175,616 | ---- | M] () -- C:\Users\Nanchi\AppData\Roaming\Dyix\izyb.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/02/25 15:44:56 | 000,202,752 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012/05/22 02:57:55 | 000,286,720 | ---- | M] (Mozilla Foundation) [Auto | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/08 20:58:47 | 000,493,056 | ---- | M] (Nakido) [Auto | Running] -- C:\Program Files (x86)\Nakido\nakido.exe -- (Nakido)
SRV - [2012/05/07 21:23:46 | 000,288,256 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012/05/07 21:23:45 | 000,224,256 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2012/05/07 21:23:43 | 000,415,744 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/04/10 12:17:16 | 000,097,552 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2011/09/08 17:48:36 | 006,583,160 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2011/09/08 17:48:36 | 000,528,760 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2011/03/28 21:11:06 | 002,292,096 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012/05/06 20:57:21 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/09/08 17:49:36 | 000,013,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV:64bit: - [2011/09/08 17:49:26 | 000,012,848 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV:64bit: - [2011/09/08 17:49:24 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\wacomvhid.sys -- (wacomvhid)
DRV:64bit: - [2011/08/02 17:38:56 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/11/20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 11:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/02/25 16:07:46 | 000,395,264 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:64bit: - [2010/02/25 15:45:12 | 006,106,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2010/01/14 15:54:44 | 000,093,696 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimssne64.sys -- (rimspci)
DRV:64bit: - [2009/12/01 15:49:52 | 000,038,992 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys -- (ScreamBAudioSvc)
DRV:64bit: - [2009/10/09 02:41:02 | 001,394,176 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/09/17 19:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2007/08/03 05:35:54 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV - [2012/04/10 12:17:14 | 000,164,528 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.babylon.com/?affID=112555&babsrc=HP_ss&mntrId=eaea09880000000000000024bebe022e
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 63 08 81 D3 19 23 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&babsrc=SP_ss&mntrId=eaea09880000000000000024bebe022e
IE - HKCU\..\SearchScopes\{6B7EFF18-8DE1-4E40-93EE-B99F828B3045}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=NDV&o=15765&src=kw&q={searchTerms}&locale=&apn_ptnrs=NY&apn_dtid=YYYYYYYYDE&apn_uid=FD6C23E5-109A-4A5D-88B9-53A154DAF419&apn_sauid=81970F4F-A05B-405E-98E2-6B9CF44D82B2&
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=15768"
FF - prefs.js..keyword.URL: "hxxp://search.babylon.com/?affID=111789&babsrc=KW_ss&mntrId=eaea09880000000000000024bebe022e&q="
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre7\bin\new_plugin\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.1: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/05/22 02:22:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/04/10 16:52:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nanchi\AppData\Roaming\mozilla\Extensions
[2012/05/18 19:46:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nanchi\AppData\Roaming\mozilla\Firefox\Profiles\s6ll5zft.default\extensions
[2012/05/07 21:24:05 | 000,000,000 | ---D | M] (.) -- C:\Users\Nanchi\AppData\Roaming\mozilla\Firefox\Profiles\s6ll5zft.default\extensions\{ec9032c7-c20a-464f-7b0e-13a3a9e97385}
[2012/05/18 19:46:13 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Nanchi\AppData\Roaming\mozilla\Firefox\Profiles\s6ll5zft.default\extensions\ich@maltegoetz.de
[2012/05/06 16:31:57 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Nanchi\AppData\Roaming\mozilla\Firefox\Profiles\s6ll5zft.default\extensions\plugin@yontoo.com
[2011/11/17 19:25:44 | 000,002,333 | ---- | M] () -- C:\Users\Nanchi\AppData\Roaming\Mozilla\Firefox\Profiles\s6ll5zft.default\searchplugins\askcom.xml
[2012/05/22 02:22:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012/04/21 20:35:17 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/05/08 13:34:19 | 000,086,818 | ---- | M] () (No name found) -- C:\USERS\NANCHI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\S6LL5ZFT.DEFAULT\EXTENSIONS\ONECLICKDOWNLOADER@ONECLICKDOWNLOADER.COM.XPI
[2012/04/21 03:18:00 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/04/21 03:54:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/05/05 13:21:42 | 000,002,313 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012/04/21 03:54:08 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/04/21 03:54:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/04/21 03:54:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/04/21 03:54:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/04/21 03:54:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012/05/05 19:23:04 | 000,011,267 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 46.108.240.220 google.com
O1 - Hosts: 46.108.240.220 www.google.com
O1 - Hosts: 46.108.240.220 facebook.com
O1 - Hosts: 46.108.240.220 www.facebook.com
O1 - Hosts: 46.108.240.220 yahoo.com
O1 - Hosts: 46.108.240.220 www.yahoo.com
O1 - Hosts: 46.108.240.220 live.com
O1 - Hosts: 46.108.240.220 www.live.com
O1 - Hosts: 46.108.240.220 bing.com
O1 - Hosts: 46.108.240.220 www.bing.com
O1 - Hosts: 46.108.240.220 gmail.com
O1 - Hosts: 46.108.240.220 www.gmail.com
O1 - Hosts: 46.108.240.220 youtube.com
O1 - Hosts: 46.108.240.220 www.youtube.com
O1 - Hosts: 46.108.240.220 aol.com
O1 - Hosts: 46.108.240.220 www.aol.com
O1 - Hosts: 46.108.240.220 google.de
O1 - Hosts: 46.108.240.220 www.google.de
O1 - Hosts: 46.108.240.220 google.fr
O1 - Hosts: 46.108.240.220 www.google.fr
O1 - Hosts: 46.108.240.220 google.es
O1 - Hosts: 46.108.240.220 www.google.es
O1 - Hosts: 46.108.240.220 google.pt
O1 - Hosts: 46.108.240.220 www.google.pt
O1 - Hosts: 358 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {29590FFD-4A30-6BA1-2BE0-27CF0E1C1FAC} - C:\Windows\SysWOW64\kbdd103.DLL ()
O2 - BHO: (Groove Folder Synchronization) - {4BE735A2-0076-194F-5C7E-4E412FD83B2D} - C:\Windows\SysWOW64\mscmms.dll ()
O2 - BHO: (Adobe PDF Link Helper) - {601F0C90-270A-1760-7445-30F328D90D6E} - C:\Windows\SysWOW64\NlsData00033.dll ()
O2 - BHO: (Groove Folder Synchronization) - {72501D5D-0E48-2C3A-3088-08BB26E07BC3} - C:\Windows\SysWOW64\msdadiagg.dll ()
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKCU..\Run: [Avbezyg] C:\Users\Nanchi\AppData\Roaming\Dyix\izyb.exe ()
O4 - HKCU..\Run: [Grid Service] C:\Program Files (x86)\GridService\peer.exe (FS2YOU)
O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKCU..\Run: [uTorrent] C:\Program Files (x86)\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - Startup: C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
F3:64bit: - HKCU WinNT: Load - (C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe) - C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe ()
F3 - HKCU WinNT: Load - (C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe) - C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 2440 = C:\PROGRA~3\LOCALS~1\Temp\msqookr.pif ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17F21C71-A9D8-4F3E-B0B7-93A44A1B1C25}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012/04/07 08:39:41 | 000,000,200 | R--- | M] () - H:\AUTORUN.INF -- [ UDF ]
O33 - MountPoints2\{be6284c9-9754-11e1-9d94-f07bcbe87f9c}\Shell - "" = AutoRun
O33 - MountPoints2\{be6284c9-9754-11e1-9d94-f07bcbe87f9c}\Shell\AutoRun\command - "" = H:\setup.exe -- [2012/04/11 19:54:54 | 000,802,816 | R--- | M] (Acresso Software Inc.                                        )
O33 - MountPoints2\{be6284c9-9754-11e1-9d94-f07bcbe87f9c}\Shell\dxsetup\command - "" = H:\DirectX\DXSETUP.exe -- [2011/01/14 12:26:53 | 000,528,392 | R--- | M] (Microsoft Corporation)
O33 - MountPoints2\{be6284c9-9754-11e1-9d94-f07bcbe87f9c}\Shell\setup\command - "" = H:\setup.exe -- [2012/04/11 19:54:54 | 000,802,816 | R--- | M] (Acresso Software Inc.                                        )
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/05/25 15:27:34 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Nanchi\Desktop\OTL.exe
[2012/05/25 12:30:32 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Nanchi\Desktop\dds.com
[2012/05/25 00:49:05 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{93FCC98B-14C1-4001-BB83-3E5566214533}
[2012/05/25 00:48:41 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{4998F218-B425-4330-A65A-F49C306B9A59}
[2012/05/24 12:50:30 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{855CF679-36FA-45F4-9FE2-51B49FBC5B9D}
[2012/05/24 02:56:51 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\【ドラマCD】DIABOLIK LOVERS ドS吸血CD Vol.6 逆巻シュウ (CV.鳥海浩輔)
[2012/05/23 22:03:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Ywda
[2012/05/23 22:03:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Ishei
[2012/05/23 11:53:02 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{332EF127-0C8F-47D8-8CF6-97BA00693E02}
[2012/05/23 11:52:22 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{814887EE-5422-4C8C-8A50-A31A83A4E96C}
[2012/05/22 12:36:46 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{11BB1C3D-ACDC-426B-B000-A84298A7F1CF}
[2012/05/22 12:36:22 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{F4A10B1E-37E7-4190-A8AD-5DFB91931447}
[2012/05/22 12:33:50 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Local Settings
[2012/05/22 02:27:59 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Curiolab
[2012/05/22 02:22:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012/05/22 02:04:06 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Katizo
[2012/05/22 02:04:06 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Dyix
[2012/05/22 02:04:06 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Daalom
[2012/05/22 02:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Local Settings
[2012/05/22 01:56:35 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{B3D0B6CE-A489-4DFE-970F-4C89B442F75F}
[2012/05/22 01:56:07 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{8FFC6ABE-A026-4828-81F8-EE6489AB86AB}
[2012/05/21 12:21:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
[2012/05/21 12:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Sandboxie
[2012/05/21 11:51:30 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV
[2012/05/21 04:20:02 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\ヘ「ヘモムァ・ vol.5 ネヒ巻、ホヘモ・( CV. ケネノスシoユツ)
[2012/05/21 04:13:56 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\ドラマCD TOKYOヤマノテBOYS ~Secret.1~ ナイショの真夜中王子(ミッドナイトプリンス)
[2012/05/21 03:54:31 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\月刊男前図鑑 王子様編 黒盤
[2012/05/21 03:53:58 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\月刊男前図鑑 めがね編 黒盤
[2012/05/21 03:50:13 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\月刊男前図鑑 めがね編 白盤
[2012/05/21 03:45:31 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\月刊男前図鑑 王子様編 白盤
[2012/05/20 21:20:19 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{949B65BF-FD1C-4BC4-B0EA-94C795DFDA92}
[2012/05/20 21:19:55 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{70B0315F-5457-44FC-B9D2-61D5FEB44097}
[2012/05/20 20:03:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nostale(DE)
[2012/05/20 19:57:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NosTale(DE)
[2012/05/19 15:03:11 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012/05/19 14:35:22 | 000,000,000 | ---D | C] -- C:\AeriaGames
[2012/05/18 20:06:50 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Documents\Cross Fire
[2012/05/18 20:06:50 | 000,000,000 | ---D | C] -- C:\CFLog
[2012/05/18 19:55:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Z8Games
[2012/05/18 19:42:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BP DOWNLOADER
[2012/05/18 19:30:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gameforge
[2012/05/16 17:45:51 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{329A6338-AC99-4A05-96A2-6EDDE39417F1}
[2012/05/16 17:45:25 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{153C4281-5F81-4923-A2F7-A3DC53362DCF}
[2012/05/16 16:23:17 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\Kimi To Boku
[2012/05/16 11:51:10 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{7D40D032-C22F-43FB-8CD4-AC6CC2A5CD7E}
[2012/05/15 21:29:54 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{7AF04D40-7A5B-4A66-A7BD-8BDAAE5CBFEB}
[2012/05/15 21:29:34 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{8521BA4A-3911-44DC-BC85-016BD7CE5BBD}
[2012/05/15 15:28:56 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Starry☆Sky~AfterWinter~
[2012/05/15 15:28:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ASGARD
[2012/05/15 15:28:01 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Desktop\BWSOST
[2012/05/15 15:26:07 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{15768D96-8D4D-44C6-9ECD-5293FC2C6946}
[2012/05/15 13:34:57 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{AA207566-46B4-4641-B3AA-461BE05BA033}
[2012/05/15 13:34:41 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{054D5322-70FF-438C-B56D-7AE079A1EA1B}
[2012/05/14 00:58:33 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{9DF95080-4251-4267-9098-404428A98082}
[2012/05/13 20:14:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{53D6E827-5C10-4CB1-8D9F-24F9AA9DD003}
[2012/05/13 13:16:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{89D4A0F0-5552-405A-95AE-B476DF119E46}
[2012/05/12 13:22:19 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{494801B0-EB6F-4EC3-A41D-1D2836E210CF}
[2012/05/12 13:22:07 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{DC575D08-6E83-4341-9584-7FB724AE00EA}
[2012/05/11 19:08:11 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{071FF9CC-64FF-42AF-A858-0D616552BC82}
[2012/05/11 19:07:46 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{DAAA9B73-1439-4203-85EF-4FE9B6B7BE52}
[2012/05/11 16:04:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WILLPLUS
[2012/05/11 16:04:10 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sugarbeans
[2012/05/10 15:35:52 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{0AD6647C-462E-42D3-AC43-06E8B6A29A38}
[2012/05/10 15:35:27 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{890CDB98-66F5-41D6-B88F-10E3DA762D14}
[2012/05/09 15:16:38 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\Documents\キャラメリアトルテ
[2012/05/09 15:12:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\キャラメリアトルテ
[2012/05/09 15:10:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\キャラメリアトルテ
[2012/05/09 11:55:19 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{CCD757D1-417A-42E1-A30F-6DB262BCEE38}
[2012/05/08 22:22:15 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{8D5A5EE5-FE53-4D64-876B-EB6045FE063B}
[2012/05/08 22:21:52 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{C5B53C6B-8FD0-430C-A7DE-C70748328B3B}
[2012/05/08 21:00:40 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{AAF3DEF2-4F5C-4252-B3B3-D9FBADCEEC82}
[2012/05/08 13:33:21 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{AE0E109A-0205-4395-8B13-99BC36DBA08C}
[2012/05/07 20:34:57 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012/05/07 20:28:24 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Starry☆Sky~AfterSummer~
[2012/05/07 20:28:24 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\InstallShield Installation Information
[2012/05/07 18:00:33 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{9F17198B-267E-482A-ABE9-5A2177EEECC6}
[2012/05/07 18:00:08 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{1ACEEA2C-7A98-479C-B33F-97E584615B00}
[2012/05/07 15:20:02 | 000,000,000 | ---D | C] -- C:\Tiaramode
[2012/05/07 00:07:25 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\『黒と金の開かない鍵。』
[2012/05/07 00:05:35 | 000,000,000 | ---D | C] -- C:\littlecheese
[2012/05/06 23:59:59 | 000,000,000 | ---D | C] -- C:\ProgramData\美蕾
[2012/05/06 23:59:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\美蕾
[2012/05/06 20:58:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite
[2012/05/06 20:57:21 | 000,283,200 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012/05/06 20:57:17 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\DAEMON Tools Lite
[2012/05/06 20:57:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite
[2012/05/06 20:56:38 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite
[2012/05/06 16:36:57 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\sakevisual
[2012/05/06 16:36:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\sakevisual
[2012/05/06 11:42:28 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{02F21486-4D1E-4246-A194-FAF325183A32}
[2012/05/06 11:42:16 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{773C8281-3A86-4409-9FB0-B8D10F0B127C}
[2012/05/05 23:41:53 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{03ACC96A-9FA3-4804-B1F3-2C1C2CFD53CB}
[2012/05/05 23:41:41 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{1FCD9DB8-1E34-466C-9043-8BABED01D448}
[2012/05/05 17:59:52 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\3007
[2012/05/05 17:41:26 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\3095
[2012/05/05 17:27:19 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\2045
[2012/05/05 15:05:57 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\3023
[2012/05/05 14:51:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\uTorrent
[2012/05/05 14:51:15 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\uTorrent
[2012/05/05 14:49:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Date Warp
[2012/05/05 13:32:27 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\RenPy
[2012/05/05 13:29:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012/05/05 13:21:39 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\YourFileDownloader
[2012/05/05 12:05:49 | 000,436,736 | ---- | C] (AMD) -- C:\Windows\SysNative\atieclxx.exe
[2012/05/05 12:05:49 | 000,202,752 | ---- | C] (AMD) -- C:\Windows\SysNative\atiesrxx.exe
[2012/05/05 12:05:49 | 000,120,320 | ---- | C] (AMD) -- C:\Windows\SysNative\atitmm64.dll
[2012/05/05 12:05:49 | 000,012,288 | ---- | C] (AMD) -- C:\Windows\SysNative\atimuixx.dll
[2012/05/05 12:04:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony Corporation
[2012/05/05 12:02:12 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Carambis
[2012/05/05 12:01:37 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\TempDIR
[2012/05/05 11:41:14 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{99917276-D985-42D2-94EC-8C8B65DEB39B}
[2012/05/05 11:41:02 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{E8570178-832E-4572-B800-FBC13B8EAF94}
[2012/05/05 00:34:24 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\Babylon
[2012/05/05 00:34:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012/05/05 00:34:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Babylon
[2012/05/05 00:34:22 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2012/05/05 00:19:17 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CAFE 0 ~The Drowned Mermaid~ Deutsche Version
[2012/05/05 00:18:54 | 000,000,000 | ---D | C] -- C:\roseVeRte
[2012/05/04 11:49:05 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{602464C1-E54E-4684-9CB0-C37D6C6DB24E}
[2012/05/04 11:48:42 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{EFB506C5-1ADE-4506-B4BA-95065C9BAA03}
[2012/05/02 22:35:09 | 000,000,000 | ---D | C] -- C:\Intel
[2012/05/02 22:31:31 | 000,093,696 | ---- | C] (REDC) -- C:\Windows\SysNative\drivers\rimssne64.sys
[2012/05/02 22:30:37 | 000,496,128 | ---- | C] (Marvell) -- C:\Windows\SysNative\yk62x64.dll
[2012/05/02 12:04:27 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{02311751-D8AD-4FF1-BED2-E8ADFC5AFCD7}
[2012/05/02 12:04:03 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{E59938E0-B859-4284-8C53-C833C8DBB29C}
[2012/05/01 23:02:47 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{2C8BFE5E-C50E-47B5-A76A-D77C79A5E576}
[2012/05/01 23:02:24 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{7279BF14-B9E5-4ABF-AD5F-A13A1BA028CB}
[2012/05/01 11:01:56 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{CF39AA5B-14AD-49A4-B458-BD03740D136D}
[2012/05/01 11:01:33 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{ABCFFE43-BE2F-4CC1-9472-8038BC786E5D}
[2012/04/30 16:23:47 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{EC940159-6F82-4A34-B929-204219E00690}
[2012/04/30 16:23:24 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{F36CA259-17C9-48C4-B481-E3C4F3B437B9}
[2012/04/30 16:11:28 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{BF67E970-52D6-4F83-84D6-983887500760}
[2012/04/30 16:11:16 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{6C4B4DB7-5ACC-4E12-AE59-7376D960C194}
[2012/04/30 14:17:02 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{5C475102-1C0A-4BB7-BC85-ACAD83AB2883}
[2012/04/27 20:25:14 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\IsolatedStorage
[2012/04/27 20:15:36 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Screaming Bee
[2012/04/27 20:15:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Screaming Bee
[2012/04/26 14:10:53 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Local\{249D8022-38F9-4DC5-BAB4-6451FA2727B7}
[2012/04/26 00:46:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012/04/26 00:45:05 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Mp3tag
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/05/25 16:16:06 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/05/25 15:27:38 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Nanchi\Desktop\OTL.exe
[2012/05/25 12:36:37 | 000,063,062 | ---- | M] () -- C:\Users\Nanchi\Desktop\SPAMHAUS.png
[2012/05/25 12:30:33 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Nanchi\Desktop\dds.com
[2012/05/25 12:28:55 | 000,000,168 | ---- | M] () -- C:\Users\Nanchi\defogger_reenable
[2012/05/25 12:27:59 | 000,050,477 | ---- | M] () -- C:\Users\Nanchi\Desktop\Defogger.exe
[2012/05/25 12:18:56 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/05/25 12:18:56 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/05/25 12:10:59 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/05/25 12:10:52 | 3106,480,128 | -HS- | M] () -- C:\hiberfil.sys
[2012/05/25 00:55:54 | 000,002,462 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2012/05/24 22:40:34 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012/05/24 22:40:34 | 000,686,540 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012/05/24 22:40:34 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012/05/24 22:40:34 | 000,147,668 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012/05/24 22:40:34 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012/05/23 19:18:51 | 000,018,686 | ---- | M] () -- C:\Users\Nanchi\Desktop\marilyn lebenslauf.odt
[2012/05/23 14:06:00 | 000,000,352 | ---- | M] () -- C:\Windows\tasks\At1.job
[2012/05/22 23:58:28 | 006,448,274 | ---- | M] () -- C:\Users\Nanchi\Desktop\【PV付き】愛迷エレジー アレンジして歌ってみた.mp3
[2012/05/22 23:43:26 | 009,989,224 | ---- | M] () -- C:\Users\Nanchi\Desktop\【ろん】ジェミニ 歌ってみた【そらる】.mp3
[2012/05/22 22:53:57 | 008,047,386 | ---- | M] () -- C:\Users\Nanchi\Desktop\『テトロドトキサイザ2号』 歌ってみた.mp3
[2012/05/22 22:38:14 | 004,886,987 | ---- | M] () -- C:\Users\Nanchi\Desktop\【歌ってみた】 magician's operation 【kradness】.mp3
[2012/05/22 02:58:15 | 000,001,020 | ---- | M] () -- C:\Users\Nanchi\Desktop\Sandboxed Web Browser.lnk
[2012/05/22 02:22:07 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/05/22 02:21:34 | 000,005,699 | ---- | M] () -- C:\Users\Nanchi\AppData\Local\dfl24z32.dll
[2012/05/21 16:57:10 | 298,977,662 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012/05/20 20:48:29 | 000,000,943 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/05/20 20:03:08 | 000,001,686 | ---- | M] () -- C:\Users\Public\Desktop\NosTale.lnk
[2012/05/12 20:09:54 | 000,291,832 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012/05/12 01:13:12 | 000,031,060 | ---- | M] () -- C:\Users\Nanchi\Documents\jhzuijopk.odt
[2012/05/09 15:12:44 | 000,002,074 | ---- | M] () -- C:\Users\Public\Desktop\赤ずきんと迷いの森.lnk
[2012/05/08 22:16:46 | 000,001,163 | ---- | M] () -- C:\Users\Nanchi\Desktop\Anyos_Love - Verknüpfung.lnk
[2012/05/07 20:42:37 | 000,004,582 | ---- | M] () -- C:\Users\Nanchi\Desktop\muh - Verknüpfung.lnk
[2012/05/07 20:36:15 | 000,006,249 | ---- | M] () -- C:\Users\Nanchi\Desktop\STSKAFSU - Verknüpfung.lnk
[2012/05/07 20:29:42 | 000,005,430 | ---- | M] () -- C:\Users\Nanchi\Desktop\PersonA - Verknüpfung.lnk
[2012/05/07 20:29:17 | 000,004,350 | ---- | M] () -- C:\Users\Nanchi\Desktop\鳥籠と獣_プレ体験版 - Verknüpfung.lnk
[2012/05/07 20:26:51 | 000,004,570 | ---- | M] () -- C:\Users\Nanchi\Desktop\Sleepless Night - Verknüpfung.lnk
[2012/05/07 00:07:28 | 000,000,806 | ---- | M] () -- C:\Users\Nanchi\Desktop\『黒と金の開かない鍵。』.lnk
[2012/05/06 23:08:27 | 000,001,310 | ---- | M] () -- C:\Users\Nanchi\Desktop\WinterInFairbrook - Verknüpfung.lnk
[2012/05/06 23:08:27 | 000,001,084 | ---- | M] () -- C:\Users\Nanchi\Desktop\RE Alistair++.lnk
[2012/05/06 23:08:27 | 000,001,041 | ---- | M] () -- C:\Users\Nanchi\Desktop\DateWarp - Verknüpfung.lnk
[2012/05/06 20:57:21 | 000,283,200 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys
[2012/05/05 19:16:47 | 001,590,378 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/05/05 13:21:45 | 000,000,474 | ---- | M] () -- C:\user.js
[2012/05/05 12:08:14 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2012/05/05 12:02:49 | 000,004,140 | ---- | M] () -- C:\ProgramData\mtbjfghn.xbe
[2012/05/05 00:39:29 | 000,001,148 | ---- | M] () -- C:\Users\Nanchi\Desktop\CAFE 0 ~The Drowned Mermaid~ Deutsche Version.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/05/25 12:36:37 | 000,063,062 | ---- | C] () -- C:\Users\Nanchi\Desktop\SPAMHAUS.png
[2012/05/25 12:28:55 | 000,000,168 | ---- | C] () -- C:\Users\Nanchi\defogger_reenable
[2012/05/25 12:27:59 | 000,050,477 | ---- | C] () -- C:\Users\Nanchi\Desktop\Defogger.exe
[2012/05/23 19:18:48 | 000,018,686 | ---- | C] () -- C:\Users\Nanchi\Desktop\marilyn lebenslauf.odt
[2012/05/22 23:57:14 | 006,448,274 | ---- | C] () -- C:\Users\Nanchi\Desktop\【PV付き】愛迷エレジー アレンジして歌ってみた.mp3
[2012/05/22 23:40:30 | 009,989,224 | ---- | C] () -- C:\Users\Nanchi\Desktop\【ろん】ジェミニ 歌ってみた【そらる】.mp3
[2012/05/22 22:53:42 | 008,047,386 | ---- | C] () -- C:\Users\Nanchi\Desktop\『テトロドトキサイザ2号』 歌ってみた.mp3
[2012/05/22 22:37:56 | 004,886,987 | ---- | C] () -- C:\Users\Nanchi\Desktop\【歌ってみた】 magician's operation 【kradness】.mp3
[2012/05/22 02:22:07 | 000,001,142 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/05/22 02:22:07 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/05/22 02:20:41 | 000,001,020 | ---- | C] () -- C:\Users\Nanchi\Desktop\Sandboxed Web Browser.lnk
[2012/05/22 02:18:02 | 000,005,699 | ---- | C] () -- C:\Users\Nanchi\AppData\Local\dfl24z32.dll
[2012/05/21 12:21:16 | 000,002,462 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2012/05/20 20:48:29 | 000,000,943 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk
[2012/05/20 20:03:08 | 000,001,686 | ---- | C] () -- C:\Users\Public\Desktop\NosTale.lnk
[2012/05/19 15:03:04 | 298,977,662 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012/05/12 01:13:07 | 000,031,060 | ---- | C] () -- C:\Users\Nanchi\Documents\jhzuijopk.odt
[2012/05/09 15:12:44 | 000,002,074 | ---- | C] () -- C:\Users\Public\Desktop\赤ずきんと迷いの森.lnk
[2012/05/08 00:24:41 | 000,001,163 | ---- | C] () -- C:\Users\Nanchi\Desktop\Anyos_Love - Verknüpfung.lnk
[2012/05/07 20:42:37 | 000,004,582 | ---- | C] () -- C:\Users\Nanchi\Desktop\muh - Verknüpfung.lnk
[2012/05/07 20:36:15 | 000,006,249 | ---- | C] () -- C:\Users\Nanchi\Desktop\STSKAFSU - Verknüpfung.lnk
[2012/05/07 20:29:42 | 000,005,430 | ---- | C] () -- C:\Users\Nanchi\Desktop\PersonA - Verknüpfung.lnk
[2012/05/07 20:29:17 | 000,004,350 | ---- | C] () -- C:\Users\Nanchi\Desktop\鳥籠と獣_プレ体験版 - Verknüpfung.lnk
[2012/05/07 20:26:51 | 000,004,570 | ---- | C] () -- C:\Users\Nanchi\Desktop\Sleepless Night - Verknüpfung.lnk
[2012/05/07 00:07:28 | 000,000,806 | ---- | C] () -- C:\Users\Nanchi\Desktop\『黒と金の開かない鍵。』.lnk
[2012/05/06 22:45:02 | 000,001,310 | ---- | C] () -- C:\Users\Nanchi\Desktop\WinterInFairbrook - Verknüpfung.lnk
[2012/05/06 22:41:16 | 000,001,041 | ---- | C] () -- C:\Users\Nanchi\Desktop\DateWarp - Verknüpfung.lnk
[2012/05/06 16:36:57 | 000,001,084 | ---- | C] () -- C:\Users\Nanchi\Desktop\RE Alistair++.lnk
[2012/05/05 14:48:43 | 000,000,352 | ---- | C] () -- C:\Windows\tasks\At1.job
[2012/05/05 12:08:14 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012/05/05 12:05:50 | 000,442,208 | ---- | C] () -- C:\Windows\SysWow64\atiumdva.cap
[2012/05/05 12:05:50 | 000,028,732 | ---- | C] () -- C:\Windows\SysWow64\ativvsny.dat
[2012/05/05 12:05:50 | 000,028,732 | ---- | C] () -- C:\Windows\SysNative\ativvsny.dat
[2012/05/05 12:05:50 | 000,026,936 | ---- | C] () -- C:\Windows\SysWow64\ativvsnl.dat
[2012/05/05 12:05:50 | 000,026,936 | ---- | C] () -- C:\Windows\SysNative\ativvsnl.dat
[2012/05/05 12:05:49 | 000,442,208 | ---- | C] () -- C:\Windows\SysNative\atiumd6a.cap
[2012/05/05 12:05:49 | 000,332,288 | ---- | C] () -- C:\Windows\SysNative\ATIODE.exe
[2012/05/05 12:05:49 | 000,195,855 | ---- | C] () -- C:\Windows\SysNative\atiicdxx.dat
[2012/05/05 12:05:49 | 000,051,200 | ---- | C] () -- C:\Windows\SysNative\ATIODCLI.exe
[2012/05/05 12:05:49 | 000,018,618 | ---- | C] () -- C:\Windows\atiogl.xml
[2012/05/05 12:02:49 | 000,004,140 | ---- | C] () -- C:\ProgramData\mtbjfghn.xbe
[2012/05/05 00:34:38 | 000,000,474 | ---- | C] () -- C:\user.js
[2012/05/05 00:19:17 | 000,001,148 | ---- | C] () -- C:\Users\Nanchi\Desktop\CAFE 0 ~The Drowned Mermaid~ Deutsche Version.lnk
[2012/05/02 22:30:37 | 000,395,264 | ---- | C] () -- C:\Windows\SysNative\drivers\yk62x64.sys
[2012/04/23 14:57:10 | 001,590,378 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/04/22 12:14:36 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\mscmms.dll
[2012/04/22 01:13:34 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ieUnattt.exe
[2012/04/21 15:27:30 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
 
========== LOP Check ==========
 
[2012/05/05 00:34:23 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Babylon
[2012/05/05 12:02:12 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Carambis
[2012/05/22 02:27:59 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Curiolab
[2012/05/25 16:07:34 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Daalom
[2012/05/06 21:10:22 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\DAEMON Tools Lite
[2012/05/22 02:04:06 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Dyix
[2012/05/23 22:18:28 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Ishei
[2012/05/22 02:04:06 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Katizo
[2012/05/24 02:58:45 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Mp3tag
[2012/04/21 15:13:11 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\OpenOffice.org
[2012/05/10 22:40:00 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\PhotoScape
[2012/05/06 18:38:01 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\RenPy
[2012/04/27 20:20:56 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Screaming Bee
[2012/04/21 20:20:47 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\SYSTEMAX Software Development
[2012/05/25 12:17:36 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\uTorrent
[2012/05/08 14:15:11 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\WindSolutions
[2012/05/05 13:21:39 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\YourFileDownloader
[2012/05/23 23:06:31 | 000,000,000 | ---D | M] -- C:\Users\Nanchi\AppData\Roaming\Ywda
[2012/05/23 14:06:00 | 000,000,352 | ---- | M] () -- C:\Windows\Tasks\At1.job
[2009/07/14 07:08:49 | 000,030,870 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >
         
Extra.txt:
Code:
ATTFilter
OTL Extras logfile created on: 2012/05/25 16:29:34 - Run 1
OTL by OldTimer - Version 3.2.43.1     Folder = C:\Users\Nanchi\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000411 | Country: Japan | Language: JPN | Date Format: yyyy/MM/dd
 
3.86 Gb Total Physical Memory | 2.52 Gb Available Physical Memory | 65.29% Memory free
7.71 Gb Paging File | 6.24 Gb Available in Paging File | 80.90% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 287.07 Gb Total Space | 129.64 Gb Free Space | 45.16% Space Free | Partition Type: NTFS
Drive G: | 100.00 Mb Total Space | 71.06 Mb Free Space | 71.07% Space Free | Partition Type: NTFS
Drive H: | 2.15 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
 
Computer Name: NANCHI-PC | User Name: Nanchi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-680514434-1705131302-234099713-1000]
"EnableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-680514434-1705131302-234099713-1003]
"EnableNotifications" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{001D88D3-D290-4344-9586-8C28F879C6B3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{0CF8F339-9824-4044-8074-D0F1DA7DF27C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{1275B11A-9FC9-401A-A98C-3FF56D22A25A}" = rport=139 | protocol=6 | dir=out | app=system | 
"{17912657-C6F3-43E5-8F96-B9E2C2F78904}" = lport=139 | protocol=6 | dir=in | app=system | 
"{2246C7A0-BA7B-44AE-B87F-A70BECF82E9D}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{2F0C76A4-3BD2-4CF4-B5CC-EC6ADC8D3E9F}" = rport=137 | protocol=17 | dir=out | app=system | 
"{343811D9-1AB6-4CB6-8666-D7FCD293FDC7}" = lport=138 | protocol=17 | dir=in | app=system | 
"{390D6C2B-22B1-48FE-8183-3E3766B2F901}" = lport=445 | protocol=6 | dir=in | app=system | 
"{3BA0D8DA-BE8C-4557-B779-76E42A38D64E}" = lport=137 | protocol=17 | dir=in | app=system | 
"{3D7F59C3-C119-49D2-AB53-0BD5F6D8BD38}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{4703C4C6-B509-413C-B891-A4B9FA1A06F6}" = rport=138 | protocol=17 | dir=out | app=system | 
"{644CE670-9FE2-4FD9-9586-04C0FA211D4C}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{66C1A438-FE61-4260-A496-6517AD540A24}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{8FDD6882-BA30-4D09-8B56-75EFF8218EDF}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{93E0C5C5-9516-407E-A5B4-A08609B7D59C}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{A638122B-9B88-4F58-899C-CD7E0DAFA727}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{ABAEB04C-0A6D-4CF5-94EE-720CC518B3B0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{B75090F8-2C55-423A-92A1-0A61051F5525}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{CA4D55D6-E679-4D11-8082-B4FC0BFE272C}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EA26D932-5E89-423D-8417-11C56881C50F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{ED3B578D-D649-4A84-8FC6-E594D4062E0C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{FBFA0492-E7FE-4961-8B8B-523541245D4F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FD2560A7-220F-462C-BDC0-E9862F6A85B7}" = rport=445 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10F9B747-2E81-48BF-90F1-DF6ABAC37716}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{11CE1E2A-9750-4027-BDDD-042BF6489614}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{1B701EF3-C9E3-4B85-B83A-A9BE8927B193}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{1CF7BAB5-8DFF-45ED-89FC-A992EF6AE517}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{283215B2-FE59-4088-BDFA-2FB1CCB0DCC6}" = protocol=6 | dir=in | app=c:\program files (x86)\nakido\nakido.exe | 
"{2C1C27F1-5A6C-426A-AE8F-11A1EE324300}" = protocol=17 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe | 
"{2F9DC211-6D04-4BF9-BC5A-0723CECE99C0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{32FF5F02-11FC-40ED-A36D-F547049E0E46}" = protocol=6 | dir=in | app=c:\users\nanchi\downloads\crossfire_downloader.exe | 
"{3F56F936-C64F-47AE-AA8E-0329EFF4180B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{412DEDF0-E2F9-41AE-9C05-8B5902BC40DA}" = protocol=6 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe | 
"{42DCF602-09E0-4A49-9E45-59AF96F8B8C7}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5F3962C7-5AE4-443F-B362-1B581E7088A3}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{69DE6599-1768-47CB-9B84-47C968CC9FB8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6F29AD30-3A4E-484B-8D53-F8695EAB510E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{7281C984-4420-4C19-89F8-5C906A57E110}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{7360D043-FBA0-4279-B108-1A63D32BC61F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{7FAB451E-AA77-4F22-887D-4F2E91C93353}" = protocol=6 | dir=out | app=system | 
"{8E962039-56D7-4B46-A451-28B9EFEF1D97}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{947922F4-F08D-4564-917B-706EFD07A118}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{987149F2-6984-4874-8AEE-EDE963483F48}" = protocol=17 | dir=in | app=c:\users\nanchi\downloads\crossfire_downloader.exe | 
"{993330B3-B8AF-4BB0-8C74-2A82C9D3CA01}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{A3F53155-A721-4A20-A47E-E5EB01EC34C7}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{A4DEB1F8-224E-4749-82D3-BB1501C35425}" = protocol=17 | dir=in | app=c:\program files (x86)\yourfiledownloader\downloader.exe | 
"{AA3C26CB-F96B-4BF3-A8E7-46B36F11F27C}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{B43E9E94-FE72-4CC4-A272-A778EEB8DD21}" = protocol=17 | dir=in | app=c:\program files (x86)\yourfiledownloader\yourfile.exe | 
"{BAB55FE8-62A7-4B3E-A795-4051026DECEE}" = protocol=6 | dir=in | app=c:\program files (x86)\yourfiledownloader\yourfile.exe | 
"{D25546CB-D875-4F6C-B576-0CE36BF35985}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{D2B7002A-DC2B-4920-BD28-3C94BFF7928C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D9813B97-B51D-4641-B3F9-33EEB00EBA15}" = protocol=6 | dir=in | app=c:\program files (x86)\yourfiledownloader\downloader.exe | 
"{E42C1043-944F-40C0-8193-6EAD9A2645D9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E95B11C7-5CA4-4E74-89F9-F51D09D82596}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{EB19E6F1-BCCE-4740-9DEB-5D49204852A8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{EC8EA6C7-90AE-4B91-80E4-B241090EFEF4}" = protocol=17 | dir=in | app=c:\program files (x86)\nakido\nakido.exe | 
"{F40515CC-53D9-46AD-A3CB-AB4D351DEE53}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"TCP Query User{08F8B17D-FE82-4A4A-9AE7-7FE61A36CE33}C:\users\yorima\appdata\local\temp\003d499e.exe" = protocol=6 | dir=in | app=c:\users\yorima\appdata\local\temp\003d499e.exe | 
"TCP Query User{5628F743-867B-4D79-89C0-3E4EE586990B}C:\program files (x86)\1clickdownload\1clickdownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\1clickdownload\1clickdownloader.exe | 
"TCP Query User{67DB7172-C38A-486E-892D-D34D5C2301FD}C:\program files (x86)\gridservice\peer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gridservice\peer.exe | 
"TCP Query User{8E6423AA-357A-4740-9B5B-A3C274188116}C:\program files (x86)\gridservice\peer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gridservice\peer.exe | 
"TCP Query User{90D5E5E9-E7FD-429E-8E57-3D539B22CA51}C:\games\the flower shop 2- winter in fairbrook v2\winter_wolves_howler.exe" = protocol=6 | dir=in | app=c:\games\the flower shop 2- winter in fairbrook v2\winter_wolves_howler.exe | 
"TCP Query User{A934F3BD-B3AA-4675-BFCA-7F725C15A682}C:\users\nanchi\appdata\roaming\ywda\yclytu.exe" = protocol=6 | dir=in | app=c:\users\nanchi\appdata\roaming\ywda\yclytu.exe | 
"TCP Query User{C5F8A090-46FA-48D7-9300-2B2D5234D20B}C:\users\yorima\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\yorima\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{02233DB7-95CF-4645-9082-0952F92A7625}C:\program files (x86)\1clickdownload\1clickdownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\1clickdownload\1clickdownloader.exe | 
"UDP Query User{5EEEF7B5-1F71-4B4C-9678-4EE2856B0E54}C:\users\nanchi\appdata\roaming\ywda\yclytu.exe" = protocol=17 | dir=in | app=c:\users\nanchi\appdata\roaming\ywda\yclytu.exe | 
"UDP Query User{83B05586-F952-44A7-B0F9-D6284EB2659E}C:\program files (x86)\gridservice\peer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gridservice\peer.exe | 
"UDP Query User{B147E759-5E0E-4D0D-BD38-A853FCB99DAE}C:\users\yorima\appdata\local\temp\003d499e.exe" = protocol=17 | dir=in | app=c:\users\yorima\appdata\local\temp\003d499e.exe | 
"UDP Query User{DE237399-FE45-4B93-85DA-7DC818E5C26E}C:\program files (x86)\gridservice\peer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gridservice\peer.exe | 
"UDP Query User{E8249495-4221-4959-A86A-D02DFC12F89B}C:\users\yorima\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\yorima\appdata\local\akamai\netsession_win.exe | 
"UDP Query User{EF98B8EE-9047-49D4-9AC0-150FDA43B6DF}C:\games\the flower shop 2- winter in fairbrook v2\winter_wolves_howler.exe" = protocol=17 | dir=in | app=c:\games\the flower shop 2- winter in fairbrook v2\winter_wolves_howler.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Pen Tablet Driver" = Bamboo
"Sandboxie" = Sandboxie 3.68 (64-bit)
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1587B908-2A81-4099-B653-05648D251082}" = StarrySky~AfterWinter~
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java(TM) 7 Update 3
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{575BEB1C-1D64-4049-A9E4-E1081CC737EC}" = 赤ずきんと迷いの森
"{5928359F-BF46-4646-BF19-B64E55171EB5}" = FILSHtray
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"{706CA74B-10AD-49FB-B812-8E3BFBAB09A4}" = NVIDIA Direct3D SDK 11
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{905057B6-AC1C-44B2-AF2D-FB43740F6F68}" = StarrySky~AfterSummer~
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"CAFE 0 ~The Drowned Mermaid~ Deutsche Version" = CAFE 0 ~The Drowned Mermaid~ Deutsche Version 1.2
"DAEMON Tools Lite" = DAEMON Tools Lite
"Date Warp_is1" = Date Warp version 1.0
"InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Mp3tag" = Mp3tag v2.50
"Nakido" = Nakido
"NCLauncher_GameForge" = NC Launcher (GameForge)
"NosTale(DE)_is1" = Nostale(DE)
"PhotoScape" = PhotoScape
"RaySource" = RaySource 2.2.0.1
"RE: Alistair++" = RE: Alistair++ 1
"uTorrent" = µTorrent
"VLC media player" = VLC media player 2.0.1
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{2BA24BD2-E46C-461F-AA37-C7553E1C618E}" = VAMPIRE SWEETIE
"{77AC097D-8BED-4B93-B591-3F4221B160C6}" = Starry☆Sky~AfterSummer~
"{BACDA947-804C-4F93-A9DB-308143B1CAA1}" = Starry☆Sky~AfterWinter~
"『黒と金の開かない鍵。』" = 『黒と金の開かない鍵。』  1.00
"w•‚Æ‹à‚ÌŠJ‚©‚È‚¢Œ®Bx" = w•‚Æ‹à‚ÌŠJ‚©‚È‚¢Œ®Bx  1.00
"CopyTrans Suite" = Nur Entfernen der CopyTrans Suite möglich
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 2012/05/25 9:50:50 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 9:55:03 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 9:59:16 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:03:29 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:07:42 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:12:07 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:16:18 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:20:20 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:24:22 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
Error - 2012/05/25 10:28:24 | Computer Name = Nanchi-PC | Source = Windows Search Service | ID = 3100
Description = 
 
[ System Events ]
Error - 2012/05/22 10:32:30 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/23 5:49:30 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/23 17:05:20 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/23 20:56:25 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsruckmeldung
 von Dienst wlidsvc erreicht.
 
Error - 2012/05/24 1:06:37 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/24 6:47:21 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/24 9:41:54 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/24 14:14:54 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/24 16:53:34 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
Error - 2012/05/25 6:11:09 | Computer Name = Nanchi-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund
 folgenden Fehlers nicht gestartet:   %%2
 
 
< End of report >
         
__________________

Alt 25.05.2012, 16:30   #4
markusg
/// Malware-holic
 
Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Standard

Spamhaus fordert 2 Euro zur Entsperrung meiner IP



hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
ATTFilter
:OTL
F3:64bit: - HKCU WinNT: Load - (C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe) - C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe ()
F3 - HKCU WinNT: Load - (C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe) - C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe ()
O4 - HKCU..\Run: [Avbezyg] C:\Users\Nanchi\AppData\Roaming\Dyix\izyb.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 2440 = C:\PROGRA~3\LOCALS~1\Temp\msqookr.pif ()
[2012/05/23 22:03:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Ywda
[2012/05/23 22:03:23 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Ishei
[2012/05/22 02:04:06 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Katizo
[2012/05/22 02:04:06 | 000,000,000 | ---D | C] -- C:\Users\Nanchi\AppData\Roaming\Dyix
 :Files
C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe
C:\Users\Nanchi\AppData\Roaming\Dyix
C:\PROGRA~3\LOCALS~1\Temp\msqookr.pif
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!




Drücke bitte die + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 25.05.2012, 17:28   #5
Nanchi
 
Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Standard

Spamhaus fordert 2 Euro zur Entsperrung meiner IP



textlog:
Code:
ATTFilter
All processes killed
========== OTL ==========
C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe moved successfully.
64bit-Registry delete failed. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe scheduled to be deleted on reboot.
File C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Avbezyg deleted successfully.
C:\Users\Nanchi\AppData\Roaming\Dyix\izyb.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\2440 deleted successfully.
C:\PROGRA~3\LOCALS~1\Temp\msqookr.pif moved successfully.
C:\Users\Nanchi\AppData\Roaming\Ywda folder moved successfully.
C:\Users\Nanchi\AppData\Roaming\Ishei folder moved successfully.
C:\Users\Nanchi\AppData\Roaming\Katizo folder moved successfully.
C:\Users\Nanchi\AppData\Roaming\Dyix folder moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Nanchi
->Flash cache emptied: 36599 bytes
 
User: Public
 
User: Yorima
->Flash cache emptied: 19835 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Nanchi
->Temp folder emptied: 731427570 bytes
->Temporary Internet Files folder emptied: 98634970 bytes
->Java cache emptied: 9478 bytes
->FireFox cache emptied: 1127092667 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Yorima
->Temp folder emptied: 4229324 bytes
->Temporary Internet Files folder emptied: 2501701 bytes
->FireFox cache emptied: 176369376 bytes
->Flash cache emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 184415697 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46356772 bytes
RecycleBin emptied: 6201549 bytes
 
Total Files Cleaned = 2,267.00 mb
 
 
OTL by OldTimer - Version 3.2.43.1 log created on 05252012_181305

Files\Folders moved on Reboot...
C:\Users\Nanchi\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
64bit-Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\Load:C:\Users\Nanchi\LOCALS~1\Temp\msasacivl.exe deleted successfully.
         
Ich habe den Uploud ausgeführt. Danke schonmal für deine Hilfe!


Antwort

Themen zu Spamhaus fordert 2 Euro zur Entsperrung meiner IP
blockiert, entsperrung, euro, facebook, fordert, frage, fragen, gen, google, großes, guten, lösen, natürlich, plötzlich, problem, seite, spamhaus, spamhaus mail virus?, sperrung, wenig, woche, youtube, zahlen, zufällig, öffnen



Ähnliche Themen: Spamhaus fordert 2 Euro zur Entsperrung meiner IP


  1. Spamhaus XBL
    Alles rund um Mac OSX & Linux - 04.12.2014 (6)
  2. Spamhaus + DNS Blacklist PBL und XBL
    Plagegeister aller Art und deren Bekämpfung - 27.11.2014 (17)
  3. Spamhaus + DNS Blacklist PBL und XBL
    Netzwerk und Hardware - 21.11.2014 (1)
  4. Spamhaus Ransomware entfernen
    Anleitungen, FAQs & Links - 22.05.2013 (2)
  5. Wuchtige DNS-DDoS-Attacke auf Spamhaus
    Nachrichten - 27.03.2013 (0)
  6. EXP/CVE-2011.3402.C, Aufforderung 100Euro für Entsperrung
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (8)
  7. Spamhaus
    Plagegeister aller Art und deren Bekämpfung - 24.06.2012 (1)
  8. Spamhaus Virus
    Plagegeister aller Art und deren Bekämpfung - 22.05.2012 (1)
  9. Spamhaus Trojaner Danke
    Lob, Kritik und Wünsche - 22.05.2012 (2)
  10. Spamhaus Virus? Was Kann ich tun?
    Log-Analyse und Auswertung - 16.05.2012 (1)
  11. Windows gespert mit der Aufforderung zur Bezahlung für Entsperrung
    Log-Analyse und Auswertung - 03.04.2012 (11)
  12. 100€ Aufforderung zur Entsperrung des PCs
    Plagegeister aller Art und deren Bekämpfung - 28.02.2012 (22)
  13. Windows Security Center will 100 euro und droht mit löschung meiner daten !
    Plagegeister aller Art und deren Bekämpfung - 10.02.2012 (8)
  14. Windows Security Center will 100 Euro und droht mit Löschung meiner Daten
    Log-Analyse und Auswertung - 06.02.2012 (3)
  15. Microsoft Security fordert 100 Euro - kein zugriff mehr auf Destkop
    Log-Analyse und Auswertung - 05.02.2012 (1)
  16. Trojaner blockiert Windows System und fordert 50 Euro
    Log-Analyse und Auswertung - 23.01.2012 (3)
  17. Spamhaus Listung und deren Probleme
    Überwachung, Datenschutz und Spam - 13.06.2010 (10)

Zum Thema Spamhaus fordert 2 Euro zur Entsperrung meiner IP - Guten Tag! Ich habe ein großes Problem mit Spamhaus, was mir vorher nie passiert ist. Als ich vor einer Woche zufällig auf Google gegangen bin, erschien plötzlich eine Seite in - Spamhaus fordert 2 Euro zur Entsperrung meiner IP...
Archiv
Du betrachtest: Spamhaus fordert 2 Euro zur Entsperrung meiner IP auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.