Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Computer von "info@online-cyber-polizei" gesperrt

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 09.08.2012, 19:48   #1
verin
 
Computer von "info@online-cyber-polizei" gesperrt - Standard

Computer von "info@online-cyber-polizei" gesperrt



HALLO meine lieben wie ihr seht ist mein Computer von "info@online-cyber-polizei" gesperrt worden das problem ist das ich leider an nicht mehr ran komme pc fährt hoch bild ist da bezahlen sie 100 euro bla bla bundespolizei bei fragen bitte "info@online-cyber-polizei" anschreiben ich brauch hilfe wie bekomme ich es weg
ich habe vista

Okay ich sollte erklären vllt das ich gerade patienten akten am durchschauen war einen etwas merkwürdigen begriff gelesen habe diesen gegoogelt habe und auf einmal bam die seite und nichts geht mehr ich bracuh wirklich dringend hilfe und bitte sagt mir das meine daten (patientenakten) noch vorhanden sein werden wenn er wieder geht bittte

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 8/9/2012 10:29:16 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 455.99 Gb Total Space | 381.17 Gb Free Space | 83.59% Space Free | Partition Type: NTFS
Drive E: | 7.42 Gb Total Space | 7.42 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011/09/08 13:29:56 | 000,204,288 | ---- | M] (AMD) [Auto] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV:64bit: - [2010/09/22 13:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2012/07/30 06:02:10 | 000,018,360 | ---- | M] () [On_Demand] -- C:\Program Files (x86)\Overwolf\\OverwolfUpdater.exe -- (OverwolfUpdaterService)
SRV - [2012/07/10 13:43:57 | 004,419,392 | ---- | M] () [Auto] -- C:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai)
SRV - [2012/06/30 09:33:44 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/04/06 15:40:17 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/23 06:40:41 | 002,886,528 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2012/02/21 13:38:06 | 000,776,848 | ---- | M] (Mister Group) [On_Demand] -- C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe -- (SystemExplorerHelpService)
SRV - [2012/02/15 08:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/01/03 09:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/09/08 14:27:22 | 010,203,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011/09/08 12:52:40 | 000,310,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011/03/21 15:22:06 | 000,452,200 | ---- | M] (Realtek                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2010/11/20 23:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 23:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\system32\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2007/03/14 05:57:42 | 000,524,800 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\PA707UCM.SYS -- (PAC7311)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\Keks_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKU\Keks_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = Search
IE - HKU\Keks_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\Keks_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\Keks_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0F E8 D0 09 A9 FB CC 01  [binary data]
IE - HKU\Keks_ON_C\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - Reg Error: Key error. File not found
IE - HKU\Keks_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Keks_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q="
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF64_11_2_202_228.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Keks\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Keks\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012/03/27 07:02:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/06/30 09:33:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/08/02 09:07:30 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}: C:\Users\Keks\AppData\Roaming\13001.038 [2012/08/09 06:46:20 | 000,000,000 | ---D | M]
 
[2012/08/07 06:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Keks\AppData\Roaming\Mozilla\Extensions
[2012/08/07 06:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Keks\AppData\Roaming\Mozilla\Firefox\Profiles\eogwmdsb.default\extensions
[2012/08/07 06:52:38 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Keks\AppData\Roaming\Mozilla\Firefox\Profiles\eogwmdsb.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2012/05/31 12:31:57 | 000,000,000 | ---D | M] (IncrediMail MediaBar Deutsch 2 Community Toolbar) -- C:\Users\Keks\AppData\Roaming\Mozilla\Firefox\Profiles\eogwmdsb.default\extensions\{990af1c2-5a27-4460-8149-ecc6bc122af3}
[2012/05/15 12:15:44 | 000,002,197 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\Mozilla\Firefox\Profiles\eogwmdsb.default\searchplugins\MyStart Search.xml
[2012/08/07 06:52:34 | 000,002,519 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\Mozilla\Firefox\Profiles\eogwmdsb.default\searchplugins\Search_Results.xml
[2012/08/07 06:52:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) -- 
[2012/03/27 07:02:41 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2012/08/07 06:52:41 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES (X86)\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012/08/09 06:46:20 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\KEKS\APPDATA\ROAMING\13001.038
[2012/06/30 09:33:45 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012/05/06 03:53:25 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/05/06 03:53:25 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012/05/06 03:53:25 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012/05/06 03:53:25 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/08/07 06:52:34 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012/05/06 03:53:25 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/05/06 03:53:25 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - C:\Program Files (x86)\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - C:\Program Files (x86)\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Keks\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [PAC7311_Monitor] C:\Windows\PixArt\PAC7311\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKU\Keks_ON_C..\Run: [Akamai NetSession Interface] C:\Users\Keks\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKU\Keks_ON_C..\Run: [ktktatnphzhkecr] C:\ProgramData\ktktatnp.exe ()
O4 - HKU\Keks_ON_C..\Run: [Overwolf] C:\Program Files (x86)\Overwolf\Overwolf.exe (Overwolf)
O4 - HKU\Keks_ON_C..\Run: [SystemExplorerAutoStart] C:\Program Files (x86)\System Explorer\SystemExplorer.exe (Mister Group)
O4 - HKU\Keks_ON_C..\Run: [Userinit] C:\Users\Keks\AppData\Roaming\appconf32.exe ()
O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin]  File not found
O4 - Startup: C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation - Wikinger.LNK ()
O4 - Startup: C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation.LNK ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15:64bit: - Keks_ON_C\..Trusted Ranges: GD ([http] in Local intranet)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media, inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~2\Google\GOOGLE~1\GO36F4~1.DLL) - C:\Program Files (x86)\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/08/09 13:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\rewboavjhimvxgo
[2012/08/09 05:51:17 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.038
[2012/08/09 04:56:54 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{B92A591F-66A3-4FF7-9768-55529CA6D85F}
[2012/08/09 04:56:43 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{425CFE74-690F-407F-B083-C928EC81E620}
[2012/08/08 09:45:01 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.037
[2012/08/08 05:59:50 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.036
[2012/08/08 02:14:31 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{405112F3-FCDA-4DE9-930C-A840951C0D0B}
[2012/08/08 02:14:17 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{F34886EB-A251-4C03-BFC0-E17CB1E610B6}
[2012/08/07 11:47:33 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{064A5526-009D-4786-9E48-8BD0C3F56412}
[2012/08/07 09:59:16 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\777lc
[2012/08/07 09:50:17 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\777
[2012/08/07 07:11:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.035
[2012/08/07 06:53:09 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\Ilivid Player
[2012/08/07 06:52:35 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012/08/07 06:52:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Searchqu Toolbar
[2012/08/06 23:33:12 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{9A26B4EA-6247-49F1-9DE8-19E4D8EAF425}
[2012/08/06 23:32:59 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{545FC0B4-A7BA-4492-B744-3810C5D096B1}
[2012/08/06 11:47:59 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.034
[2012/08/06 01:51:19 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{0AF2D835-BC88-4D8F-97CC-91855B024594}
[2012/08/06 01:51:07 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7A45CDAD-1E32-4BD1-80C3-1724C319C2F4}
[2012/08/05 00:16:45 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7D052F39-6781-4B9E-B731-B109F0472D0B}
[2012/08/05 00:16:34 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{E0FF546C-CF2B-4D2A-8E7A-FDFFBB30F392}
[2012/08/02 10:08:20 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{AD9326F9-5292-4293-B843-AC2BAA4CBB5E}
[2012/08/02 09:25:13 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{DDA68847-6C9D-427F-82E6-19E7C92BB746}
[2012/08/02 09:12:20 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{FE3D309F-269A-4BA6-80E6-259354069806}
[2012/08/02 09:04:08 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{F20DC6B3-B8BF-45BB-8B1A-D235972CDA48}
[2012/08/02 03:49:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Overwolf
[2012/08/02 03:48:56 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7B0D7E08-E73F-4A9D-A888-0CC93DA64BA4}
[2012/08/01 15:14:56 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{05F42930-E337-4AED-A14F-B41487ED90F5}
[2012/08/01 15:14:32 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{872F8ACB-8984-4064-B6AB-303A3E26E479}
[2012/08/01 00:28:15 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{90E992D5-E585-4018-A7C0-0E44BB5EBF64}
[2012/08/01 00:27:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{821E3779-CDD3-4724-A7EF-3C2C7891C87A}
[2012/07/31 13:45:35 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.033
[2012/07/31 11:58:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lionhead Studios Ltd
[2012/07/31 01:26:06 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{35B3F2B5-16A3-4C4A-8295-F031E10542C5}
[2012/07/31 01:25:44 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{0CCE65F4-75D3-47C0-910B-A58673BFBDA8}
[2012/07/30 13:15:07 | 000,000,000 | ---D | C] -- C:\ProgramData\DivoGames
[2012/07/30 13:07:15 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012/07/30 11:33:20 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.032
[2012/07/30 06:02:26 | 000,421,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcp100.dll
[2012/07/30 06:02:14 | 000,768,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcr100.dll
[2012/07/30 04:54:27 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{5B9A679F-DD33-4900-A6A0-C4646590F681}
[2012/07/30 04:54:16 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{FDBAEAD2-216F-4CE3-B6F0-B3A5089B0DA3}
[2012/07/29 10:07:31 | 000,000,000 | ---D | C] -- C:\xmldm
[2012/07/28 13:35:26 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.031
[2012/07/28 04:28:33 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{ED9A31B6-48A2-41E7-89DC-DD43AA4A7FFC}
[2012/07/28 04:28:22 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{B0794AB8-4E40-4C40-AAFA-6120D93B9F4A}
[2012/07/27 16:40:09 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\07MeMiCy
[2012/07/27 16:39:47 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\07HaMon2
[2012/07/27 15:01:44 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.030
[2012/07/27 00:57:15 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{BA3D24DE-FA2D-40F2-8885-199FCC2A00E7}
[2012/07/27 00:57:04 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{884FBA9D-19ED-4A5D-BE8D-F02D48D1E330}
[2012/07/26 12:45:50 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{07FAA2BE-92E6-4206-AB09-A83FA19FC2F0}
[2012/07/26 12:45:38 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{19EEF9A9-15A8-466C-8575-EE1B40028481}
[2012/07/25 13:53:16 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7732B444-89A3-4CB1-A4C2-5FB4AE70DFCB}
[2012/07/25 13:53:02 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{DC36BCD1-A56B-4D03-B1FB-B01E81D3F101}
[2012/07/25 00:33:08 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{94F53E6F-FA68-4B58-A6F6-045013672E8B}
[2012/07/25 00:32:57 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7F7C1E51-3281-4CB2-BC69-503F083CEEBB}
[2012/07/25 00:32:46 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.029
[2012/07/24 07:05:03 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{67EE6085-E1B3-4824-9A14-A463D108B032}
[2012/07/24 07:04:51 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{6D745AF6-3214-4D79-BF1E-7456655A246F}
[2012/07/23 17:45:25 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\Helene Fischer - Die Erfolgsgeschichte 4CD (2012) Shop24 Edition
[2012/07/23 17:43:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\Harry_Potter_And_The_Sorcerer's_Stone
[2012/07/23 17:41:59 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\FluchderKaribik4PiratesOfTheCaribbeanOnStrangerTidesOST2011
[2012/07/23 15:37:19 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{398A6313-A0C2-4233-A727-7F9CBF8529E8}
[2012/07/23 15:37:08 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{52D9EAD1-DB4F-48C3-A4E9-11FCB75057B6}
[2012/07/23 02:45:22 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{14086D39-F598-4FB1-85BF-97315AB4D2B7}
[2012/07/23 02:44:59 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{E38E7DBD-5D74-4A96-BDE3-DBF31EC20DED}
[2012/07/22 06:30:53 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{B29580EF-9A08-4500-A2C7-4AE54D5E8DD5}
[2012/07/22 06:30:41 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{82AE2595-3DD8-44D2-A1EC-E9716C67248A}
[2012/07/21 02:27:03 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{098D3C71-0530-4C10-83FA-CED42DE54D90}
[2012/07/21 02:26:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{A306F00E-025F-4307-B83A-72224725477F}
[2012/07/20 17:42:15 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.028
[2012/07/20 15:12:06 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\S2
[2012/07/20 14:51:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2012/07/20 06:20:29 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{548141AD-7ED2-4D26-B8EB-DAFE56F0D3A0}
[2012/07/20 06:20:17 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{D3DA2BA1-2C8D-4CF9-A77F-218AE35F6C5B}
[2012/07/19 13:36:05 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{85857B5A-C1BC-4D5C-9637-51B63CD09C67}
[2012/07/19 13:35:54 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{96675817-C9C1-42FA-93FA-BD849A11C8C0}
[2012/07/19 00:24:53 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{91C57DDA-CDAE-42CC-859D-83A50A63F5CC}
[2012/07/19 00:24:42 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{6872BD7A-AE16-4D52-9774-DE44A20BACAB}
[2012/07/18 13:11:06 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\Microsoft Games
[2012/07/18 13:11:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Games
[2012/07/18 13:10:43 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012/07/18 10:20:45 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.027
[2012/07/18 10:09:26 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{DDE24F12-5A08-4D90-A363-347280C08B7A}
[2012/07/18 10:09:14 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{3D62A9A2-F879-412F-8151-E6D149E55281}
[2012/07/17 13:47:57 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.026
[2012/07/17 11:41:27 | 000,000,000 | ---D | C] -- C:\Users\Keks\Documents\Tilted Mill
[2012/07/17 11:41:27 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\Tilted Mill
[2012/07/17 11:37:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tilted Mill
[2012/07/17 11:34:33 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{CEC74D9D-1522-439A-9B2E-697EF21D8561}
[2012/07/16 13:15:04 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{B5F23771-25C0-4F8F-9F79-37F63CC89024}
[2012/07/16 13:14:49 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{EE3F3B6C-6BE0-4B7D-BB3E-D73FC090A539}
[2012/07/16 00:32:18 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{35AA3A2F-8FD4-4FD1-B1F9-E23DBA3C5123}
[2012/07/16 00:32:06 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{F4F96B79-7495-4CBD-97D7-CD95EFCECAA2}
[2012/07/15 15:21:35 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{23FF5EC4-988D-4423-883D-14E079E64886}
[2012/07/15 15:21:23 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{F45F562E-BCD2-4276-B46C-8F392E7FDF33}
[2012/07/15 00:00:34 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{4526D22F-8935-4E57-BB10-882D61423F99}
[2012/07/14 23:58:16 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{BE009CDD-0B56-481B-89CA-44FE5991AFB3}
[2012/07/14 14:29:53 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.025
[2012/07/14 02:10:57 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{02CDC5C1-8583-403A-B38A-24846DF375DA}
[2012/07/14 02:10:44 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{C592BEF2-B80E-4997-8701-725360198B36}
[2012/07/13 11:44:49 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.024
[2012/07/12 23:48:00 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{AF475D8A-B3DB-4EC4-8F65-A9D8D26A1EE6}
[2012/07/12 23:47:48 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\UAs
[2012/07/12 23:47:37 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{233144F2-8725-4FE5-B689-5B11C94DB142}
[2012/07/12 23:47:35 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.023
[2012/07/12 13:03:40 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.022
[2012/07/12 13:03:22 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\xmldm
[2012/07/12 13:03:21 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\kock
[2012/07/12 00:08:14 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{7DB77ADE-1B36-46EE-A23F-6DDD32B48130}
[2012/07/12 00:08:03 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{BDF7D2FC-F321-4514-8C30-994AA699A912}
[2012/07/11 10:09:29 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012/07/11 10:09:29 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012/07/11 10:09:29 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmled.dll
[2012/07/11 10:09:29 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012/07/11 10:09:28 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012/07/11 10:09:28 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012/07/11 10:09:28 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012/07/11 10:09:28 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012/07/11 10:09:27 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012/07/11 10:09:26 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012/07/11 10:09:26 | 001,800,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9.dll
[2012/07/11 10:09:26 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012/07/11 10:09:26 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2012/07/11 10:09:26 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012/07/11 09:51:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012/07/11 09:51:20 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll
[2012/07/11 09:51:18 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll
[2012/07/11 09:51:18 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncrypt.dll
[2012/07/11 09:51:17 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll
[2012/07/11 09:51:17 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[2012/07/11 09:50:15 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{ECC320E9-D52C-40FD-88F9-6C12166FD562}
[2012/07/11 09:49:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{4317376D-4658-4433-996D-D4AE7F968F51}
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\Keks\AppData\Roaming\*.tmp files -> C:\Users\Keks\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/08/09 14:06:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/08/09 14:06:11 | 000,021,888 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/08/09 14:06:10 | 000,021,888 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/08/09 14:03:50 | 000,000,017 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\blckdom.res
[2012/08/09 14:03:29 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/08/09 14:03:24 | 1945,509,887 | -HS- | M] () -- C:\hiberfil.sys
[2012/08/09 13:59:05 | 000,000,051 | ---- | M] () -- C:\ProgramData\ukuwblnmzxtiits
[2012/08/09 13:58:57 | 000,061,440 | ---- | M] () -- C:\ProgramData\ktktatnp.exe
[2012/08/09 13:45:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1121376267-28944291-3684495066-1000UA.job
[2012/08/09 06:46:19 | 000,200,336 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\AcroIEHelpe186.dll
[2012/08/09 06:46:19 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe186.dll
[2012/08/08 16:45:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1121376267-28944291-3684495066-1000Core.job
[2012/08/08 10:44:56 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe185.dll
[2012/08/08 05:59:51 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe184.dll
[2012/08/07 14:48:39 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe183.dll
[2012/08/07 09:32:19 | 1450,673,619 | ---- | M] () -- C:\Users\Keks\Desktop\777lc.rar
[2012/08/07 07:11:54 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe182.dll
[2012/08/06 08:58:15 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe181.dll
[2012/08/02 10:47:53 | 000,002,451 | ---- | M] () -- C:\Users\Keks\Desktop\Google Chrome.lnk
[2012/08/02 09:07:30 | 000,002,441 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
[2012/08/02 06:00:29 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
[2012/08/01 15:15:28 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe180.dll
[2012/07/30 11:33:25 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe178.dll
[2012/07/30 06:02:26 | 000,421,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcp100.dll
[2012/07/30 06:02:14 | 000,768,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msvcr100.dll
[2012/07/28 13:35:33 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe177.dll
[2012/07/27 07:53:43 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe176.dll
[2012/07/27 00:58:32 | 000,001,723 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation.LNK
[2012/07/27 00:58:27 | 000,001,745 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation - Wikinger.LNK
[2012/07/25 14:29:08 | 003,384,818 | ---- | M] () -- C:\Users\Keks\Desktop\IMG_6273.JPG
[2012/07/23 07:30:07 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe173.dll
[2012/07/20 14:51:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2012/07/20 06:45:18 | 000,000,029 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\urhtps.dat
[2012/07/16 13:20:39 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe169.dll
[2012/07/11 14:57:54 | 000,274,464 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Users\Keks\AppData\Roaming\*.tmp files -> C:\Users\Keks\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/08/09 13:59:05 | 000,061,440 | ---- | C] () -- C:\ProgramData\ktktatnp.exe
[2012/08/09 13:58:59 | 000,000,051 | ---- | C] () -- C:\ProgramData\ukuwblnmzxtiits
[2012/08/09 06:46:19 | 000,200,336 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\AcroIEHelpe186.dll
[2012/08/09 06:46:19 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe186.dll
[2012/08/08 10:44:56 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe185.dll
[2012/08/08 05:59:51 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe184.dll
[2012/08/07 14:48:39 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe183.dll
[2012/08/07 08:40:00 | 1450,673,619 | ---- | C] () -- C:\Users\Keks\Desktop\777lc.rar
[2012/08/07 07:11:54 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe182.dll
[2012/08/06 08:58:15 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe181.dll
[2012/08/01 15:15:28 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe180.dll
[2012/07/30 11:33:25 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe178.dll
[2012/07/28 13:35:33 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe177.dll
[2012/07/27 07:53:43 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe176.dll
[2012/07/27 00:58:32 | 000,001,723 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation.LNK
[2012/07/27 00:58:27 | 000,001,745 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation - Wikinger.LNK
[2012/07/25 14:10:53 | 003,384,818 | ---- | C] () -- C:\Users\Keks\Desktop\IMG_6273.JPG
[2012/07/23 07:30:07 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe173.dll
[2012/07/20 14:45:17 | 000,000,017 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\blckdom.res
[2012/07/16 13:20:39 | 000,006,400 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe169.dll
[2012/07/16 00:37:48 | 000,000,029 | ---- | C] () -- C:\Users\Keks\AppData\Roaming\urhtps.dat
[2012/03/20 14:38:47 | 001,590,274 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/03/12 13:54:08 | 000,688,128 | ---- | C] () -- C:\Windows\SysWow64\libeay32.dll
[2012/03/12 13:54:08 | 000,155,648 | ---- | C] () -- C:\Windows\SysWow64\ssleay32.dll
[2012/03/06 10:45:00 | 000,017,408 | ---- | C] () -- C:\Users\Keks\AppData\Local\WebpageIcons.db
[2012/03/03 07:24:35 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011/10/17 04:45:20 | 000,003,929 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2010/11/20 23:24:49 | 000,252,928 | ---- | C] () -- C:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2008/12/09 11:23:13 | 000,052,688 | RHS- | C] () -- C:\Users\Keks\AppData\Roaming\appconf32.exe
[2007/01/31 09:48:36 | 000,000,518 | ---- | C] () -- C:\Windows\SysWow64\SP7311.ini
 
========== LOP Check ==========
 
[2012/07/12 13:03:40 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.022
[2012/07/12 23:47:35 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.023
[2012/07/14 02:10:30 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.024
[2012/07/14 16:02:09 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.025
[2012/07/17 13:47:57 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.026
[2012/07/18 10:20:50 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.027
[2012/07/20 17:42:15 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.028
[2012/07/25 00:32:46 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.029
[2012/07/27 15:01:44 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.030
[2012/07/28 13:35:31 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.031
[2012/07/30 11:33:26 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.032
[2012/07/31 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.033
[2012/08/06 11:48:02 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.034
[2012/08/07 07:11:54 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.035
[2012/08/08 05:59:52 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.036
[2012/08/08 10:21:35 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.037
[2012/08/09 06:46:20 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.038
[2012/07/12 13:03:21 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\kock
[2012/03/27 06:59:58 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\loadtbs
[2012/04/01 08:20:16 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\Process Hacker 2
[2012/03/08 10:40:37 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\Quadra
[2012/07/08 06:46:20 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\SecondLife
[2012/07/20 18:05:54 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\SoftGrid Client
[2012/03/31 15:13:42 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\TeamViewer
[2012/07/17 11:41:27 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\Tilted Mill
[2012/03/20 14:39:36 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\TP
[2012/04/28 15:46:14 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\TS3Client
[2012/07/31 06:23:41 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\UAs
[2012/08/07 09:57:27 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\uTorrent
[2012/08/08 12:33:17 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\xmldm
[2012/03/05 02:23:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2012/08/07 09:58:29 | 000,000,000 | ---D | M] -- C:\ProgramData\boost_interprocess
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2012/07/30 13:15:07 | 000,000,000 | ---D | M] -- C:\ProgramData\DivoGames
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/05/15 12:19:01 | 000,000,000 | ---D | M] -- C:\ProgramData\IM
[2012/05/15 12:17:45 | 000,000,000 | ---D | M] -- C:\ProgramData\IncrediMail
[2012/04/14 11:23:30 | 000,000,000 | ---D | M] -- C:\ProgramData\Overwolf
[2012/05/15 12:18:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Photo Notifier and Animation Creator
[2012/08/09 13:59:04 | 000,000,000 | ---D | M] -- C:\ProgramData\rewboavjhimvxgo
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2012/04/01 08:25:55 | 000,000,000 | ---D | M] -- C:\ProgramData\SystemExplorer
[2012/07/31 08:47:32 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2012/03/20 17:19:09 | 000,000,000 | ---D | M] -- C:\ProgramData\VirtualizedApplications
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2012/07/19 11:29:48 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2012/03/06 10:43:11 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012/04/07 21:03:47 | 000,000,000 | ---D | M] -- C:\72c552a9190e08c6831c84
[2012/03/03 07:20:12 | 000,000,000 | -HSD | M] -- C:\Boot
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012/03/24 07:10:41 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012/05/11 03:01:03 | 000,000,000 | R--D | M] -- C:\Program Files
[2012/08/07 06:53:48 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012/08/09 13:59:05 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012/03/06 10:42:55 | 000,000,000 | -HSD | M] -- C:\Programme
[2012/08/08 02:17:00 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012/03/06 10:43:01 | 000,000,000 | R--D | M] -- C:\Users
[2012/05/17 14:28:17 | 000,000,000 | ---D | M] -- C:\Windows
[2012/07/29 10:07:31 | 000,000,000 | ---D | M] -- C:\xmldm
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/08/19 11:39:14 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2011/08/19 11:39:14 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011/08/19 11:39:14 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/08/19 11:39:14 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 23:24:25 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/08/19 11:39:14 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011/08/19 11:39:14 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 23:24:11 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 23:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 23:23:47 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/08/19 11:50:52 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/08/19 11:50:52 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\System32\drivers\iaStorV.sys
[2011/08/19 11:50:52 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/08/19 11:50:52 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 23:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\System32\netlogon.dll
[2010/11/20 23:24:01 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 23:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010/11/20 23:24:09 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/08/19 11:50:52 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/08/19 11:50:52 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\System32\drivers\nvstor.sys
[2011/08/19 11:50:52 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/08/19 11:50:52 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 23:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 23:23:47 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010/11/20 23:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010/11/20 23:23:54 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 23:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\System32\scecli.dll
[2010/11/20 23:24:32 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 23:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010/11/20 23:24:20 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2010/11/20 23:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\System32\user32.dll
[2010/11/20 23:24:09 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010/11/20 23:23:55 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\System32\userinit.exe
[2010/11/20 23:24:28 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\System32\winlogon.exe
[2010/11/20 23:24:29 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 164 bytes -> C:\ProgramData\TEMP:7AF9CAEB
< End of report >
         
--- --- ---

Alt 10.08.2012, 17:04   #2
t'john
/// Helfer-Team
 
Computer von "info@online-cyber-polizei" gesperrt - Standard

Computer von "info@online-cyber-polizei" gesperrt





Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:


Code:
ATTFilter
:OTL
SRV - [2012/07/10 13:43:57 | 004,419,392 | ---- | M] () [Auto] -- C:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll -- (Akamai) 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\Keks_ON_C\..\URLSearchHook: {990af1c2-5a27-4460-8149-ecc6bc122af3} - Reg Error: Key error. File not found 
IE - HKU\Keks_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\Keks_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
FF - prefs.js..browser.search.defaultenginename: "Search Results" 
FF - prefs.js..browser.search.order.1: "Search Results" 
FF - prefs.js..browser.search.selectedEngine: "Search Results" 
FF - prefs.js..browser.search.update: false 
FF - prefs.js..browser.startup.homepage: "http://www.google.de/" 
FF - prefs.js..keyword.URL: "http://dts.search-results.com/sr?src=ffb&appid=394&systemid=406&sr=0&q=" 
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found 
File not found (No name found) -- 
O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media, inc) 
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () 
O2 - BHO: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - C:\Program Files (x86)\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.) 
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) 
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () 
O3 - HKLM\..\Toolbar: (IncrediMail MediaBar Deutsch 2 Toolbar) - {990af1c2-5a27-4460-8149-ecc6bc122af3} - C:\Program Files (x86)\IncrediMail_MediaBar_Deutsch_2\prxtbIncr.dll (Conduit Ltd.) 
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. 
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () 
O4 - HKU\Keks_ON_C..\Run: [Akamai NetSession Interface] C:\Users\Keks\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) 
O4 - HKU\Keks_ON_C..\Run: [ktktatnphzhkecr] C:\ProgramData\ktktatnp.exe () 
O4 - HKU\Keks_ON_C..\Run: [Userinit] C:\Users\Keks\AppData\Roaming\appconf32.exe () 
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] File not found 
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] File not found 
O4 - Startup: C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation - Wikinger.LNK () 
O4 - Startup: C:\Users\Keks\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Die Siedler II - Die nächste Generation.LNK () 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) 
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found 
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found 
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media, inc) 
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media, inc) 
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc) 
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\IEBHO.dll) - C:\Program Files (x86)\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] 
O34 - HKLM BootExecute: (autocheck autochk *) - File not found 
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found 
[7 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 
[2012/08/09 13:58:57 | 000,061,440 | ---- | M] () -- C:\ProgramData\ktktatnp.exe 

Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe 
@Alternate Data Stream - 164 bytes -> C:\ProgramData\Temp:7AF9CAEB 
xml 
 
[2012/07/12 23:47:48 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\UAs 
[2012/07/12 23:47:37 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{233144F2-8725-4FE5-B689-5B11C94DB142} 
[2012/07/12 23:47:35 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.023 
[2012/07/12 23:48:00 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Local\{AF475D8A-B3DB-4EC4-8F65-A9D8D26A1EE6} 
[2012/07/12 13:03:40 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.022 
[2012/07/12 13:03:22 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\xmldm 
[2012/07/12 13:03:21 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\kock 
[2012/08/09 14:03:50 | 000,000,017 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\blckdom.res 
[2012/08/09 14:03:29 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2012/08/09 13:58:59 | 000,000,051 | ---- | C] () -- C:\ProgramData\ukuwblnmzxtiits 
[2012/08/09 13:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\rewboavjhimvxgo 
[2012/08/09 13:59:05 | 000,000,000 | -H-D | M] -- C:\ProgramData 
[2012/08/09 13:45:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1121376267-28944291-3684495066-1000UA.job 
[2012/08/09 06:46:20 | 000,000,000 | ---D | M] (Java Link Helper) -- C:\USERS\KEKS\APPDATA\Roaming\13001.038 
[2012/08/09 06:46:19 | 000,200,336 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\AcroIEHelpe186.dll 
[2012/08/09 06:46:19 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe186.dll 
[2012/08/09 06:46:20 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\13001.038 
[2012/08/08 16:45:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1121376267-28944291-3684495066-1000Core.job 
[2012/08/08 10:44:56 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe185.dll 
[2012/08/08 05:59:50 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.036 
[2012/08/08 05:59:51 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe184.dll 
[2012/08/07 14:48:39 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe183.dll 
[2012/08/07 07:11:52 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.035 
[2012/08/07 07:11:54 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe182.dll 
[2012/08/06 08:58:15 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe181.dll 
[2012/08/01 15:15:28 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe180.dll 
[2012/07/30 11:33:20 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.032 
[2012/07/30 11:33:25 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe178.dll 
[2012/07/28 13:35:26 | 000,000,000 | ---D | C] -- C:\Users\Keks\AppData\Roaming\13001.031 
[2012/07/28 13:35:33 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe177.dll 
[2012/07/27 07:53:43 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe176.dll 
[2012/07/23 07:30:07 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe173.dll 
[2012/07/16 13:20:39 | 000,006,400 | ---- | M] () -- C:\Users\Keks\AppData\Roaming\BAcroIEHelpe169.dll 
[2012/03/20 14:39:36 | 000,000,000 | ---D | M] -- C:\Users\Keks\AppData\Roaming\TP 
[2012/08/07 09:59:16 | 000,000,000 | ---D | C] -- C:\Users\Keks\Desktop\777lc 
:Files
C:\Users\Keks\AppData\Roaming\13*
C:\Users\Keks\AppData\Roaming\BAcroIEHelp*

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________

__________________

Alt 26.09.2012, 12:47   #3
t'john
/// Helfer-Team
 
Computer von "info@online-cyber-polizei" gesperrt - Standard

Computer von "info@online-cyber-polizei" gesperrt



Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.
__________________
__________________

Antwort

Themen zu Computer von "info@online-cyber-polizei" gesperrt
100 euro, bandoo, bezahlen, bild, bla, brauch, bundespolizei, compu, computer, conduit, euro, frage, fragen, gesperrt, intranet, langs, liebe, lieben, monitor.exe, msn deutschland, nicht mehr, problem, vista



Ähnliche Themen: Computer von "info@online-cyber-polizei" gesperrt


  1. "Cyber Crime Strike Week": Britische Polizei verhaftet 57 mutmaßliche Hacker
    Nachrichten - 06.03.2015 (0)
  2. Computer wurde gesperrt - "Polizei" Trojaner/Virus
    Plagegeister aller Art und deren Bekämpfung - 09.05.2013 (15)
  3. Polizei (Österreich) Control Department "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 26.03.2013 (12)
  4. Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"
    Log-Analyse und Auswertung - 12.02.2013 (5)
  5. 1) Polizei Cyber Crime... Department 2) "Windows-Kopie ist noch nicht bestätigt..."
    Plagegeister aller Art und deren Bekämpfung - 02.02.2013 (5)
  6. Polizei (Österreich) Control Department "Ihr Computer ist gesperrt
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (11)
  7. Polizei Control Department gegen Cyberkriminalität "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (15)
  8. Polizei Control Department gegen Cyberkriminalität "Ihr Computer ist gesperrt"
    Plagegeister aller Art und deren Bekämpfung - 31.01.2013 (7)
  9. Computer gesperrt "POLIZEI Cybercrime Investigation Department" , Ukash / Schweizerische Eidgenossenschaft
    Log-Analyse und Auswertung - 16.12.2012 (14)
  10. Trojaner "Polizei Cyber Crime Investignation Department" eingefangen
    Log-Analyse und Auswertung - 07.12.2012 (2)
  11. Bundestrojaner Variante: "Ihr Computer wurde gesperrt"; " Ihr Computer wurde durch das Speichern der autom. Informationskontrolle gesperrt"
    Log-Analyse und Auswertung - 25.11.2012 (10)
  12. "Polizei: Cyber Crime Investigation Department" Schadsoftware
    Plagegeister aller Art und deren Bekämpfung - 23.11.2012 (13)
  13. "Polizei: Cyber Crime Investigation Department" Trojaner: habe bereits OTL.Txt und Extras.Txt. erstellt
    Plagegeister aller Art und deren Bekämpfung - 13.11.2012 (16)
  14. Computer von "Cyber-Polizei Schweiz" gesperrt
    Log-Analyse und Auswertung - 11.11.2012 (26)
  15. Computer von "POLIZEI Cybercrime Investigation Department" gesperrt
    Log-Analyse und Auswertung - 05.11.2012 (9)
  16. "Polizei Cyber Crime Unit ...." Österreich-Variante.
    Plagegeister aller Art und deren Bekämpfung - 24.09.2012 (11)
  17. Computer von "info@online-cyber-polizei" gesperrt
    Plagegeister aller Art und deren Bekämpfung - 28.08.2012 (15)

Zum Thema Computer von "info@online-cyber-polizei" gesperrt - HALLO meine lieben wie ihr seht ist mein Computer von "info@online-cyber-polizei" gesperrt worden das problem ist das ich leider an nicht mehr ran komme pc fährt hoch bild ist da - Computer von "info@online-cyber-polizei" gesperrt...
Archiv
Du betrachtest: Computer von "info@online-cyber-polizei" gesperrt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.