| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: JS/Expack.aeu in C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkt0e7uc.default\Cache\E\A6\14C54d01Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
03.10.2012, 12:35
| #1 |
| |  JS/Expack.aeu in C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkt0e7uc.default\Cache\E\A6\14C54d01 Hallo Leute, ich bin absolut neu hier in diesem Forum. Vorhin hat Avira Free Antivirus sich hoch gepoppt und gemeldet das hier gefunden zu haben: JS/Expack.aeu in C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkt0e7uc.default\Cache\E\A6\14C54d01 Ich habe als erstes in Quarantäne verschoben mit Avira, was aber meines Erachtens eh nichts bringt. Ich merke am PC selber nichts von dem Virus/ Trojaner was auch immer. Wie eure Anleitung besagt habe ich das Programm durchlaufen lassen (OTL), das andere nicht da ich ein 64 bit System habe. Hier der Inhalt der Txt's: OTL Txt: OTL logfile created on: 03.10.2012 13:14:21 - Run 1 OTL by OldTimer - Version 3.2.70.1 Folder = C:\Users\Philipp\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 6,00 Gb Total Physical Memory | 4,38 Gb Available Physical Memory | 72,93% Memory free 12,00 Gb Paging File | 10,25 Gb Available in Paging File | 85,44% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 268,69 Gb Total Space | 28,55 Gb Free Space | 10,63% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 0,79 Gb Free Space | 0,34% Space Free | Partition Type: NTFS Drive F: | 29,30 Gb Total Space | 13,50 Gb Free Space | 46,07% Space Free | Partition Type: NTFS Computer Name: PP-PC | User Name: Philipp | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.10.03 13:13:50 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Philipp\Desktop\OTL.exe PRC - [2012.09.18 16:04:57 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012.08.11 15:27:57 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.17 22:31:18 | 000,776,088 | ---- | M] () -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe PRC - [2012.07.17 22:31:18 | 000,116,632 | ---- | M] () -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe PRC - [2012.06.05 11:48:30 | 000,087,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe PRC - [2012.05.09 16:58:54 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.09 16:58:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.05.04 07:37:00 | 003,521,424 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe PRC - [2012.04.06 17:10:01 | 000,624,856 | ---- | M] (Pandora.TV) -- C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe PRC - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.09.02 16:06:38 | 000,065,657 | ---- | M] (Motorola) -- C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe PRC - [2011.01.24 02:47:44 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe PRC - [2011.01.24 02:47:42 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe ========== Modules (No Company Name) ========== MOD - [2012.07.17 22:31:18 | 000,776,088 | ---- | M] () -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe MOD - [2011.01.24 02:47:44 | 000,148,280 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe MOD - [2011.01.24 02:47:42 | 000,770,728 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe MOD - [2010.04.05 12:56:07 | 000,716,954 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Epwizard.DLL MOD - [2010.04.05 12:55:15 | 000,159,890 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\customui.dll MOD - [2010.04.05 12:55:04 | 000,061,604 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Epfunct.DLL MOD - [2010.04.05 12:54:59 | 000,123,033 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Eputil.DLL MOD - [2010.04.05 12:54:52 | 000,143,502 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\Imagutil.DLL MOD - [2010.04.01 19:24:28 | 001,159,168 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecDRS.dll MOD - [2010.04.01 19:23:27 | 000,389,120 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecscw.dll MOD - [2009.06.23 13:11:04 | 000,102,400 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\EPOEMDll.dll MOD - [2009.06.23 13:10:29 | 000,045,056 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\epstring.dll MOD - [2009.06.23 13:09:11 | 002,203,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\EPWizRes.dll MOD - [2009.05.27 14:16:50 | 000,192,512 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecdatr.dll MOD - [2009.04.28 09:56:29 | 000,024,064 | ---- | M] () -- C:\Windows\SysWOW64\LXECsmr.dll MOD - [2009.04.07 21:25:27 | 000,409,600 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\iptk.dll MOD - [2009.03.10 07:43:49 | 000,155,648 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxeccaps.dll MOD - [2009.03.02 16:25:47 | 000,151,552 | ---- | M] () -- C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecptp.dll MOD - [2009.02.20 10:48:03 | 000,299,008 | ---- | M] () -- C:\Windows\SysWOW64\LXECsm.dll ========== Services (SafeList) ========== SRV:64bit: - [2010.04.14 22:08:30 | 001,052,328 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysNative\lxeccoms.exe -- (lxec_device) SRV:64bit: - [2010.04.14 22:08:23 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxecserv.exe -- (lxecCATSCustConnectService) SRV:64bit: - [2009.08.18 02:36:20 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.09.18 16:04:57 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012.09.07 12:09:04 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.17 22:31:18 | 000,116,632 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe -- (Motorola Device Manager) SRV - [2012.06.05 11:48:30 | 000,087,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe -- (DeviceMonitorService) SRV - [2012.05.09 16:58:54 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.09 16:58:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.06 17:10:01 | 000,624,856 | ---- | M] (Pandora.TV) [Auto | Running] -- C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe -- (PanService) SRV - [2012.03.23 14:25:24 | 000,087,040 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service) SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.09.02 16:06:38 | 000,065,657 | ---- | M] (Motorola) [Auto | Running] -- C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe -- (PST Service) SRV - [2010.04.14 22:08:23 | 000,045,736 | ---- | M] () [Auto | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\\lxecserv.exe -- (lxecCATSCustConnectService) SRV - [2010.04.14 22:08:12 | 000,598,696 | ---- | M] ( ) [Auto | Running] -- C:\Windows\SysWOW64\lxeccoms.exe -- (lxec_device) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.08.17 17:12:11 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt) DRV:64bit: - [2012.08.17 17:12:10 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt) DRV:64bit: - [2012.06.11 11:56:34 | 000,022,016 | ---- | M] (Motorola Mobility Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motccgp.sys -- (motccgp) DRV:64bit: - [2012.06.08 16:09:12 | 000,027,136 | ---- | M] (Motorola Mobility Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Motousbnet.sys -- (Motousbnet) DRV:64bit: - [2012.06.08 16:08:54 | 000,008,832 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motswch.sys -- (MotoSwitchService) DRV:64bit: - [2012.05.09 16:58:54 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.09 16:58:54 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.28 13:49:13 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.02.15 11:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.01.25 14:57:46 | 000,009,728 | ---- | M] (Motorola Mobility Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motccgpfl.sys -- (motccgpfl) DRV:64bit: - [2011.12.08 06:22:28 | 000,177,640 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdm.sys -- (ssadmdm) DRV:64bit: - [2011.12.08 06:22:28 | 000,157,672 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadbus.sys -- (ssadbus) DRV:64bit: - [2011.12.08 06:22:28 | 000,146,920 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadserd.sys -- (ssadserd) DRV:64bit: - [2011.12.08 06:22:28 | 000,036,328 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadadb.sys -- (androidusb) DRV:64bit: - [2011.12.08 06:22:28 | 000,016,872 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ssadmdfl.sys -- (ssadmdfl) DRV:64bit: - [2011.11.08 13:59:12 | 000,011,776 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motusbdevice.sys -- (motusbdevice) DRV:64bit: - [2011.09.16 16:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.07.29 13:54:56 | 000,016,776 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\epmntdrv.sys -- (epmntdrv) DRV:64bit: - [2011.07.29 13:54:56 | 000,009,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\EuGdiDrv.sys -- (EuGdiDrv) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.06.25 16:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot) DRV:64bit: - [2009.11.02 18:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64) DRV:64bit: - [2009.08.23 05:08:10 | 000,056,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1E62x64.sys -- (L1E) DRV:64bit: - [2009.08.18 03:48:48 | 006,037,504 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.01.29 18:11:38 | 000,006,144 | ---- | M] (Motorola Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\motfilt.sys -- (BTCFilterService) DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor) DRV - [2011.07.29 13:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\epmntdrv.sys -- (epmntdrv) DRV - [2011.07.29 13:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\EuGdiDrv.sys -- (EuGdiDrv) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6E C0 49 39 4F 0B CD 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;192.168.*.* ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}:6.0.33 FF - prefs.js..extensions.enabledAddons: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}:6.0.35 FF - prefs.js..extensions.enabledAddons: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:1.1 FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_4_402_265.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_35: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll File not found FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 12:09:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 12:09:03 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.09.07 12:09:04 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.09.07 12:09:03 | 000,000,000 | ---D | M] [2012.03.26 14:55:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philipp\AppData\Roaming\mozilla\Extensions [2012.09.15 19:30:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philipp\AppData\Roaming\mozilla\Firefox\Profiles\lkt0e7uc.default\extensions [2012.06.14 20:29:39 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Philipp\AppData\Roaming\mozilla\Firefox\Profiles\lkt0e7uc.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.09.15 19:30:03 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Philipp\AppData\Roaming\mozilla\Firefox\Profiles\lkt0e7uc.default\extensions\ich@maltegoetz.de [2012.09.15 19:30:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Philipp\AppData\Roaming\mozilla\Firefox\Profiles\lkt0e7uc.default\extensions\staged [2012.09.15 10:45:30 | 000,270,876 | ---- | M] () (No name found) -- C:\Users\Philipp\AppData\Roaming\mozilla\firefox\profiles\lkt0e7uc.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2012.09.12 15:36:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.09.07 12:09:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012.09.12 15:36:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012.09.07 12:09:04 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.12.09 19:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2012.07.01 18:20:22 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.04 09:59:04 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.07.01 18:20:22 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.07.01 18:20:22 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.01 18:20:22 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.01 18:20:22 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll () O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll () O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files (x86)\Lexmark Toolbar\toolband.dll () O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\ezprint.exe () O4:64bit: - HKLM..\Run: [lxecmon.exe] C:\Program Files (x86)\Lexmark Pro800-Pro900 Series\lxecmon.exe () O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [KiesHelper] C:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung) O4 - HKCU..\Run: [MotoCast] C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Philipp\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Philipp\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~2\MICROS~1\OFFICE11\EXCEL.EXE/3000 File not found O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35) O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37EB815E-74AE-4A90-BA2D-514F21749B4F}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - F:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{25248211-f666-11e1-80e9-90e6ba071684}\Shell - "" = AutoRun O33 - MountPoints2\{25248211-f666-11e1-80e9-90e6ba071684}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a O33 - MountPoints2\{dd0d3c99-0576-11e2-a9e5-90e6ba071684}\Shell - "" = AutoRun O33 - MountPoints2\{dd0d3c99-0576-11e2-a9e5-90e6ba071684}\Shell\AutoRun\command - "" = G:\MotoCastSetup.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.10.03 13:13:49 | 000,600,064 | ---- | C] (OldTimer Tools) -- C:\Users\Philipp\Desktop\OTL.exe [2012.09.28 13:59:04 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\Ashampoo [2012.09.28 13:58:55 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Local\ashampoo [2012.09.28 13:58:55 | 000,000,000 | ---D | C] -- C:\ProgramData\ashampoo [2012.09.28 13:58:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ashampoo [2012.09.28 13:58:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ashampoo [2012.09.27 16:15:43 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Documents\FIFA 12 [2012.09.27 15:56:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Fifa 12 [2012.09.27 15:46:04 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Desktop\Fifa.12.GERMAN-0x0007 [2012.09.25 18:07:08 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Local\Diagnostics [2012.09.25 08:39:06 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Documents\Podcast [2012.09.24 17:51:24 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\dvdcss [2012.09.24 17:09:52 | 000,000,000 | ---D | C] -- C:\Users\Philipp\.gstreamer-0.10 [2012.09.24 17:09:36 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Local\Motorola [2012.09.24 17:09:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero [2012.09.24 17:09:27 | 000,000,000 | ---D | C] -- C:\Binaries [2012.09.24 17:09:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2012.09.24 17:09:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Motorola Media Link [2012.09.24 17:09:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Motorola [2012.09.24 17:09:03 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\Motorola Mobility [2012.09.24 17:08:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\MSSoap [2012.09.24 17:08:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Motorola Mobility [2012.09.24 17:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Motorola Shared [2012.09.24 17:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\Motorola Inc [2012.09.24 17:07:54 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\Motorola [2012.09.24 17:07:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Motorola [2012.09.24 17:07:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Motorola Mobility [2012.09.24 17:07:20 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\MotoCast [2012.09.23 14:56:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tunatic [2012.09.18 17:18:35 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.09.18 17:18:34 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2012.09.18 17:18:18 | 007,163,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll [2012.09.18 17:18:18 | 002,605,400 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib.dll [2012.09.18 17:18:18 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2012.09.18 17:18:18 | 000,433,504 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll [2012.09.18 17:18:18 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2012.09.18 17:18:18 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2012.09.18 17:18:18 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2012.09.18 17:18:18 | 000,221,024 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFNHK64.dll [2012.09.18 17:18:18 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2012.09.18 17:18:18 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2012.09.18 17:18:18 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2012.09.18 17:18:18 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2012.09.18 17:18:18 | 000,141,152 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll [2012.09.18 17:18:18 | 000,123,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll [2012.09.18 17:18:18 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2012.09.18 17:18:18 | 000,081,248 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFCOM64.dll [2012.09.18 17:18:18 | 000,078,688 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFAPO64.dll [2012.09.18 17:18:18 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2012.09.18 17:18:18 | 000,074,592 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll [2012.09.18 17:18:18 | 000,074,064 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll [2012.09.18 17:18:17 | 008,363,864 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek.dll [2012.09.18 17:18:17 | 002,533,952 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2012.09.18 17:18:17 | 002,131,288 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ.dll [2012.09.18 17:18:17 | 001,756,264 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll [2012.09.18 17:18:17 | 001,568,360 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll [2012.09.18 17:18:17 | 001,486,952 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll [2012.09.18 17:18:17 | 001,345,368 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek264.dll [2012.09.18 17:18:17 | 001,015,640 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll [2012.09.18 17:18:17 | 000,728,680 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll [2012.09.18 17:18:17 | 000,712,296 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll [2012.09.18 17:18:17 | 000,693,352 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll [2012.09.18 17:18:17 | 000,603,984 | ---- | C] (Knowles Acoustics ) -- C:\Windows\SysNative\KAAPORT64.dll [2012.09.18 17:18:17 | 000,537,456 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PLFX64.dll [2012.09.18 17:18:17 | 000,524,656 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PGFX64.dll [2012.09.18 17:18:17 | 000,491,112 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll [2012.09.18 17:18:17 | 000,449,392 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PREC64.dll [2012.09.18 17:18:17 | 000,432,744 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll [2012.09.18 17:18:17 | 000,428,648 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll [2012.09.18 17:18:17 | 000,396,632 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll [2012.09.18 17:18:17 | 000,341,336 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll [2012.09.18 17:18:17 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2012.09.18 17:18:17 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll [2012.09.18 17:18:17 | 000,242,792 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll [2012.09.18 17:18:17 | 000,241,768 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll [2012.09.18 17:18:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2012.09.18 17:18:15 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2012.09.18 16:40:24 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Local\Ubisoft Game Launcher [2012.09.18 16:24:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Ubisoft [2012.09.18 16:04:57 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\PunkBuster [2012.09.12 16:33:22 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\elsterformular [2012.09.12 16:30:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular [2012.09.12 16:30:04 | 000,000,000 | ---D | C] -- C:\ProgramData\elsterformular [2012.09.12 16:29:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular [2012.09.07 12:09:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.09.05 17:59:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medieval Software [2012.09.05 17:59:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Medieval Software [2012.09.05 17:41:16 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\CUE Tools [2012.09.05 17:38:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLAC [2012.09.05 17:38:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FLAC [2012.09.05 17:17:19 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Documents\Freemake [2012.09.05 17:17:18 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake [2012.09.05 17:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake [2012.09.05 17:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake [2012.09.05 17:17:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake [2012.09.05 16:27:33 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\mp3DirectCut [2012.09.05 16:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\mp3DirectCut [2012.09.05 16:08:26 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\foobar2000 [2012.09.05 16:08:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\foobar2000 [2012.09.05 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Philipp\AppData\Roaming\Audacity [2012.09.05 16:03:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity [2012.09.05 11:44:21 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Desktop\Vannesa Bilder [2012.09.05 11:38:26 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Desktop\Musik alle [2012.09.04 16:42:06 | 000,000,000 | ---D | C] -- C:\Users\Philipp\Desktop\Programme + Spiele [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.10.03 13:13:50 | 000,600,064 | ---- | M] (OldTimer Tools) -- C:\Users\Philipp\Desktop\OTL.exe [2012.10.03 13:12:54 | 000,000,168 | ---- | M] () -- C:\Users\Philipp\defogger_reenable [2012.10.03 12:43:55 | 000,014,960 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.10.03 12:43:55 | 000,014,960 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.10.03 12:40:42 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.10.03 12:40:42 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.10.03 12:40:42 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.10.03 12:40:42 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.10.03 12:40:42 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.10.03 12:36:14 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.10.03 12:36:02 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.10.03 12:35:57 | 536,174,591 | -HS- | M] () -- C:\hiberfil.sys [2012.10.02 17:20:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.29 18:40:22 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motfilt_01007.Wdf [2012.09.29 18:40:21 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2012.09.29 18:40:17 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2012.09.29 18:40:17 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf [2012.09.29 18:40:13 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2012.09.28 13:58:54 | 000,001,319 | ---- | M] () -- C:\Users\Public\Desktop\Ashampoo Burning Studio 2012.lnk [2012.09.27 16:00:34 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Fifa 12.lnk [2012.09.25 18:12:27 | 000,001,291 | ---- | M] () -- C:\Users\Philipp\Desktop\Free Audio CD Burner.lnk [2012.09.24 17:00:31 | 001,308,644 | ---- | M] () -- C:\Users\Philipp\Documents\bafög antrag.pdf [2012.09.23 14:56:59 | 000,001,799 | ---- | M] () -- C:\Users\Philipp\Desktop\Tunatic.lnk [2012.09.18 16:04:59 | 000,189,248 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.09.18 16:04:57 | 000,075,136 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.09.12 17:35:59 | 000,272,209 | ---- | M] () -- C:\Users\Philipp\Documents\Schulbescheinigung TO Sä 2012.PDF [2012.09.12 16:30:04 | 000,001,225 | ---- | M] () -- C:\Users\Public\Desktop\ElsterFormular.lnk [2012.09.05 18:00:00 | 000,001,242 | ---- | M] () -- C:\Users\Public\Desktop\Medieval CUE Splitter.lnk [2012.09.05 17:38:11 | 000,001,858 | ---- | M] () -- C:\Users\Public\Desktop\FLAC Frontend.lnk [2012.09.05 17:17:18 | 000,001,316 | ---- | M] () -- C:\Users\Public\Desktop\Freemake Audio Converter.lnk [2012.09.05 17:12:22 | 000,001,308 | ---- | M] () -- C:\Users\Philipp\Desktop\lame - Verknüpfung.lnk [2012.09.05 16:25:03 | 000,001,051 | ---- | M] () -- C:\Users\Philipp\Desktop\mp3DirectCut.lnk [2012.09.05 16:08:23 | 000,001,027 | ---- | M] () -- C:\Users\Public\Desktop\foobar2000.lnk [2012.09.05 16:03:51 | 000,001,003 | ---- | M] () -- C:\Users\Philipp\Desktop\Audacity.lnk [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.10.03 13:12:54 | 000,000,168 | ---- | C] () -- C:\Users\Philipp\defogger_reenable [2012.09.29 18:40:22 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motfilt_01007.Wdf [2012.09.29 18:40:21 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Motousbnet_01007.Wdf [2012.09.29 18:40:17 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgpfl_01007.Wdf [2012.09.29 18:40:17 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motccgp_01007.Wdf [2012.09.29 18:40:13 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_motusbdevice_01007.Wdf [2012.09.28 13:58:54 | 000,001,319 | ---- | C] () -- C:\Users\Public\Desktop\Ashampoo Burning Studio 2012.lnk [2012.09.27 16:00:34 | 000,001,083 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fifa 12.lnk [2012.09.27 16:00:34 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Fifa 12.lnk [2012.09.25 18:12:27 | 000,001,291 | ---- | C] () -- C:\Users\Philipp\Desktop\Free Audio CD Burner.lnk [2012.09.24 17:00:31 | 001,308,644 | ---- | C] () -- C:\Users\Philipp\Documents\bafög antrag.pdf [2012.09.23 14:56:59 | 000,001,799 | ---- | C] () -- C:\Users\Philipp\Desktop\Tunatic.lnk [2012.09.18 17:18:18 | 000,293,889 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT [2012.09.18 16:04:59 | 000,189,248 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.09.18 16:04:57 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012.09.12 17:35:59 | 000,272,209 | ---- | C] () -- C:\Users\Philipp\Documents\Schulbescheinigung TO Sä 2012.PDF [2012.09.12 16:30:04 | 000,001,225 | ---- | C] () -- C:\Users\Public\Desktop\ElsterFormular.lnk [2012.09.05 18:00:00 | 000,001,242 | ---- | C] () -- C:\Users\Public\Desktop\Medieval CUE Splitter.lnk [2012.09.05 17:38:11 | 000,001,858 | ---- | C] () -- C:\Users\Public\Desktop\FLAC Frontend.lnk [2012.09.05 17:17:18 | 000,001,316 | ---- | C] () -- C:\Users\Public\Desktop\Freemake Audio Converter.lnk [2012.09.05 17:12:22 | 000,001,308 | ---- | C] () -- C:\Users\Philipp\Desktop\lame - Verknüpfung.lnk [2012.09.05 16:25:03 | 000,001,051 | ---- | C] () -- C:\Users\Philipp\Desktop\mp3DirectCut.lnk [2012.09.05 16:08:23 | 000,001,109 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk [2012.09.05 16:08:23 | 000,001,027 | ---- | C] () -- C:\Users\Public\Desktop\foobar2000.lnk [2012.09.05 16:03:51 | 000,001,015 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk [2012.09.05 16:03:51 | 000,001,003 | ---- | C] () -- C:\Users\Philipp\Desktop\Audacity.lnk [2012.08.28 09:32:47 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe [2012.08.28 09:32:47 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe [2012.08.28 09:32:47 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll [2012.08.28 09:32:47 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys [2012.08.28 09:32:47 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys [2012.04.16 20:31:35 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXECinst.dll [2012.04.16 20:31:34 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecpmui.dll [2012.04.16 20:31:34 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecinpa.dll [2012.04.16 20:31:34 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxeccomx.dll [2012.04.16 20:31:34 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeciesc.dll [2012.04.16 20:31:34 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxecins.dll [2012.04.16 20:31:34 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxecinsb.dll [2012.04.16 20:31:34 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxecinsr.dll [2012.04.16 20:31:34 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxecjswr.dll [2012.04.16 20:31:34 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxeccur.dll [2012.04.16 20:31:33 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecserv.dll [2012.04.16 20:31:33 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecusb1.dll [2012.04.16 20:31:33 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccomc.dll [2012.04.16 20:31:33 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxechbn3.dll [2012.04.16 20:31:33 | 000,598,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccoms.exe [2012.04.16 20:31:33 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeclmpm.dll [2012.04.16 20:31:33 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccomm.dll [2012.04.16 20:31:33 | 000,324,264 | ---- | C] ( ) -- C:\Windows\SysWow64\lxecih.exe [2012.04.16 20:31:33 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxeccu.dll [2012.04.16 20:31:33 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxeccub.dll [2012.04.16 20:31:32 | 000,373,416 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeccfg.exe [2012.04.16 20:30:26 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXECsm.dll [2012.04.16 20:30:26 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\LXECsmr.dll [2012.03.28 13:53:33 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.03.26 14:43:20 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.03.26 12:15:56 | 000,032,127 | ---- | C] () -- C:\Users\Philipp\bookmarks-2012-03-26.json [2012.01.31 18:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012.01.31 18:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2012.01.31 18:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2012.01.31 18:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2012.01.31 18:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.09.28 13:59:05 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Ashampoo [2012.09.05 18:08:18 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Audacity [2012.09.05 17:52:17 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\CUE Tools [2012.03.28 13:50:35 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\DAEMON Tools Lite [2012.09.29 17:45:09 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\DVDVideoSoft [2012.06.14 20:29:39 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\DVDVideoSoftIEHelpers [2012.09.12 16:33:23 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\elsterformular [2012.09.05 18:07:23 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\foobar2000 [2012.10.03 13:14:05 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\MotoCast [2012.09.24 17:07:56 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Motorola [2012.09.24 17:09:03 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Motorola Mobility [2012.09.05 16:27:33 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\mp3DirectCut [2012.03.28 12:15:12 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Opera [2012.05.07 22:33:31 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Outlook [2012.09.18 16:04:57 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\PunkBuster [2012.04.11 14:17:29 | 000,000,000 | ---D | M] -- C:\Users\Philipp\AppData\Roaming\Samsung ========== Purity Check ========== < End of report > Extras.txt: OTL Extras logfile created on: 03.10.2012 13:14:21 - Run 1 OTL by OldTimer - Version 3.2.70.1 Folder = C:\Users\Philipp\Desktop 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 6,00 Gb Total Physical Memory | 4,38 Gb Available Physical Memory | 72,93% Memory free 12,00 Gb Paging File | 10,25 Gb Available in Paging File | 85,44% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 268,69 Gb Total Space | 28,55 Gb Free Space | 10,63% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 0,79 Gb Free Space | 0,34% Space Free | Partition Type: NTFS Drive F: | 29,30 Gb Total Space | 13,50 Gb Free Space | 46,07% Space Free | Partition Type: NTFS Computer Name: PP-PC | User Name: Philipp | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Unable to open value key htmlfile [edit] -- Reg Error: Unable to open value key htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Unable to open value key scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Unable to open value key Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Unable to open value key htmlfile [edit] -- Reg Error: Unable to open value key htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Unable to open value key scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Unable to open value key Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00936D4D-3B4F-40B0-936A-E37EC8BD1262}" = lport=138 | protocol=17 | dir=in | app=system | "{064A93C6-6DB9-41CB-A19F-81AE83D1586D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{15E8ABF6-D714-4F46-8FE2-01E77030E329}" = rport=139 | protocol=6 | dir=out | app=system | "{1FF3DA0D-867E-4484-8ADD-78D5F3A5220C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{3A230FF4-5A04-443B-BA4E-6BEAB344C780}" = lport=139 | protocol=6 | dir=in | app=system | "{41EE69FA-7D59-4EC5-9309-BCD425761053}" = rport=137 | protocol=17 | dir=out | app=system | "{47FEC849-3AA3-47A8-9A96-4C7F89652FF8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{48023632-9E91-405C-BAF4-73B58D460A9B}" = rport=10243 | protocol=6 | dir=out | app=system | "{673DC7DE-14CE-4625-ACE9-925DA7EEF0F7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{7494E77A-6350-47A4-BE06-AF9E893F31D2}" = lport=137 | protocol=17 | dir=in | app=system | "{7649AE3C-E630-4070-9C42-4DE426805CDE}" = rport=445 | protocol=6 | dir=out | app=system | "{7F82EE24-FEB4-466F-83FF-F6F836D1FDDD}" = rport=138 | protocol=17 | dir=out | app=system | "{80F3CC80-371C-4779-8B84-61FE45D87C05}" = lport=2869 | protocol=6 | dir=in | app=system | "{8FCFCEF2-B3B4-4A02-8714-9A343E92E734}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{9F1152F1-4E05-49AA-BE1A-C0A421954D47}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{9FD26E92-A158-42CB-9C6D-DB29ACB12948}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{B1A24181-BD5A-4FEA-918B-17CCCD2D771C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{D429F370-F78C-4A5F-86AB-B107572541DF}" = lport=10243 | protocol=6 | dir=in | app=system | "{DFE0DD61-3BA0-4A4E-9B1D-B2FFB398A5E1}" = lport=445 | protocol=6 | dir=in | app=system | "{E47B4D17-CAE3-458F-9784-D9FA7B4D5BFC}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F2656839-90B8-40D9-8A3D-7AA0C592457D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00BC8F20-DC32-464A-8489-90BB62F5C701}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | "{0A813F3A-1826-4673-A735-50112B5BCF5C}" = protocol=17 | dir=in | app=c:\program files (x86)\opera\opera.exe | "{0C080D9A-5C17-422C-B618-4E4A8DD92279}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | "{0D0C3EA6-120B-4A1E-B3CD-F572966527BB}" = dir=in | app=c:\program files (x86)\motorola media link\lite\mml.exe | "{12A26046-A373-4485-A5D1-188E1C6E06D5}" = protocol=6 | dir=in | app=c:\program files (x86)\pandora.tv\panservice\pandoraservice.exe | "{2282DB0A-07F2-4CBB-84F1-013A75461345}" = protocol=17 | dir=in | app=c:\program files (x86)\pandora.tv\panservice\pandoraservice.exe | "{279267D3-825F-4F06-B6B0-E11F8F6F17B6}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | "{2C4E4970-839F-41FB-B3BB-03C7B2AE7C66}" = protocol=6 | dir=in | app=c:\program files (x86)\pandora.tv\panservice\pandoraservice.exe | "{2D90D97A-6793-48ED-A34C-AC3DBCC47BB6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{2F657C44-B3AF-4435-8DE9-2002E89F3038}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | "{32DDD5B5-7B1A-4F34-8243-763862B52147}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{3579FF82-7AF4-43FB-A2E1-64F7B1FAA238}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{38E2C6D3-1353-49C2-B8E8-5F36D219B4AA}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | "{39276FC4-37D7-4ECB-8C06-5C31916FA2BE}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | "{3E63FDB7-5EC3-43CC-9784-27A1039A06D8}" = protocol=17 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | "{43030BCB-8FFC-4F94-B225-ACF12DAB0477}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | "{4326338B-07E3-406F-A068-4BA012CC4DCE}" = protocol=6 | dir=out | app=system | "{43FC1C3A-9F10-4EF4-9CDF-827F06E89FE8}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{4BC6B250-E821-4516-BBFE-C40E3B17533A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{50A10719-7595-495D-95CE-075AF3FE4825}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbmp.exe | "{5309DD98-E4F8-4686-9BC8-D41A72E8B487}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | "{56877862-0283-4DA5-B52A-92C6F237367F}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | "{58BC59AD-A46A-4031-8904-4464BB79BA52}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{5D13EA10-A154-4393-996E-03296AB1F964}" = protocol=6 | dir=in | app=c:\program files (x86)\abbyy finereader 6.0 sprint\scan\scanman6.exe | "{5E0DBD93-4DB3-4587-AF77-E1FC0F193FE0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{5E1ADF7B-0791-464D-8354-1E1F67FEABB0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{619F9D0E-D1A6-4803-AE66-4A5F2CBD13FD}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{70A64893-5929-4E08-B2EA-1B1B65AB5A80}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{74F18A95-649F-4E4B-B501-64D2014D2C6C}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{7971046E-CE3E-4482-B6B1-67099B3E1A17}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe | "{79CC8381-58FB-413C-BDF1-422D47DA7B5F}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{82C40D7B-182A-43AC-9313-04B63A8200C3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{8BD47807-1FAE-47A2-9A80-608F36DFA35E}" = dir=in | app=c:\program files (x86)\motorola mobility\motocast\bin\motocast-thumbnailer.exe | "{944DEC75-6D26-4351-BDA5-930CDEEDB078}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{94FE1F2D-7B45-4D9B-A57B-A581BB96D368}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\acbsp.exe | "{997442CB-4D7F-483A-9AD4-CFAAC3AE635C}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{9C806AB2-4FFE-4709-81F2-6EFFB3577E75}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{A07BC7D4-ED0A-499F-96FD-4039D0D22482}" = dir=in | app=c:\windows\system32\lxeccoms.exe | "{A408F683-9D8E-456C-8305-271FBDC6BFB3}" = dir=out | app=c:\program files (x86)\motorola mobility\motocast\bin\motocast-thumbnailer.exe | "{ACC2C0FC-601C-4984-81E8-CBD3E16D932F}" = dir=in | app=c:\windows\system32\lxeccoms.exe | "{AF3CE5FA-1619-44E7-8343-5316C943DA8A}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | "{B14531EF-2F6D-47E0-B7BA-92C0B851D313}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | "{B65DA66A-DAE7-4E67-B1BD-7AF8622BDA20}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{B6CCEE70-BB6C-40F5-8C13-48EEF80C992A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{BB486BF3-545B-48FA-B0FE-89D970F1F3FB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{BC2D9032-3D9E-475D-95FB-3BB56531C058}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{BEBDA742-107A-4955-A2A2-4FDB83A6F65D}" = dir=in | app=c:\windows\system32\lxeccoms.exe | "{C030FA46-9049-454C-8E25-80D27368A686}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{C33A8A91-9AE5-406F-83C2-FF64EFE80A7A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{C47B423F-9449-4087-819E-361414892A1A}" = dir=in | app=c:\windows\system32\lxeccoms.exe | "{CC06579F-B3EC-44C4-987D-73AA00CACE85}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{D6C0F55D-2A80-4942-8E64-C01691826DCA}" = protocol=17 | dir=in | app=c:\program files (x86)\pandora.tv\panservice\pandoraservice.exe | "{D7F495C8-991F-4339-9D82-E3E9E74E25D8}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\uplaybrowser.exe | "{DDAF0772-1130-469D-9C9F-D4E70C8D7092}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{DE5BF371-6A56-425D-A500-AA5E427185F5}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{E13DA662-B9D3-4756-BB92-33D2E64C1783}" = dir=out | app=c:\program files (x86)\motorola mobility\motocast\motocast.exe | "{E4F454CA-48DA-443E-83CA-D701497EDFF4}" = protocol=6 | dir=in | app=c:\program files (x86)\opera\opera.exe | "{E6B61B14-CAE7-44CA-8002-25912B721E72}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{EC40AD13-E3A6-433E-A6FD-6F80F574473F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{F070C86C-3188-4310-860C-CA04DD25A845}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{F36F7F3C-7207-4B1A-BBC2-52EA9838F313}" = dir=in | app=c:\program files (x86)\motorola mobility\motocast\motocast.exe | "{F6DABF64-033E-46B1-A711-0D3BE0B1826B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\assassin's creed brotherhood\assassinscreedbrotherhood.exe | "{F7309B0C-C247-46F5-9793-7AE49CCCD12D}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe | "{FEC187A7-3996-43CE-9BBF-2ACF0B9B8352}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "TCP Query User{182AA9A0-7BE8-4EA9-8B2E-D2ABF351DC0F}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "TCP Query User{5D1F858E-201C-4A82-83B9-3B76A0323782}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | "TCP Query User{65115E06-5D35-4657-91D6-7BC6E567D6F8}C:\program files (x86)\fifa 12\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files (x86)\fifa 12\game\fifa.exe | "TCP Query User{9554A0CD-1A14-448C-B72E-66E55A42B654}C:\program files (x86)\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | "TCP Query User{A73E996C-D2F1-4113-908F-D9A6E4AA1AA7}C:\program files (x86)\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | "TCP Query User{CD642202-04C4-468A-8C0C-B797324BCCD3}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "UDP Query User{205A9594-10C4-4B01-A08B-0A42086DE028}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | "UDP Query User{2B29F0CD-331B-4346-806F-7C8A5158B8D6}C:\program files (x86)\fifa 12\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files (x86)\fifa 12\game\fifa.exe | "UDP Query User{54A81E2F-EC3D-48C0-A369-C401DFAF4DA0}C:\program files (x86)\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\winamp\winamp.exe | "UDP Query User{A1540DFE-9859-40FB-AC89-AF0C34DF0F84}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "UDP Query User{B5D96AB1-33F9-4273-80A3-BEBC4AF46149}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | "UDP Query User{CEEC77EC-76FD-4A0D-98A9-4F7EDFFA24C8}C:\program files (x86)\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sopcast\sopcast.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{4E7CCB76-687B-4C53-9A5E-08780AF3A551}" = Motorola Mobile Drivers Installation 5.9.0 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Lexmark Pro800-Pro900 Series" = Lexmark Pro800-Pro900 Series "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "VLC media player" = VLC media player 2.0.1 "WinRAR archiver" = WinRAR 4.20 (64-Bit) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404 "{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 35 "{28DB8373-C1BB-444F-A427-A55585A12ED7}" = Motorola Device Manager "{2AADC4EE-94C8-422B-977B-547774C4A463}" = Motorola Device Software Update "{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver "{33286280-8617-11E1-8FF6-B8AC6F97B88E}" = Google Earth Plug-in "{378397D6-FD32-4092-A854-6A75CB7EDA46}" = MOTOROLA MEDIA LINK "{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404 "{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5401CEE8-3C2D-4835-A802-213306537FF4}" = MotoCast "{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer "{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy "{B96D2269-568B-4CBF-9332-12FAE8B158F7}" = Medieval CUE Splitter "{BE4BA698-8533-4F77-9559-C7F3F78C0B05}" = Assassin's Creed Brotherhood "{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark "{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8 "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio "4F6D5E84-5826-4394-9F40-3A9A19165651_is1" = Pandora Service "5513-1208-7298-9440" = JDownloader 0.9 "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Anti-Twin 2012-04-03 11.57.27" = Anti-Twin (Installation 03.04.2012) "Ashampoo Burning Studio 2012_is1" = Ashampoo Burning Studio 2012 v.10.0.15 "Audacity_is1" = Audacity 2.0.2 "Avira AntiVir Desktop" = Avira Free Antivirus "DAEMON Tools Lite" = DAEMON Tools Lite "EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition "ElsterFormular" = ElsterFormular "Fifa 12 (c) Electronic Arts_is1" = Fifa 12 (c) Electronic Arts version 1 "FLAC" = FLAC 1.2.1b (remove only) "foobar2000" = foobar2000 v1.1.14a "Free Audio CD Burner_is1" = Free Audio CD Burner version 2.0.19.903 "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.32.918 "Freemake Audio Converter_is1" = Freemake Audio Converter Version 1.1.0 "InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies "Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "Opera 11.62.1347" = Opera 11.62 "PunkBusterSvc" = PunkBuster Services "SopCast" = SopCast 3.5.0 "The KMPlayer" = The KMPlayer (remove only) "Tunatic" = Tunatic "Winamp" = Winamp ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de) "Winamp Detect" = Winamp Erkennungs-Plug-in ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 25.09.2012 11:56:27 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0x2120 Startzeit der fehlerhaften Anwendung: 0x01cd9b3651a19be8 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: 8fe2142c-0729-11e2-87a6-90e6ba071684 Error - 26.09.2012 09:31:43 | Computer Name = Pp-PC | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 27.09.2012 11:22:19 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0x974 Startzeit der fehlerhaften Anwendung: 0x01cd9cb4e35921ad Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: 20464f2f-08b7-11e2-8c16-90e6ba071684 Error - 27.09.2012 11:45:53 | Computer Name = Pp-PC | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 29.09.2012 10:46:45 | Computer Name = Pp-PC | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 29.09.2012 12:42:35 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0xc80 Startzeit der fehlerhaften Anwendung: 0x01cd9e3c4af0dca1 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: ab376283-0a54-11e2-ab0d-90e6ba071684 Error - 29.09.2012 12:42:56 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0x3cc Startzeit der fehlerhaften Anwendung: 0x01cd9e61790136d1 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: b83d50d4-0a54-11e2-ab0d-90e6ba071684 Error - 29.09.2012 12:43:34 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0x1488 Startzeit der fehlerhaften Anwendung: 0x01cd9e619060870d Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: ce81b70b-0a54-11e2-ab0d-90e6ba071684 Error - 01.10.2012 10:34:11 | Computer Name = Pp-PC | Source = SideBySide | ID = 16842815 Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files (x86)\spybot - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files (x86)\spybot - search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig. Error - 02.10.2012 10:22:18 | Computer Name = Pp-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: winamp.exe, Version: 5.6.2.3199, Zeitstempel: 0x4ee2440b Name des fehlerhaften Moduls: MSVCR90.dll, Version: 9.0.30729.6161, Zeitstempel: 0x4dace5b9 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00056b1d ID des fehlerhaften Prozesses: 0xf44 Startzeit der fehlerhaften Anwendung: 0x01cda09813f82413 Pfad der fehlerhaften Anwendung: C:\Program Files (x86)\Winamp\winamp.exe Pfad des fehlerhaften Moduls: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll Berichtskennung: 91ddd7a4-0c9c-11e2-a504-90e6ba071684 [ System Events ] Error - 02.10.2012 02:45:21 | Computer Name = Pp-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 02.10.2012 07:34:31 | Computer Name = Pp-PC | Source = atikmdag | ID = 52236 Description = CPLIB :: General - Invalid Parameter Error - 02.10.2012 07:34:31 | Computer Name = Pp-PC | Source = atikmdag | ID = 43029 Description = Display is not active Error - 02.10.2012 07:34:37 | Computer Name = Pp-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxecCATSCustConnectService erreicht. Error - 02.10.2012 07:34:37 | Computer Name = Pp-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 03.10.2012 06:36:02 | Computer Name = Pp-PC | Source = atikmdag | ID = 52236 Description = CPLIB :: General - Invalid Parameter Error - 03.10.2012 06:36:02 | Computer Name = Pp-PC | Source = atikmdag | ID = 43029 Description = Display is not active Error - 03.10.2012 06:36:14 | Computer Name = Pp-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst lxecCATSCustConnectService erreicht. Error - 03.10.2012 06:36:14 | Computer Name = Pp-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "lxecCATSCustConnectService" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 03.10.2012 06:39:00 | Computer Name = Pp-PC | Source = BROWSER | ID = 8032 Description = < End of report > Muss ich den PC neu aufziehen oder was soll ich machen? Gruss und schon mal vielen Danke Bozo |
| Themen zu JS/Expack.aeu in C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkt0e7uc.default\Cache\E\A6\14C54d01 |
| antivirus, autorun, avira, bho, bonjour, converter, error, excel, firefox, flash player, focus, google, install.exe, installation, jdownloader, logfile, mozilla, mp3, pandora.tv, plug-in, programm, registry, richtlinie, rundll, scan, security, software, svchost.exe, system, trojaner, windows |
Baum-Darstellung