| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCsWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
28.12.2012, 17:55
| #1 |
| |  GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs Liebe Forengemeinde, ich habe wie einige andere hier im Forum, dass Problem mit dem GVU-Trojaner, der den PC sperrt. Ich eröffne einen eigenen Thread, da so die Logs anscheinend besser ausgewertet werden können. Welche Schritte muss ich als erstes machen? Was passiert eigentlich, wenn ich den Computer nicht ausmache? Kommt diese "Gesperrt"-Meldung dann nach einer bestimmten Zeit? Muss nämlich gleich weg und hätte das Problem gerne schnell beseitigt. Vielen Dank schonmal im Voraus. LG Robert |
|
28.12.2012, 18:05
| #2 |
| /// Malware-holic   | GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs Hi,
__________________mit schnell wird das nichts. Wir haben hier viel zu tun, und du musst dich gedulden, wie alle anderen. Starte neu, drücke f8 wähle abgesicherter Modus mit Netzwerk, melde dich im betroffenen Konto an. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
28.12.2012, 18:13
| #3 |
| | GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs Hallo Marcus,
__________________vielen Dank für deine schnelle Antwort. Da hast du mich wohl missverstanden - ich wollte eigentlich nur wissen ob ich den Rechner ohne Bedenken anlassen kann oder ob die Sperrung nach einer bestimmten Zeit automatisch kommt. Würde dann den Säuberungsprozess später bzw. morgen durchführen. Ich werde die Logs schnellstmöglich posten. LG Robert |
|
28.12.2012, 18:23
| #4 |
| /// Malware-holic | GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs Kannst den Rechner schon ausschalten, da passiert nichts. Da wir nicht wisse, ob, und wenn ja, was noch zusätzlich an Malware drauf ist, währe das die bessere Idee.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
29.12.2012, 00:26
| #5 |
| | Logfile OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 29.12.2012 00:07:56 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Max Mustermann\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 75,97% Memory free 6,19 Gb Paging File | 5,75 Gb Available in Paging File | 92,76% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 576,17 Gb Total Space | 328,45 Gb Free Space | 57,01% Space Free | Partition Type: NTFS Drive D: | 19,99 Gb Total Space | 3,25 Gb Free Space | 16,25% Space Free | Partition Type: FAT32 Computer Name: KATHRINUNDRO-PC | User Name: Max Mustermann | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Max Mustermann\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Windows\explorer.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Program Files\FileZilla FTP Client\fzshellext.dll () ========== Services (SafeList) ========== SRV - (Akamai) -- c:\program files\common files\akamai/netsession_win_ce5ba24.dll () SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (DevoloNetworkService) -- C:\Program Files\devolo\dlan\devolonetsvc.exe (devolo AG) SRV - (nlsX86cc) -- C:\Windows\System32\nlssrv32.exe (Nalpeiron Ltd.) SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (OMSI download service) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe () SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.) SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (PSI_SVC_2) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Protexis Inc.) SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe () ========== Driver Services (SafeList) ========== DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (AnyDVD) -- C:\Windows\System32\drivers\AnyDVD.sys (SlySoft, Inc.) DRV - (NPF_devolo) -- C:\Windows\System32\drivers\npf_devolo.sys (CACE Technologies) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (ANDModem) -- C:\Windows\System32\drivers\lgandmodem.sys (LG Electronics Inc.) DRV - (AndDiag) -- C:\Windows\System32\drivers\lganddiag.sys (LG Electronics Inc.) DRV - (AndGps) -- C:\Windows\System32\drivers\lgandgps.sys (LG Electronics Inc.) DRV - (Andbus) -- C:\Windows\System32\drivers\lgandbus.sys (LG Electronics Inc.) DRV - (ivusb) -- C:\Windows\System32\drivers\ivusb.sys (Initio Corporation) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (LgBttPort) -- C:\Windows\System32\drivers\lgbtport.sys (LG Electronics Inc.) DRV - (LGVMODEM) -- C:\Windows\System32\drivers\lgvmodem.sys (LG Electronics Inc.) DRV - (LGBusEnum) -- C:\Windows\System32\drivers\lgbtbus.sys (LG Electronics Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation) DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys () DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation) DRV - (s1018unic) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation) DRV - (s1018mgmt) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation) DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation) DRV - (s1018bus) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation) DRV - (s1018nd5) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation) DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation) DRV - (ss_bmdm) -- C:\Windows\System32\drivers\ss_bmdm.sys (MCCI Corporation) DRV - (ss_bbus) -- C:\Windows\System32\drivers\ss_bbus.sys (MCCI) DRV - (ss_bmdfl) -- C:\Windows\System32\drivers\ss_bmdfl.sys (MCCI Corporation) DRV - (s0017mdm) -- C:\Windows\System32\drivers\s0017mdm.sys (MCCI Corporation) DRV - (s0017unic) -- C:\Windows\System32\drivers\s0017unic.sys (MCCI Corporation) DRV - (s0017mgmt) -- C:\Windows\System32\drivers\s0017mgmt.sys (MCCI Corporation) DRV - (s0017obex) -- C:\Windows\System32\drivers\s0017obex.sys (MCCI Corporation) DRV - (s0017bus) -- C:\Windows\System32\drivers\s0017bus.sys (MCCI Corporation) DRV - (s0017nd5) -- C:\Windows\System32\drivers\s0017nd5.sys (MCCI Corporation) DRV - (s0017mdfl) -- C:\Windows\System32\drivers\s0017mdfl.sys (MCCI Corporation) DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation) DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation) DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH) DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications) DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.) DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://medion.msn.com [binary data] IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://medion.msn.com [binary data] IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/ IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7AMSA_en IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\SearchScopes\{E2DF38D6-280E-4EBA-B431-E45EE9E77E3D}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=MEDTDF&pc=MAMD&src=IE-SearchBox IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-989385188-1076098978-986594699-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/" FF - prefs.js..extensions.enabledAddons: anttoolbar@ant.com:2.4.7.1 FF - prefs.js..extensions.enabledAddons: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.13 FF - prefs.js..extensions.enabledAddons: testpilot@labs.mozilla.com:1.2.1 FF - prefs.js..extensions.enabledAddons: {EEE6C361-6118-11DC-9C72-001320C79847}:1.4.0.0 FF - prefs.js..extensions.enabledAddons: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.4.8.1 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:2.0.2 FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.4.5 FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.8 FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.3.6 FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.2 FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.1.0 FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7280 FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\3.0.40723.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.4: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8051.1204: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Max Mustermann\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Max Mustermann\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.04 00:08:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.04 00:08:03 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Program Files\PriceGong\2.1.0\FF [2011.02.05 22:06:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.04 00:08:10 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.04 00:08:03 | 000,000,000 | ---D | M] [2009.09.29 17:32:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\Extensions [2012.08.28 21:32:07 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\Firefox\Profiles\rphztifu.default\extensions [2010.04.30 20:00:29 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\Firefox\Profiles\rphztifu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.07.25 21:50:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\Firefox\Profiles\rphztifu.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.07.19 21:05:00 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\Firefox\Profiles\rphztifu.default\extensions\anttoolbar@ant.com [2012.07.19 21:05:00 | 001,184,804 | ---- | M] () (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\extensions\testpilot@labs.mozilla.com.xpi [2012.08.10 22:01:48 | 000,340,132 | ---- | M] () (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2012.07.25 21:50:01 | 000,741,958 | ---- | M] () (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.07.19 21:05:03 | 000,709,293 | ---- | M] () (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2012.07.30 19:33:59 | 000,162,686 | ---- | M] () (No name found) -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2009.12.04 23:27:53 | 000,002,055 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\searchplugins\daemon-search.xml [2012.08.21 22:21:34 | 000,001,056 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\searchplugins\icqplugin.xml [2011.02.05 21:53:54 | 000,003,915 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\searchplugins\sweetim.xml [2010.01.28 16:38:21 | 000,001,774 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Roaming\mozilla\firefox\profiles\rphztifu.default\searchplugins\wowdbbuffedde.xml [2012.09.04 00:08:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012.09.04 00:08:01 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.09.04 00:08:02 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.09.04 00:08:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions [2012.09.04 00:08:10 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.17 22:52:25 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.07.17 22:52:25 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.17 22:52:25 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.17 22:52:26 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.17 22:52:25 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.17 22:52:25 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.google.com/ CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\Application\21.0.1180.60\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\Application\21.0.1180.60\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.160.1 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll CHR - plugin: Java(TM) Platform SE 6 U16 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.4 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Media Go Detector (Enabled) = C:\Program Files\Sony\Media Go\npmediago.dll CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Google Update (Enabled) = C:\Users\Max Mustermann\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\3.0.40723.0\npctrl.dll CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - Extension: YouTube = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: AdBlock = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.47_0\ CHR - Extension: Google Mail = C:\Users\Max Mustermann\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2012.07.28 16:58:46 | 000,002,738 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 192.150.18.108 O1 - Hosts: 41 more lines... O2 - BHO: (PriceGongBHO Class) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll (PriceGong) O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics) O3 - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-989385188-1076098978-986594699-1000\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\Run: [] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe (Samsung) O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\Run: [Akamai NetSession Interface] C:\Users\Max Mustermann\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\Run: [KiesAirMessage] C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup File not found O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\Run: [KiesPreload] C:\Program Files\Samsung\Kies\Kies.exe (Samsung) O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe () O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-21-989385188-1076098978-986594699-1000..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil32_11_4_402_287_Plugin.exe (Adobe Systems Incorporated) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0A5FA8B-7078-4342-9769-98D82699E0D9}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Max Mustermann\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Max Mustermann\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{70219a71-e124-11de-bdd3-4061860c9e53}\Shell - "" = AutoRun O33 - MountPoints2\{70219a71-e124-11de-bdd3-4061860c9e53}\Shell\AutoRun\command - "" = J:\setup.exe O33 - MountPoints2\{72b85e9e-dc13-11e1-afd6-4061860c9e53}\Shell - "" = AutoRun O33 - MountPoints2\{72b85e9e-dc13-11e1-afd6-4061860c9e53}\Shell\AutoRun\command - "" = I:\iStudio.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {A38B334A-A0A2-436D-BAA0-34FE5E517E44} - Microsoft .NET Framework 1.1 Security Update (KB2656370) ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) MsConfig - StartUpReg: FlashGet - hkey= - key= - File not found MsConfig - StartUpReg: Google Update - hkey= - key= - C:\Users\Max Mustermann\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) MsConfig - StartUpReg: ICQ - hkey= - key= - File not found MsConfig - StartUpReg: Windows Defender - hkey= - key= - File not found MsConfig - State: "startup" - 2 CREATERESTOREPOINT Unable to start System Restore Service. Error code 1084 ========== Files/Folders - Created Within 30 Days ========== [2012.12.28 18:26:56 | 000,000,000 | ---D | C] -- C:\Program Files\LSoft Technologies [2012.12.28 18:26:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Active@ ISO Burner [2012.12.28 18:10:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Max Mustermann\Desktop\OTL.exe [2012.12.28 17:41:15 | 000,000,000 | ---D | C] -- C:\Users\Max Mustermann\Desktop\Ordner [2012.12.28 17:15:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.12.28 17:15:37 | 000,021,104 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.12.28 17:14:23 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log [2012.12.28 17:14:23 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump [2012.12.28 17:14:17 | 000,000,000 | ---D | C] -- C:\Users\Max Mustermann\AppData\Local\Samsung [2012.12.28 17:13:55 | 000,000,000 | ---D | C] -- C:\Users\Max Mustermann\Documents\samsung [2012.12.28 17:12:28 | 000,000,000 | ---D | C] -- C:\Windows\LastGood [2012.12.28 17:09:54 | 000,204,712 | ---- | C] (Корпорация Майкрософт) -- C:\Users\Max Mustermann\wgsdgsdgdsgsd.exe [2012.12.28 17:07:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung [2012.12.28 17:07:11 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\System32\Redemption.dll [2012.12.28 17:07:02 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\System32\dgderapi.dll [2012.12.28 17:07:02 | 000,020,032 | ---- | C] (Devguru Co., Ltd) -- C:\Windows\System32\drivers\dgderdrv.sys [2012.12.28 17:06:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung [2012.12.28 17:02:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.12.18 10:06:10 | 000,330,240 | ---- | C] ((주)마크애니) -- C:\Windows\MASetupCaller.dll [2012.12.18 10:06:10 | 000,090,112 | ---- | C] ((주)마크애니) -- C:\Windows\MAMCityDownload.ocx [2012.12.18 10:06:06 | 000,569,344 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzdecode.ax [2012.12.18 10:06:06 | 000,491,520 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.dll [2012.12.18 10:06:06 | 000,352,256 | ---- | C] (Sample Corporation) -- C:\Windows\System32\MSLUR71.dll [2012.12.18 10:06:06 | 000,258,048 | ---- | C] ((c) PeeringPortal) -- C:\Windows\System32\muzoggsp.ax [2012.12.18 10:06:06 | 000,245,760 | ---- | C] (Teruten Inc.) -- C:\Windows\System32\MSCLib.dll [2012.12.18 10:06:06 | 000,200,704 | ---- | C] ( (c) MusicCity) -- C:\Windows\System32\muzwmts.dll [2012.12.18 10:06:06 | 000,172,032 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.exe [2012.12.18 10:06:06 | 000,155,648 | ---- | C] (Teruten Inc.) -- C:\Windows\System32\MSFLib.dll [2012.12.18 10:06:06 | 000,135,168 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzaf1.dll [2012.12.18 10:06:06 | 000,131,072 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzmpgsp.ax [2012.12.18 10:06:06 | 000,122,880 | ---- | C] ((c) MUSICCITY) -- C:\Windows\System32\muzeffect.ax [2012.12.18 10:06:06 | 000,118,784 | ---- | C] ((주)마크애니) -- C:\Windows\System32\MaDRM.dll [2012.12.18 10:06:06 | 000,110,592 | ---- | C] ((c) MusicCity) -- C:\Windows\System32\muzmp4sp.ax [2012.12.18 10:06:06 | 000,057,344 | ---- | C] (Marktek) -- C:\Windows\System32\MK_Lyric.dll [2012.12.18 10:06:06 | 000,057,344 | ---- | C] (Marktek Inc.) -- C:\Windows\System32\MTXSYNCICON.dll [2012.12.18 10:06:06 | 000,049,152 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MaJGUILib.dll [2012.12.18 10:06:06 | 000,045,320 | ---- | C] (MARKANY) -- C:\Windows\System32\MAMACExtract.dll [2012.12.18 10:06:06 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MaXMLProto.dll [2012.12.18 10:06:06 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\System32\MACXMLProto.dll [2012.12.18 10:06:06 | 000,040,960 | ---- | C] (Telechips Inc.,) -- C:\Windows\System32\MTTELECHIP.dll [2012.12.18 10:06:06 | 000,024,576 | ---- | C] ((주)마크애니) -- C:\Windows\System32\MASetupCleaner.exe [2009.12.25 17:15:25 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\ProgramData\hpeD271.dll ========== Files - Modified Within 30 Days ========== [2012.12.28 23:50:47 | 000,638,224 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.28 23:50:47 | 000,604,154 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.28 23:50:47 | 000,130,634 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.28 23:50:47 | 000,107,486 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.28 23:46:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.28 18:37:52 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.28 18:37:52 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.28 18:32:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.28 18:18:05 | 000,060,639 | ---- | M] () -- C:\Users\Max Mustermann\Desktop\OTL.png [2012.12.28 18:10:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Max Mustermann\Desktop\OTL.exe [2012.12.28 18:07:22 | 210,292,736 | ---- | M] () -- C:\Users\Max Mustermann\Desktop\KWU_1.0.3.upd.iso [2012.12.28 17:10:51 | 095,023,320 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.12.28 17:10:04 | 000,104,538 | ---- | M] () -- C:\ProgramData\nvModes.dat [2012.12.28 17:10:03 | 000,104,538 | ---- | M] () -- C:\ProgramData\nvModes.001 [2012.12.28 17:09:57 | 000,000,894 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.28 17:09:54 | 000,204,712 | ---- | M] (Корпорация Майкрософт) -- C:\Users\Max Mustermann\wgsdgsdgdsgsd.exe [2012.12.18 10:06:54 | 004,659,712 | ---- | M] (Dmitry Streblechenko) -- C:\Windows\System32\Redemption.dll [2012.12.18 10:06:10 | 000,330,240 | ---- | M] ((주)마크애니) -- C:\Windows\MASetupCaller.dll [2012.12.18 10:06:10 | 000,090,112 | ---- | M] ((주)마크애니) -- C:\Windows\MAMCityDownload.ocx [2012.12.18 10:06:10 | 000,030,568 | ---- | M] () -- C:\Windows\MusiccityDownload.exe [2012.12.18 10:06:06 | 000,974,848 | ---- | M] () -- C:\Windows\System32\cis-2.4.dll [2012.12.18 10:06:06 | 000,569,344 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzdecode.ax [2012.12.18 10:06:06 | 000,491,520 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.dll [2012.12.18 10:06:06 | 000,352,256 | ---- | M] (Sample Corporation) -- C:\Windows\System32\MSLUR71.dll [2012.12.18 10:06:06 | 000,258,048 | ---- | M] ((c) PeeringPortal) -- C:\Windows\System32\muzoggsp.ax [2012.12.18 10:06:06 | 000,245,760 | ---- | M] (Teruten Inc.) -- C:\Windows\System32\MSCLib.dll [2012.12.18 10:06:06 | 000,200,704 | ---- | M] ( (c) MusicCity) -- C:\Windows\System32\muzwmts.dll [2012.12.18 10:06:06 | 000,172,032 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzapp.exe [2012.12.18 10:06:06 | 000,155,648 | ---- | M] (Teruten Inc.) -- C:\Windows\System32\MSFLib.dll [2012.12.18 10:06:06 | 000,143,360 | ---- | M] () -- C:\Windows\System32\3DAudio.ax [2012.12.18 10:06:06 | 000,135,168 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\System32\muzaf1.dll [2012.12.18 10:06:06 | 000,131,072 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzmpgsp.ax [2012.12.18 10:06:06 | 000,122,880 | ---- | M] ((c) MUSICCITY) -- C:\Windows\System32\muzeffect.ax [2012.12.18 10:06:06 | 000,118,784 | ---- | M] ((주)마크애니) -- C:\Windows\System32\MaDRM.dll [2012.12.18 10:06:06 | 000,110,592 | ---- | M] ((c) MusicCity) -- C:\Windows\System32\muzmp4sp.ax [2012.12.18 10:06:06 | 000,081,920 | ---- | M] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2012.12.18 10:06:06 | 000,065,536 | ---- | M] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2012.12.18 10:06:06 | 000,057,344 | ---- | M] (Marktek) -- C:\Windows\System32\MK_Lyric.dll [2012.12.18 10:06:06 | 000,057,344 | ---- | M] (Marktek Inc.) -- C:\Windows\System32\MTXSYNCICON.dll [2012.12.18 10:06:06 | 000,057,344 | ---- | M] () -- C:\Windows\System32\issacapi_se-2.3.dll [2012.12.18 10:06:06 | 000,049,152 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MaJGUILib.dll [2012.12.18 10:06:06 | 000,045,320 | ---- | M] (MARKANY) -- C:\Windows\System32\MAMACExtract.dll [2012.12.18 10:06:06 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MaXMLProto.dll [2012.12.18 10:06:06 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\System32\MACXMLProto.dll [2012.12.18 10:06:06 | 000,040,960 | ---- | M] (Telechips Inc.,) -- C:\Windows\System32\MTTELECHIP.dll [2012.12.18 10:06:06 | 000,024,576 | ---- | M] ((주)마크애니) -- C:\Windows\System32\MASetupCleaner.exe [2012.12.18 10:06:00 | 000,821,824 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\System32\dgderapi.dll [2012.12.18 10:06:00 | 000,020,032 | ---- | M] (Devguru Co., Ltd) -- C:\Windows\System32\drivers\dgderdrv.sys [2012.12.14 16:49:28 | 000,021,104 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.11.29 21:09:32 | 000,013,312 | ---- | M] () -- C:\Users\Max Mustermann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.11.29 21:03:31 | 003,986,440 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2012.12.28 18:18:05 | 000,060,639 | ---- | C] () -- C:\Users\Max Mustermann\Desktop\OTL.png [2012.12.28 18:06:04 | 210,292,736 | ---- | C] () -- C:\Users\Max Mustermann\Desktop\KWU_1.0.3.upd.iso [2012.12.28 17:09:57 | 000,000,894 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk [2012.12.28 17:09:55 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.12.18 10:06:10 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012.12.18 10:06:06 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2012.12.18 10:06:06 | 000,143,360 | ---- | C] () -- C:\Windows\System32\3DAudio.ax [2012.12.18 10:06:06 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2012.12.18 10:06:06 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2012.12.18 10:06:06 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2012.11.22 12:27:13 | 000,000,106 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Local\fusioncache.dat [2012.08.25 19:38:43 | 000,000,132 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\Adobe CS6-GIF-Format - Voreinstellungen [2012.08.24 15:21:06 | 1799,350,784 | ---- | C] () -- C:\Windows\System32\MAESTIA_SETUP-1.bin [2012.08.24 15:19:19 | 1257,667,440 | ---- | C] () -- C:\Windows\System32\MAESTIA_SETUP-2.bin [2012.07.26 22:45:25 | 000,001,782 | ---- | C] () -- C:\Users\Max Mustermann\.recently-used.xbel [2012.07.26 20:45:51 | 000,001,456 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Local\Adobe Für Web speichern 13.0 Prefs [2012.07.26 19:58:28 | 000,023,894 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\Microsoft Excel 97-2003.ADR [2012.07.22 19:17:56 | 000,000,132 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen [2012.07.19 16:42:11 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2012.05.28 16:46:10 | 068,558,962 | ---- | C] () -- C:\Users\Max Mustermann\AIDa.cpr [2011.06.05 12:03:51 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll [2011.06.05 12:03:51 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini [2011.02.05 20:02:12 | 000,000,680 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Local\d3d9caps.dat [2011.01.08 00:21:12 | 041,885,824 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 007 - Der unheimliche Drache.mp3 [2011.01.08 00:21:05 | 041,828,937 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 006 - Der sprechende Totenkopf.mp3 [2011.01.07 23:46:27 | 045,023,232 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 005 - Der Fluch des Rubins.mp3 [2011.01.07 23:23:25 | 041,264,274 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 004 - Die schwarze Katze.mp3 [2010.12.19 23:37:47 | 044,101,927 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 002 - Der Phantomsee.mp3 [2010.12.19 23:24:02 | 048,466,257 | ---- | C] () -- C:\Users\Max Mustermann\DDF - 001 - Der Superpapagei.mp3 [2010.01.07 13:19:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.12.06 22:49:55 | 000,000,139 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\default.rss [2009.12.06 22:49:55 | 000,000,000 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Roaming\downloads.m3u [2009.09.29 19:48:36 | 000,013,312 | ---- | C] () -- C:\Users\Max Mustermann\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.08.11 10:47:54 | 000,104,538 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.08.11 10:47:53 | 000,104,538 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.07.30 07:19:35 | 000,000,952 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys ========== ZeroAccess Check ========== [2006.11.02 13:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 18:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.10 22:28:20 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.10 22:28:26 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.08.10 20:17:31 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Alien Skin [2010.01.28 16:33:30 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Amazon [2012.08.09 22:56:30 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Athentech [2012.08.02 21:30:55 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\BITS [2012.10.14 13:15:10 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Buhl Data Service [2012.10.14 13:14:57 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Buhl Data Service GmbH [2012.07.19 16:35:26 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Canneverbe Limited [2009.11.07 19:32:37 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Capcom [2012.07.26 21:53:46 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2012.07.20 18:58:28 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\DAEMON Tools Lite [2009.12.04 23:15:47 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\DAEMON Tools Pro [2010.12.27 23:47:07 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\DeepBurner [2012.11.08 19:04:14 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\FileZilla [2010.01.14 18:53:05 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\FreeFLVConverter [2011.06.03 20:03:18 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\go [2009.10.11 17:22:34 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\gtk-2.0 [2012.07.19 17:13:10 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\ICQ [2012.08.02 21:35:23 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\inkscape [2012.08.19 10:32:50 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\IrfanView [2009.10.02 22:39:04 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\OpenOffice.org [2012.08.22 21:00:56 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Opera [2010.10.02 16:32:56 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\PC Suite [2012.07.26 23:06:05 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\PDAppFlex [2009.10.03 08:03:26 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\ProtectDisc [2012.12.28 17:14:13 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Samsung [2011.06.05 14:55:00 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Sony [2010.01.02 18:14:28 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Sony Setup [2012.07.26 23:06:39 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2009.12.29 10:33:06 | 000,000,000 | -HSD | M] -- C:\Users\Max Mustermann\AppData\Roaming\SystemProc [2011.02.05 19:57:32 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\TS3Client [2012.08.03 22:17:56 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\TuneUp Software [2012.08.04 23:01:49 | 000,000,000 | ---D | M] -- C:\Users\Max Mustermann\AppData\Roaming\Weaverslave ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.09.29 17:11:15 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2010.09.16 19:03:01 | 000,000,000 | ---D | M] -- C:\07571f56d4f7ff127e69cdc3b0414b29 [2011.12.12 18:28:08 | 000,000,000 | ---D | M] -- C:\226b0042c24e366175993c [2012.07.21 10:09:39 | 000,000,000 | ---D | M] -- C:\andreas07 [2012.07.31 22:18:54 | 000,000,000 | ---D | M] -- C:\Appz [2012.08.05 07:37:21 | 000,000,000 | -HSD | M] -- C:\Boot [2012.11.04 19:37:05 | 000,000,000 | ---D | M] -- C:\BVB-Fanclub [2012.12.28 17:07:00 | 000,000,000 | -HSD | M] -- C:\Config.Msi [2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2009.09.29 17:07:50 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2012.08.12 20:59:38 | 000,000,000 | ---D | M] -- C:\Downloads [2011.06.05 12:50:50 | 000,000,000 | ---D | M] -- C:\LGP990 [2010.01.03 02:03:15 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.10.03 12:08:27 | 000,000,000 | ---D | M] -- C:\profiles [2012.12.28 18:26:56 | 000,000,000 | ---D | M] -- C:\Program Files [2012.12.28 17:11:54 | 000,000,000 | ---D | M] -- C:\ProgramData [2009.09.29 17:07:50 | 000,000,000 | -HSD | M] -- C:\Programme [2012.12.28 18:26:40 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.08.21 22:08:53 | 000,000,000 | ---D | M] -- C:\TEMP [2009.09.29 17:10:53 | 000,000,000 | R--D | M] -- C:\Users [2012.12.28 18:38:58 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < C:\Windows\system32\*.tsp > [2006.11.02 10:44:49 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp [2006.11.02 10:44:49 | 000,038,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp [2006.11.02 10:44:49 | 000,049,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp [2006.11.02 10:44:49 | 000,081,408 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp [2009.04.10 22:27:18 | 000,280,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp [2006.11.02 14:01:49 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2006.11.02 14:01:49 | 000,032,514 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.05.28 16:03:28 | 000,001,120 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-989385188-1076098978-986594699-1000Core.job [2012.05.28 16:03:28 | 000,001,172 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-989385188-1076098978-986594699-1000UA.job [2012.11.01 15:02:32 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job < MD5 for: AGP440.SYS > [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.03.11 15:14:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys [2009.03.11 15:14:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys [2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.10 22:32:28 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2009.03.11 15:14:24 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.03.11 15:41:13 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2009.03.11 15:41:13 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2009.03.11 15:41:12 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2009.03.11 15:41:13 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe < MD5 for: IASTORV.SYS > [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: NVSTOR32.SYS > [2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\Windows\System32\drivers\nvstor32.sys [2008.08.18 18:58:16 | 000,145,952 | ---- | M] (NVIDIA Corporation) MD5=8EE374B6FB3CB2BB8D70395218B464A5 -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_d87a3a1f\nvstor32.sys < MD5 for: SCECLI.DLL > [2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll [2009.04.10 22:28:26 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2012.12.14 16:49:28 | 000,216,424 | ---- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.07.26 22:45:25 | 000,001,782 | ---- | M] () -- C:\Users\Max Mustermann\.recently-used.xbel [2012.05.29 19:51:47 | 068,558,962 | ---- | M] () -- C:\Users\Max Mustermann\AIDa.cpr [2004.10.07 03:00:42 | 048,466,257 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 001 - Der Superpapagei.mp3 [2004.10.08 04:36:07 | 044,101,927 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 002 - Der Phantomsee.mp3 [2004.10.10 10:21:31 | 041,264,274 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 004 - Die schwarze Katze.mp3 [2004.10.10 10:35:41 | 045,023,232 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 005 - Der Fluch des Rubins.mp3 [2004.10.10 15:23:03 | 041,828,937 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 006 - Der sprechende Totenkopf.mp3 [2004.10.10 20:18:40 | 041,885,824 | ---- | M] () -- C:\Users\Max Mustermann\DDF - 007 - Der unheimliche Drache.mp3 [2012.12.29 00:07:55 | 002,883,584 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT [2012.12.29 00:07:55 | 000,262,144 | -H-- | M] () -- C:\Users\Max Mustermann\ntuser.dat.LOG1 [2009.09.29 17:10:55 | 000,000,000 | -H-- | M] () -- C:\Users\Max Mustermann\ntuser.dat.LOG2 [2012.08.05 07:39:43 | 000,000,000 | -H-- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT_tureg_new.LOG1 [2012.08.05 07:39:43 | 000,000,000 | -H-- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT_tureg_new.LOG2 [2012.08.05 07:39:45 | 002,621,440 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT_tureg_old [2012.08.05 07:39:45 | 000,065,536 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2012.08.05 07:39:45 | 000,524,288 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2009.09.29 17:27:06 | 000,524,288 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2012.12.28 18:45:07 | 000,065,536 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{f56943f3-dec7-11e1-a199-806e6f6e6963}.TM.blf [2012.12.28 18:45:07 | 000,524,288 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{f56943f3-dec7-11e1-a199-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2012.08.05 08:02:57 | 000,524,288 | -HS- | M] () -- C:\Users\Max Mustermann\NTUSER.DAT{f56943f3-dec7-11e1-a199-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2009.09.29 17:10:56 | 000,000,020 | -HS- | M] () -- C:\Users\Max Mustermann\ntuser.ini [2012.12.28 17:09:54 | 000,204,712 | ---- | M] (Корпорация Майкрософт) -- C:\Users\Max Mustermann\wgsdgsdgdsgsd.exe < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ========== Alternate Data Streams ========== @Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences < End of report > OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 29.12.2012 00:07:56 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Max Mustermann\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,28 Gb Available Physical Memory | 75,97% Memory free
6,19 Gb Paging File | 5,75 Gb Available in Paging File | 92,76% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 576,17 Gb Total Space | 328,45 Gb Free Space | 57,01% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 3,25 Gb Free Space | 16,25% Space Free | Partition Type: FAT32
Computer Name: KATHRINUNDRO-PC | User Name: Max Mustermann | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS6\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" = C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe" = C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe" = C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D4D7496-0172-4EE6-B2B2-443B14898FF9}" = lport=3702 | protocol=17 | dir=in | app=c:\windows\system32\p2phost.exe |
"{310D6329-27A8-484D-A52B-2916CFB64426}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{3CB4BF4D-40C6-4626-B09C-4916AC6243C2}" = lport=137 | protocol=17 | dir=in | app=system |
"{41D26764-0730-4073-A8F6-86935DE54FA2}" = lport=138 | protocol=17 | dir=in | app=system |
"{4A1EFCD7-7A9C-49CC-AECA-30D1CA12B03E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{665073B9-6DD1-4D84-892E-4B8BC38474BE}" = lport=19375 | protocol=17 | dir=in | app=c:\program files\devolo\dlan\devolonetsvc.exe |
"{68D62165-5B0E-4D7D-8569-4E745CA8F05F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{72FD6013-56AB-4BCA-83E9-274602C2E66B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{735D0F5B-36E8-4F52-9B26-CBB3C35D3AEB}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{74F83773-1317-4B45-8935-FD69664338DA}" = rport=139 | protocol=6 | dir=out | app=system |
"{7A241BA7-C333-4BD2-8D7D-C9CD6EDBCDFB}" = lport=445 | protocol=6 | dir=in | app=system |
"{850C1D0F-AFC2-4D96-824E-C1DAD2C343BD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{A2E0F47C-3AF3-489F-8321-B359DA3D306A}" = rport=3702 | protocol=17 | dir=out | app=c:\windows\system32\p2phost.exe |
"{A33751B2-AD76-4C31-87B1-90E1514C9B42}" = rport=137 | protocol=17 | dir=out | app=system |
"{C06CDF0B-098A-4373-B329-D56976E61F66}" = lport=19376 | protocol=6 | dir=in | app=c:\program files\devolo\dlan\devolonetsvc.exe |
"{C565F9BC-F3E7-4A9F-9A0A-6285D188FCDB}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=c:\windows\system32\svchost.exe |
"{C9BA43D3-B1A6-4E1F-A3C1-C1C735C2F363}" = lport=139 | protocol=6 | dir=in | app=system |
"{F1DDEFB7-5FA4-48E5-B888-8660E9CC9129}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F7C08DD4-D7F8-48B9-9176-BA5018098067}" = rport=138 | protocol=17 | dir=out | app=system |
"{FE59E319-8FF9-46CA-BE34-DE1839359D77}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0232B0C1-D5E6-493E-9020-F103D19E0497}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{0627351C-61EC-4615-9A50-420BE8475E59}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{06AA08E6-F585-43D3-B011-62CC1024E945}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{157CCF88-B570-460E-B707-206889C0086B}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{16D6FE40-2F99-4DC1-87C1-1EE36E5FEF63}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{18CF2325-645B-4EC2-9770-910F6FC74A12}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{1B4A75B6-CE5F-4A3B-8483-CBF4079DF3A8}" = protocol=6 | dir=in | app=c:\windows\system32\p2phost.exe |
"{1CD154D4-D3E9-4D61-A642-2F1895EADC7D}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1EF1CF0A-A07B-404F-A497-B450F9F43604}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{2DB70CE0-9D36-44EE-8AC8-AA6EF15CD872}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe |
"{352E8414-1B68-4C09-93C9-8764A32AFCD8}" = protocol=17 | dir=in | app=c:\users\Max Mustermann\appdata\local\google\chrome\application\chrome.exe |
"{3AC35961-2704-47B9-9B6A-75C875416CA1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{3BA51A41-9C3C-4D18-9DAF-FF94C6C7B57B}" = protocol=6 | dir=out | app=c:\windows\system32\p2phost.exe |
"{3C3ACDD9-D417-4064-9CAB-7A6C4D8AA4F5}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{45AFBBC2-ABB2-488F-94CB-4C2A036E1475}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{4B8B178E-24EF-4A1E-AB9C-914683136DC8}" = protocol=6 | dir=in | app=c:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe |
"{51460DC9-AA4D-47C0-A8C9-636837E8063E}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{54A6C790-9175-4701-9009-269DD5038C72}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{77010D8F-2E86-41F3-9616-048475CD5F5D}" = dir=in | app=c:\program files\java\jre6\launch4j-tmp\duden rechtschreibtrainer.exe |
"{7F453A93-75E9-4129-AC5D-E2EC17B793FA}" = protocol=17 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{821E623E-BB46-4736-903F-DFB640F4F9B5}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe |
"{8A5122B1-41BF-4635-AEBF-B189B24B93E8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{90B60075-CB85-4FB4-8A03-A65E832C8A16}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0.10192-to-3.2.0.10314-dede-downloader.exe |
"{95153773-C67C-4B2F-A735-E0BE612DB9EE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{98738352-227F-4B17-B146-C67FF27B9413}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{A6AB0FB8-A1DA-4235-A390-B4781CFEEB38}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{B19DD376-1AEF-489D-8626-FDEC93EAD3D7}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{C506B5F6-7F08-4573-812F-AB043A04E704}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow-3.2.0-dede-downloader.exe |
"{CCA17280-645F-4B04-A7F6-4796BF11D976}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"{D0FA8AD6-01F7-4BE7-A7B5-AB85922E32B9}" = protocol=6 | dir=in | app=c:\users\Max Mustermann\appdata\local\google\chrome\application\chrome.exe |
"{DAE3BEA1-8EB6-491D-B47D-16ADA4A4F453}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DAE4BE8C-BE6D-486D-8414-6BFCA0FAD4AE}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E41A1C95-628D-44F2-95B0-FCB009425C23}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{EC6DBE10-EF75-4573-AF39-47267CB0BDAB}" = protocol=17 | dir=in | app=c:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe |
"{F4E9C035-A98F-4BFA-9AD0-3A48238629EC}" = protocol=6 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{F78C4592-C389-4735-9D03-073C0B0400D5}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{F8B4F2A0-9583-460D-ABFE-0F98DAD04740}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow-3.2.0-dede-downloader.exe |
"{FA81928B-DAC0-44D7-8ABA-984ED2C29FB3}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{FCD4366C-794A-4714-AB19-21171F779E4F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{FDB9DD9B-E0BE-46CA-92EC-628E7A7BFAA2}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{FE202521-AA28-4102-B182-2D42CCF94F48}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.2.0-dede-downloader.exe |
"TCP Query User{18A8D083-9EFF-4410-9669-96DDCEE8A103}C:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe |
"TCP Query User{220790E9-23E7-40F4-8490-A07CB8CB736A}C:\users\public\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
"TCP Query User{28F977B2-1732-46A1-A9E9-AF8ADE366870}C:\program files\turbine\the lord of the rings online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files\turbine\the lord of the rings online\lotroclient.exe |
"TCP Query User{38BA70B7-E478-47D2-9944-09905620E41D}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{3DFE763B-F1B9-4E29-967F-CF2D8667A2C0}C:\users\public\games\world of warcraft\temp\wow-4.2.1.2756-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.2.1.2756-enus-tools-downloader.exe |
"TCP Query User{40D404FB-302F-4821-809C-413BE1A4B133}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{6100C2BB-0CBA-4F95-8CA0-23FE86B56E78}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{6FB6EC09-0D38-4BDA-AA3F-29049C649FAD}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{7FB122D3-02CD-445F-A25C-3369A183B4DE}C:\users\public\games\world of warcraft\launcher.patch.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe |
"TCP Query User{BD21264F-D727-45B2-9412-F8612FE43B2F}C:\program files\videolan\vlc\vlc.exe" = protocol=6 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"TCP Query User{DA16DD87-4552-42CA-B145-8266A984E9B3}C:\users\public\games\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"TCP Query User{E1920361-AA57-484E-9933-613C478C91CD}C:\program files\java\jre6\launch4j-tmp\duden rechtschreibtrainer.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\duden rechtschreibtrainer.exe |
"TCP Query User{F1044410-964A-409C-828B-DF9009DE0957}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"UDP Query User{0BB8B13D-3807-4C91-9709-106B12630003}C:\program files\java\jre6\launch4j-tmp\duden rechtschreibtrainer.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\launch4j-tmp\duden rechtschreibtrainer.exe |
"UDP Query User{0CCEB8BF-2959-4159-8F01-44905B562F82}C:\program files\videolan\vlc\vlc.exe" = protocol=17 | dir=in | app=c:\program files\videolan\vlc\vlc.exe |
"UDP Query User{114E15EA-E26D-413A-B17F-0C033980158C}C:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\Max Mustermann\appdata\local\akamai\netsession_win.exe |
"UDP Query User{2DB50450-C1E2-410A-BA29-CB5780DCB15E}C:\users\public\games\world of warcraft\launcher.patch.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe |
"UDP Query User{3BBA4BF2-02A6-4EBB-8563-64819B610362}C:\users\public\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
"UDP Query User{6ABC9EC3-4C3C-42DC-9643-BD6A078110CE}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{83B51D22-9294-40C3-A775-D613013AFC99}C:\users\public\games\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"UDP Query User{9D921F99-FE27-4B6B-ABA9-5CF95B10E8EB}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{9FDFC5B7-45FE-4244-823A-CB052FD485B8}C:\users\public\games\world of warcraft\temp\wow-4.2.1.2756-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\temp\wow-4.2.1.2756-enus-tools-downloader.exe |
"UDP Query User{B6890A0F-C9ED-4FAB-8EFE-409E8E5CA49F}C:\program files\turbine\the lord of the rings online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files\turbine\the lord of the rings online\lotroclient.exe |
"UDP Query User{BD53A4C4-561F-4C92-8375-2BB9B6C306BB}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"UDP Query User{C3134C9A-AE38-494B-800B-CA517F7EC326}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{D5965569-1AA4-4955-9749-C20999BA0578}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0215A652-E081-4B09-9333-DC85AAB67FFA}" = Adobe Dreamweaver CS5.5
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{051F9CB0-1499-4A0E-A861-CB19A5AAA906}" = NetObjects Fusion 12.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0F895695-33CC-4203-9C47-25EF2AC9441C}" = Media Go
"{13D793E6-928B-4984-A0AB-5B6C08759096}" = WISO Mein Geld 2013 Standard
"{17A8BA41-59C0-48A1-BE2A-E1BFFEF71D1D}" = NetObjects Fusion 12.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 16
"{2ADE2157-7A5E-122C-B51D-EB8A01B15943}" = DeepBurner v1.9.0.228
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{450CFD4D-7E60-3839-D0FA-56DB08675447}" = dLAN Cockpit
"{4869414E-7AEA-4C8E-BE1C-8D40977FD517}" = Adobe Illustrator CS6
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{4b4ecc53-fb68-4d5d-864c-ede2c7fe1978}" = DTS Plug-in
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4E8C27C2-D727-4C00-A90E-C3F6376EEE70}" = Nero ControlCenter
"{4FFB0B3B-BF82-4248-A275-630AC5F7EFC5}" = Adobe Photoshop Lightroom 2.4
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{566BAEC0-74CB-4ACC-9E18-8779AC974FB0}" = Windows Live Toolbar
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{56dc6900-9056-431c-b2df-51291415ac3d}" = Nero Move it
"{5A166C0B-9557-4364-A057-F946D674E6AC}" = Windows Live Mail
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65CB4C08-C47B-4A7E-A6A4-50C06ADA5FC6}" = Adobe AIR
"{67fda232-4e4d-467a-a9d1-b589695fce45}" = Nero BackItUp 4
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}" = Windows Live Fotogalerie
"{6CC95B76-D380-46B2-9022-9353938E48BA}" = Logitech GamePanel Software 3.03.133
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7694E0B1-2332-448B-9235-929F84B41E3F}" = Active@ ISO Burner
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7D62ABA3-35EC-623E-2C5F-1B3332CB705B}" = Media Go Video Playback Engine 1.64.104.02270
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{81821BF8-DA20-4F8C-AA87-F70A274828D4}" = Windows Live Writer
"{835686C5-8650-49EB-8CA0-4528B4035495}" = Windows Live Call
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8C1E2925-14F8-45AA-B999-1E2A74BF5607}" = Windows Live Sync
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{961D53EA-40DC-4156-AD74-25684CE05F81}" = Nero Installer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9866E5F0-121F-E018-E2D1-2E1770847ABF}" = Adobe Download Assistant
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{9F3523F8-DAD7-AE52-6DA7-45CDDDF33726}" = Advertising Center
"{9F78DB3D-4F90-4A10-AD0A-85C271C88106}" = Gothic 3
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AC7EE5F1-0DE4-4256-8E43-92B73C8E6019}" = LG Bluetooth Drivers
"{AE3CF174-872C-46C6-B9F6-C0593F3BC7B8}" = Microsoft Office Live Add-in 1.4
"{AF37176A-78CA-545B-34EF-8B6A21514DD1}" = Adobe Help Manager
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B69F28DF-CBB1-41B7-008A-210E4D0518FC}" = Harry Potter und der Orden des Phönix™
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B962E962-6369-4F66-AF35-79CB39270D12}" = NetObjects Fusion 12.0
"{BAC80EF3-E106-4AEA-8C57-F217F9BC7358}" = Microsoft SQL Server 2005 Compact Edition [DEU]
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}" = Adobe Widget Browser
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C1575982-F1CA-46DC-A77D-43FF12F2EFC7}" = Adobe Photoshop Lightroom 4.1
"{c1c68ee7-3172-4eb2-8942-15249c8d5b50}" = Gracenote Plug-in
"{C2944BE7-9BFF-4EF0-A362-CB3281B7C50D}" = LG United Mobile Drivers
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC57ADF6-875C-4407-91F4-92AAB1EB681A}" = SmartFTP Client
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}" = iTunes
"{d43a568e-9a88-42bc-8be0-657d6f016e72}" = Nero MediaHome 4
"{D79649E7-85DD-440E-8482-3131C4183C81}" = SmartFTP Client German (Germany) MUI
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DF5F687F-8018-4542-9F98-7084E9022917}" = Windows Live Essentials
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = The Lord of the Rings Online™ v03.08.00.8025
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Akamai" = Akamai NetSession Interface Service
"Alien Skin Bokeh 2" = Alien Skin Bokeh 2
"Alien Skin Exposure 4" = Alien Skin Exposure 4
"Alien Skin Image Doctor 2" = Alien Skin Image Doctor 2
"Alien Skin Snap Art 3" = Alien Skin Snap Art 3
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"AnyDVD" = AnyDVD
"Autopano Giga" = Autopano Giga
"Avira AntiVir Desktop" = Avira Free Antivirus
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Help Manager
"CloneDVD2" = CloneDVD2
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Widget Browser
"DAEMON Tools Lite" = DAEMON Tools Lite
"dlancockpit" = devolo dLAN Cockpit
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileZilla Client" = FileZilla Client 3.2.7.1
"HijackThis" = HijackThis 2.0.2
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"LG On-Screen Phone" = LG On-Screen Phone
"LG PC Suite IV" = LG PC Suite IV
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 12.02.1578" = Opera 12.02
"Perfectly Clear Plugin" = Perfectly Clear Plugin 1.6.0
"PixelNet Software" = PixelNet Software 4.12.1
"PriceGong" = PriceGong 2.1.0
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"ReDynaMix HDR (Adobe Photoshop Plug-in)_is1" = DCETools - ReDynaMix HDR
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SmartFTP Client 4.0 Setup Files" = SmartFTP Client 4.0 Setup Files (remove only)
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VLC media player" = VLC media player 1.0.3
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WISO Mein Geld 2013 Standard" = WISO Mein Geld 2013 Standard
"WYSIWYG_Web_Builder_8" = WYSIWYG Web Builder 8
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-989385188-1076098978-986594699-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"090215de958f1060" = Curse Client
"Akamai" = Akamai NetSession Interface
"Game Organizer" = EasyBits GO
"Google Chrome" = Google Chrome
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.11.2012 07:29:28 | Computer Name = KathrinundRo-PC | Source = Perflib | ID = 1008
Description =
Error - 22.11.2012 07:29:40 | Computer Name = KathrinundRo-PC | Source = System Restore | ID = 8193
Description =
Error - 29.11.2012 16:03:39 | Computer Name = KathrinundRo-PC | Source = WinMgmt | ID = 10
Description =
Error - 06.12.2012 15:06:46 | Computer Name = KathrinundRo-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.12.2012 11:53:56 | Computer Name = KathrinundRo-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.12.2012 13:26:06 | Computer Name = KathrinundRo-PC | Source = VSS | ID = 8194
Description =
Error - 28.12.2012 13:40:22 | Computer Name = KathrinundRo-PC | Source = EventSystem | ID = 4609
Description =
Error - 28.12.2012 13:40:31 | Computer Name = KathrinundRo-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.12.2012 18:47:49 | Computer Name = KathrinundRo-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.12.2012 18:49:19 | Computer Name = KathrinundRo-PC | Source = EventSystem | ID = 4609
Description =
[ System Events ]
Error - 28.12.2012 13:40:22 | Computer Name = KathrinundRo-PC | Source = DCOM | ID = 10005
Description =
Error - 28.12.2012 13:40:23 | Computer Name = KathrinundRo-PC | Source = DCOM | ID = 10005
Description =
Error - 28.12.2012 13:40:32 | Computer Name = KathrinundRo-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 28.12.2012 13:40:32 | Computer Name = KathrinundRo-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 28.12.2012 18:45:52 | Computer Name = KathrinundRo-PC | Source = sptd | ID = 262148
Description = Der Treiber hat einen internen Fehler in seinen Datenstrukturen für
festgestellt.
Error - 28.12.2012 18:47:49 | Computer Name = KathrinundRo-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 28.12.2012 18:47:49 | Computer Name = KathrinundRo-PC | Source = Service Control Manager | ID = 7026
Description =
Error - 28.12.2012 18:49:11 | Computer Name = KathrinundRo-PC | Source = DCOM | ID = 10005
Description =
Error - 28.12.2012 18:49:19 | Computer Name = KathrinundRo-PC | Source = DCOM | ID = 10005
Description =
Error - 28.12.2012 18:49:19 | Computer Name = KathrinundRo-PC | Source = DCOM | ID = 10005
Description =
< End of report >
|
|
02.01.2013, 21:28
| #6 |
| /// Malware-holic | GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs Öffne bitte Malwarebytes, logdateien, poste logs mit funden. download tdss killer: http://www.trojaner-board.de/82358-t...entfernen.html Klicke auf Change parameters • Setze die Haken bei Verify driver digital signatures und Detect TDLFS file system • Klick auf OK und anschließend auf Start scan - bei funden erst mal immer skip wählen, log posten
__________________ --> GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs |
|
| Themen zu GVU Trojaner, Computer wurde gesperrt, Ausschalten des PCs |
| andere, ausschalten, besser, bestimmte, bestimmten, compu, computer, computer wurde gesperrt, forum, gemeinde, gesperrt, gvu trojaner, gvu-trojaner, liebe, pcs, problem, schei, schnell, schonmal, schritte, thread, troja, trojaner |
