Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 07.04.2010, 20:34   #1
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Ausrufezeichen

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Hallo, ich habe seid längerer Zeit ein Problem mit meinem PC.
Ich habe Google Chrome Installiert und kann es nicht öffnen, also immer wenn ich Chrome öffnen will öffnet sich der IE und in der Suchleiste steht:
hxxp://%22c/Users/******/AppData/Local/Google/Chrome/Application/chrome.exe%22

Hier Hijack File:

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32\rthdvcpl.exe
C:\Program Files\Synaptics\SynTP\syntpenh.exe
C:\Windows\WindowsMobile\wmdcbase.exe
C:\Program Files\Unlocker\unlockerassistant.exe
C:\Program Files\Microsoft Office\Office12\groovemonitor.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\program files\ati technologies\ati.ace\core-static\clistart.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Users\Sandra\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sandra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [userinit] C:\Users\Sandra\AppData\Roaming\sdra64.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMP\imqo.tmp\svchost.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [cbssreg] C:\Windows\TEMP\imqo.tmp\svchost.exe (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: View EXIF - C:\ViewEXIF\EXIF.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9412 bytes

UNd Malwarebytes:

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3913
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904

07.04.2010 20:32:01
mbam-log-2010-04-07 (20-32-01).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 114694
Laufzeit: 5 minute(s), 58 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 5
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navigator.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Userinit.exe (Security.Hijack) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Danke

Alt 08.04.2010, 10:43   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Hallo,

Zitat:
Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3913
MBAM war nicht aktuell. Bitte auf Version 1.45 updaten und anschließend auch die Datenbanken (Signaturen) aktualisieren. Danach noch nen Vollscan starten und wieder das Log posten.

Erstell auch RSIT Logfiles und poste sie.
__________________

__________________

Alt 08.04.2010, 10:43   #3
Sion
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



ups, überschnitten
__________________

Alt 08.04.2010, 21:27   #4
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



So hier nochmal Vollständiger durchlauf mit Malware:


Datenbank Version: 3930

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904

08.04.2010 21:20:29
mbam-log-2010-04-08 (21-20-29).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 292884
Laufzeit: 1 Stunde(n), 47 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Und mit Rsit:

Logfile of random's system information tool 1.06 (written by random/random)
Run by Sandra at 2010-04-08 21:24:35
Microsoft® Windows Vista™ Home Premium Service Pack 1
System drive C: has 52 GB (35%) free of 148 GB
Total RAM: 3069 MB (62% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:24:44, on 08.04.2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe
C:\Users\Sandra\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Sandra.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
R3 - URLSearchHook: (no name) - - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdcBase.exe
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Google Quick Search Box] "C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe" /autorun
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMP\imqo.tmp\svchost.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [cbssreg] C:\Windows\TEMP\imqo.tmp\svchost.exe (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O8 - Extra context menu item: View EXIF - C:\ViewEXIF\EXIF.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Program Files\ICQ7.1\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - hxxp://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} (System Requirements Lab Class) - hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 9810 bytes

======Scheduled tasks folder======

C:\Windows\tasks\At1.job
C:\Windows\tasks\At10.job
C:\Windows\tasks\At11.job
C:\Windows\tasks\At12.job
C:\Windows\tasks\At13.job
C:\Windows\tasks\At14.job
C:\Windows\tasks\At15.job
C:\Windows\tasks\At16.job
C:\Windows\tasks\At17.job
C:\Windows\tasks\At18.job
C:\Windows\tasks\At19.job
C:\Windows\tasks\At2.job
C:\Windows\tasks\At20.job
C:\Windows\tasks\At21.job
C:\Windows\tasks\At22.job
C:\Windows\tasks\At23.job
C:\Windows\tasks\At24.job
C:\Windows\tasks\At3.job
C:\Windows\tasks\At4.job
C:\Windows\tasks\At5.job
C:\Windows\tasks\At6.job
C:\Windows\tasks\At7.job
C:\Windows\tasks\At8.job
C:\Windows\tasks\At9.job
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\tasks\SupBackGroundTask.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-28 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-03-28 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2010-02-19 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2010-03-28 279664]
{855F3B16-6D32-4FE6-8A56-BBB695989046} - ICQToolBar - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll [2010-01-03 1019128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe []
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-07-08 6273568]
"SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe []
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe []
"Windows Mobile-based device management"=C:\Windows\WindowsMobile\wmdcBase.exe []
"UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe []
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe []
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\ipoint.exe []
"SunJavaUpdateSched"=C:\Program Files\Common Files\Java\Java Update\jusched.exe []
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"NPSStartup"= []
"WinampAgent"=C:\Program Files\Winamp\winampa.exe []
"Google Quick Search Box"=C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe /autorun []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2010-03-30 437584]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden []
"AdobeBridge"= []
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-10 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-01-08 68640]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe [2007-04-24 723760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2007-01-02 210520]

C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"NoHotStart"=0
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a703a182-2632-11dd-84af-806e6f6e6963}]
shell\AutoRun\command - E:\Autorun.exe


======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - "C:\Program Files\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe","%1"

======List of files/folders created in the last 1 months======

2010-04-08 19:32:19 ----A---- C:\mbam-error.txt
2010-04-06 17:33:55 ----A---- C:\Windows\system32\mshtml.dll
2010-04-06 17:33:54 ----A---- C:\Windows\system32\ieframe.dll
2010-04-06 17:33:53 ----A---- C:\Windows\system32\urlmon.dll
2010-04-06 17:33:53 ----A---- C:\Windows\system32\iertutil.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\wininet.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\occache.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\mstime.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\msfeeds.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\ieui.dll
2010-04-06 17:33:52 ----A---- C:\Windows\system32\iedkcs32.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\msfeedssync.exe
2010-04-06 17:33:51 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\jsproxy.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\ieUnatt.exe
2010-04-06 17:33:51 ----A---- C:\Windows\system32\iesysprep.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\iesetup.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\iernonce.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\iepeers.dll
2010-04-06 17:33:51 ----A---- C:\Windows\system32\ie4uinit.exe
2010-04-05 13:47:12 ----D---- C:\Program Files\Inkscape
2010-04-05 11:50:51 ----D---- C:\Program Files\ICQ7.1
2010-03-26 16:42:33 ----D---- C:\Windows\Sun
2010-03-25 21:47:12 ----D---- C:\rsit
2010-03-25 19:50:10 ----D---- C:\Users\Sandra\AppData\Roaming\Malwarebytes
2010-03-25 19:50:03 ----D---- C:\ProgramData\Malwarebytes
2010-03-25 19:50:03 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-03-25 19:33:03 ----D---- C:\Program Files\CCleaner
2010-03-24 18:30:12 ----SHD---- C:\Users\Sandra\AppData\Roaming\lowsec
2010-03-23 21:05:07 ----A---- C:\Windows\system32\asdjfhla.txt
2010-03-22 21:22:55 ----D---- C:\Users\Sandra\AppData\Roaming\streamripper
2010-03-21 23:03:04 ----D---- C:\Program Files\No23 Recorder
2010-03-13 21:50:36 ----D---- C:\Users\Sandra\AppData\Roaming\phonostar GmbH
2010-03-13 21:36:35 ----D---- C:\Users\Sandra\AppData\Roaming\Tobit
2010-03-13 21:36:18 ----D---- C:\Program Files\Common Files\Tobit
2010-03-13 21:36:18 ----A---- C:\Windows\system32\dvmsg.dll
2010-03-13 21:23:28 ----A---- C:\Windows\system32\D3DX9_42.dll
2010-03-13 21:22:44 ----D---- C:\Program Files\Winamp Detect
2010-03-13 21:22:33 ----D---- C:\Users\Sandra\AppData\Roaming\Winamp
2010-03-13 21:13:15 ----D---- C:\Users\Sandra\AppData\Roaming\RadioRipper
2010-03-12 20:27:51 ----D---- C:\ProgramData\Sun
2010-03-12 20:27:50 ----D---- C:\Program Files\Common Files\Java
2010-03-12 20:27:34 ----A---- C:\Windows\system32\javaws.exe
2010-03-12 20:27:34 ----A---- C:\Windows\system32\javaw.exe
2010-03-12 20:27:34 ----A---- C:\Windows\system32\java.exe
2010-03-11 10:51:26 ----A---- C:\Windows\system32\nshhttp.dll
2010-03-11 10:51:23 ----A---- C:\Windows\system32\httpapi.dll
2010-03-09 08:43:59 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-03-09 08:43:59 ----A---- C:\Windows\system32\ntkrnlpa.exe

======List of files/folders modified in the last 1 months======

2010-04-08 21:24:35 ----D---- C:\Windows\Temp
2010-04-08 21:20:09 ----D---- C:\Windows\System32
2010-04-08 21:20:09 ----D---- C:\Windows\inf
2010-04-08 21:20:09 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-04-08 20:50:23 ----D---- C:\Windows\Prefetch
2010-04-08 20:45:02 ----D---- C:\Windows\Tasks
2010-04-08 20:38:39 ----D---- C:\Users\Sandra\AppData\Roaming\ICQ
2010-04-08 19:32:14 ----D---- C:\Windows\system32\drivers
2010-04-07 20:38:50 ----D---- C:\Windows\Minidump
2010-04-07 20:38:50 ----D---- C:\Windows
2010-04-06 22:17:15 ----D---- C:\Windows\system32\catroot2
2010-04-06 20:49:56 ----D---- C:\Windows\system32\migration
2010-04-06 20:49:56 ----D---- C:\Program Files\Internet Explorer
2010-04-06 19:59:56 ----D---- C:\Windows\winsxs
2010-04-06 18:20:09 ----SHD---- C:\System Volume Information
2010-04-06 17:40:19 ----D---- C:\Windows\system32\Tasks
2010-04-06 14:07:26 ----D---- C:\Windows\system32\catroot
2010-04-05 20:48:02 ----RD---- C:\Program Files\Skype
2010-04-05 20:48:02 ----D---- C:\Program Files\Unlocker
2010-04-05 20:48:02 ----D---- C:\Program Files\DNA
2010-04-05 20:47:13 ----D---- C:\Users\Sandra\AppData\Roaming\Adobe
2010-04-05 14:00:07 ----D---- C:\Users\Sandra\AppData\Roaming\Inkscape
2010-04-05 13:49:30 ----SHD---- C:\Windows\Installer
2010-04-05 13:49:29 ----HD---- C:\Config.Msi
2010-04-05 13:49:17 ----D---- C:\Program Files\Google
2010-04-05 13:47:12 ----RD---- C:\Program Files
2010-04-05 13:46:43 ----D---- C:\Users\Sandra\AppData\Roaming\Google
2010-04-05 13:46:30 ----D---- C:\ProgramData\Google
2010-04-05 11:51:26 ----D---- C:\Program Files\ICQ6Toolbar
2010-04-05 11:51:17 ----HD---- C:\Program Files\InstallShield Installation Information
2010-04-05 11:51:17 ----D---- C:\ProgramData\ICQ
2010-04-05 11:51:17 ----D---- C:\Program Files\ICQ6.5
2010-04-05 11:42:35 ----D---- C:\Program Files\Common Files\LightScribe
2010-04-05 11:41:33 ----D---- C:\Program Files\Winamp
2010-04-05 11:40:38 ----D---- C:\Windows\WindowsMobile
2010-04-05 11:38:19 ----D---- C:\Program Files\Microsoft IntelliPoint
2010-03-28 17:55:57 ----D---- C:\Program Files\Common Files\Nikon
2010-03-28 17:54:21 ----HD---- C:\ProgramData
2010-03-26 21:38:16 ----D---- C:\DVDVideoSoft
2010-03-25 21:38:30 ----D---- C:\Windows\Logs
2010-03-25 21:35:30 ----D---- C:\Users\Sandra\AppData\Roaming\Desktopicon
2010-03-25 19:39:14 ----D---- C:\Windows\Debug
2010-03-25 10:33:06 ----D---- C:\Downloads
2010-03-25 00:37:17 ----D---- C:\Program Files\BitComet
2010-03-25 00:35:26 ----D---- C:\Users\Sandra\AppData\Roaming\DNA
2010-03-24 23:23:17 ----D---- C:\Program Files\Common Files
2010-03-24 23:23:08 ----D---- C:\ProgramData\Skype
2010-03-24 22:16:15 ----D---- C:\Windows\system32\wbem
2010-03-24 22:14:49 ----D---- C:\Windows\VMC302
2010-03-24 22:14:49 ----D---- C:\Windows\system32\spool
2010-03-24 22:14:49 ----D---- C:\Windows\system32\CodeIntegrity
2010-03-24 22:14:48 ----D---- C:\Windows\registration
2010-03-24 22:14:48 ----D---- C:\ProgramData\FLEXnet
2010-03-24 22:04:46 ----D---- C:\Program Files\Mozilla Firefox
2010-03-24 22:04:42 ----D---- C:\Users\Sandra\AppData\Roaming\Mozilla
2010-03-24 21:49:28 ----D---- C:\Windows\system
2010-03-24 18:27:47 ----HD---- C:\Windows\system32\GroupPolicy
2010-03-13 21:29:15 ----RSD---- C:\Windows\assembly
2010-03-12 20:27:28 ----D---- C:\Program Files\Java
2010-03-11 11:42:52 ----D---- C:\Program Files\Windows Mail
2010-03-11 11:42:52 ----D---- C:\Program Files\Movie Maker

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-11-25 56816]
R2 KMDFMEMIO;SAMSUNG Kernel Driver; C:\Windows\system32\DRIVERS\kmdfmemio.sys [2008-04-16 13312]
R3 AgereSoftModem;Agere Systems Soft Modem; C:\Windows\system32\DRIVERS\AGRSM.sys [2006-11-28 1161888]
R3 athr;Atheros Extensible Wireless LAN device driver; C:\Windows\system32\DRIVERS\athr.sys [2007-09-13 755712]
R3 atikmdag;atikmdag; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-03-18 3542016]
R3 BT;Bluetooth PAN Network Adapter; C:\Windows\system32\DRIVERS\btnetdrv.sys [2007-03-05 18320]
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-19 14208]
R3 FsUsbExDisk;FsUsbExDisk; \??\C:\Windows\system32\FsUsbExDisk.SYS [2009-07-15 36608]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-07-07 2152088]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\Windows\System32\Drivers\RootMdm.sys [2008-01-19 8192]
R3 SynTP;Synaptics TouchPad Driver; C:\Windows\system32\DRIVERS\SynTP.sys [2007-10-26 193456]
R3 VComm;Virtual Serial port driver; C:\Windows\system32\DRIVERS\VComm.sys [2007-03-05 34448]
R3 VcommMgr;Bluetooth VComm Manager Service; C:\Windows\System32\Drivers\VcommMgr.sys [2007-03-05 44304]
R3 VMC302;Vimicro Camera Service VMC302; C:\Windows\System32\Drivers\VMC302.sys [2007-10-17 242560]
R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-05-03 245248]
S3 BlueletAudio;Bluetooth Audio Service; C:\Windows\system32\DRIVERS\blueletaudio.sys [2007-03-05 34576]
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\Windows\system32\DRIVERS\BlueletSCOAudio.sys [2007-03-05 27792]
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\Windows\System32\Drivers\btcusb.sys [2007-03-05 39184]
S3 bthav;Bluetooth-AV-Profil; C:\Windows\system32\drivers\bthav.sys [2007-08-14 33792]
S3 BthEnum;Bluetooth-Auflistungsdienst; C:\Windows\system32\DRIVERS\BthEnum.sys [2008-07-05 19456]
S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-19 92160]
S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2008-07-05 220160]
S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2008-07-05 29184]
S3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664]
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200]
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432]
S3 Dot4;MS IEEE-1284.4-Treiber; C:\Windows\system32\DRIVERS\Dot4.sys [2008-01-19 131584]
S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2008-01-19 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2008-01-19 36864]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 NETw2v32;Intel(R) PRO/Wireless 2915ABG Network Connection Driver for Windows Vista; C:\Windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 Point32;Microsoft IntelliPoint Filter Driver; C:\Windows\system32\DRIVERS\point32k.sys [2009-05-28 30088]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2008-03-18 3542016]
S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2008-01-19 49664]
S3 RTL8023xp;Realtek 10/100 NIC Family NDIS x86 Driver; C:\Windows\system32\DRIVERS\Rtnicxp.sys [2006-11-02 47104]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2007-07-03 80552]
S3 sscdmdfl;SAMSUNG Mobile Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2007-07-03 11944]
S3 sscdmdm;SAMSUNG Mobile Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2007-07-03 106792]
S3 StarOpen;StarOpen; C:\Windows\system32\drivers\StarOpen.sys []
S3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2008-01-19 73088]
S3 usbscan;USB-Scannertreiber; C:\Windows\system32\DRIVERS\usbscan.sys [2008-01-19 35328]
S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2006-11-02 132352]
S3 winusb;WinUsb-Treiber; C:\Windows\system32\DRIVERS\winusb.sys [2008-01-19 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2008-01-19 39936]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S4 MBAMSwissArmy;MBAMSwissArmy; \??\C:\Windows\system32\drivers\mbamswissarmy.sys [2010-03-30 38224]
S4 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2006-11-02 82432]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AgereModemAudio;Agere Modem Call Progress Audio; C:\Windows\system32\agrsmsvc.exe [2006-10-05 9216]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Ati External Event Utility;Ati External Event Utility; C:\Windows\system32\Ati2evxx.exe [2008-03-18 663552]
R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
R2 FsUsbExService;FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [2009-07-15 233472]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 ICQ Service;ICQ Service; C:\Program Files\ICQ6Toolbar\ICQ Service.exe [2010-01-03 246520]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2007-07-25 79136]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2006-12-19 272024]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2008-01-19 21504]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2010-03-28 135664]
S2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ); C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-06-28 72704]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-27 34312]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-06-29 655624]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-03-28 194104]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 SQLWriter;SQL Server VSS Writer; C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 87840]
S4 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S4 MSSQLServerADHelper;Hilfsdienst von SQL Server für Active Directory; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2005-10-13 45272]
S4 SQLBrowser;SQL Server-Browser; C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2006-04-14 240416]

-----------------EOF-----------------

Alt 09.04.2010, 10:48   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Zitat:
Datenbank Version: 3930
Du hast die Signaturen/Datenbanken nicht aktualisiert

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 09.04.2010, 12:07   #6
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Die Datenbank wurde doch von 3913 zu 3930 kurz vor dem Durchlauf Aktualisiert!!!

Alt 09.04.2010, 12:12   #7
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Ja, nur durch das Installieren von Version 1.45. Du musst nach der Installation auch nochmal manuell auf Updates klicken! Jetzt aktuell ist DB Version 3970!
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 09.04.2010, 14:05   #8
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



So jetzt aber hoffentlich!

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Datenbank Version: 3970

Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18904

09.04.2010 14:02:48
mbam-log-2010-04-09 (14-02-48).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 292881
Laufzeit: 1 Stunde(n), 52 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Alt 09.04.2010, 19:30   #9
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Kann mir keiner helfen?

Alt 09.04.2010, 19:32   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Jop, auch wenn Geduld nicht gerade Deine Stärke ist
Poste bitte noch ein OTL Logfile, mit dem seh ich mehr:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 09.04.2010, 19:45   #11
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Ok Sorry!!

Bei mir hat Avira gerade beim Durchlauf ein Virus gemeldet:

C:\Users\******\AppData\Roaming\sdra64.exe

"DAS Trojanische Pferd: TR/Spy.ZBot.118272"

OTL logfile created on: 09.04.2010 19:34:15 - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\Sandra\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 50,33 Gb Free Space | 34,93% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SANDRA-PC
Current User Name: Sandra
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\Sandra\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Google\Google Toolbar\GoogleToolbarUser_32.exe (Google Inc.)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Programme\Avira\AntiVir Desktop\avnotify.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics co., LTD.)
PRC - C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics)
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)


========== Modules (SafeList) ==========

MOD - C:\Users\Sandra\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLBrowser) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation)
SRV - (SQLWriter) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
SRV - (MSSQLServerADHelper) -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (Point32) -- C:\Windows\System32\drivers\point32k.sys (Microsoft Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (KMDFMEMIO) -- C:\Windows\System32\drivers\KMDFMEMIO.sys (SAMSUNG ELECTRONICS CO., LTD.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (VMC302) -- C:\Windows\System32\drivers\vmc302.sys (Vimicro Corporation)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (bthav) -- C:\Windows\System32\drivers\bthav.sys (CSR, plc)
DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
DRV - (yukonwlh) -- C:\Windows\System32\drivers\yk60x86.sys (Marvell)
DRV - (AtiPcie) ATI PCI Express (3GIO) -- C:\Windows\system32\DRIVERS\AtiPcie.sys (ATI Technologies Inc.)
DRV - (btwaudio) -- C:\Windows\System32\drivers\btwaudio.sys (Broadcom Corporation.)
DRV - (Btcsrusb) -- C:\Windows\System32\drivers\btcusb.sys (IVT Corporation.)
DRV - (BlueletSCOAudio) -- C:\Windows\System32\drivers\BlueletSCOAudio.sys (IVT Corporation.)
DRV - (BT) -- C:\Windows\System32\drivers\btnetdrv.sys (IVT Corporation.)
DRV - (BTHidMgr) -- C:\Windows\System32\Drivers\BTHidMgr.sys (IVT Corporation.)
DRV - (BTHidEnum) -- C:\Windows\System32\Drivers\vbtenum.sys (IVT Corporation.)
DRV - (VcommMgr) -- C:\Windows\System32\drivers\VCommMgr.sys (IVT Corporation.)
DRV - (VComm) -- C:\Windows\System32\drivers\VComm.sys (IVT Corporation.)
DRV - (BlueletAudio) -- C:\Windows\System32\drivers\blueletaudio.sys (IVT Corporation.)
DRV - (btwavdt) -- C:\Windows\System32\drivers\btwavdt.sys (Broadcom Corporation.)
DRV - (btwrchid) -- C:\Windows\System32\drivers\btwrchid.sys (Broadcom Corporation.)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NETw2v32) Intel(R) -- C:\Windows\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (RTL8023xp) -- C:\Windows\System32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local


[2010.03.24 22:04:46 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2009.07.19 10:13:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2009.07.17 10:40:12 | 000,704,512 | ---- | M] (BitComet) -- C:\Programme\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe File not found
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program Files\Google\Quick Search Box\GoogleQuickSearchBox.exe File not found
O4 - HKLM..\Run: [GrooveMonitor] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe File not found
O4 - HKLM..\Run: [IntelliPoint] C:\Program Files\Microsoft IntelliPoint\ipoint.exe File not found
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe File not found
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe File not found
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe File not found
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe File not found
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe File not found
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe File not found
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Sandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll (Google Inc.)
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: View EXIF - C:\ViewEXIF\EXIF.htm ()
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} hxxp://www.srtest.com/srl_bin/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {40F576AD-8680-4F9E-9490-99D069CD665F} hxxp://srtest-cdn.systemrequirementslab.com.s3.amazonaws.com/bin/sysreqlabdetect.cab (Reg Error: Key error.)
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab (DLM Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab (EPUImageControl Class)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a703a182-2632-11dd-84af-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a703a182-2632-11dd-84af-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

File not found -- C:\Users\Sandra\AppData\Roaming\sdra64 .exe
[2010.04.09 19:33:30 | 000,561,664 | ---- | C] (OldTimer Tools) -- C:\Users\Sandra\Desktop\OTL.exe
[2010.04.07 20:16:39 | 000,562,840 | ---- | C] (Google Inc.) -- C:\Users\Sandra\Desktop\ChromeSetup.exe
[2010.04.06 17:33:52 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2010.04.06 17:33:52 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2010.04.06 17:33:52 | 000,594,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2010.04.06 17:33:52 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2010.04.06 17:33:52 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2010.04.06 17:33:51 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2010.04.06 17:33:51 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010.04.06 17:33:51 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2010.04.06 17:33:51 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2010.04.06 17:33:51 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2010.04.06 17:33:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2010.04.06 17:33:51 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2010.04.06 17:33:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2010.04.06 17:33:51 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2010.04.06 17:33:51 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2010.04.05 13:47:12 | 000,000,000 | ---D | C] -- C:\Programme\Inkscape
[2010.04.05 11:51:08 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Local\AOL
[2010.04.05 11:50:51 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.1
[2010.03.28 13:14:39 | 000,000,000 | ---D | C] -- C:\Users\Sandra\Documents\Eigene Google Gadgets
[2010.03.26 16:42:33 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.03.25 21:47:12 | 000,000,000 | ---D | C] -- C:\rsit
[2010.03.25 19:50:10 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Malwarebytes
[2010.03.25 19:50:06 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.03.25 19:50:03 | 000,020,824 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.03.25 19:50:03 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.03.25 19:50:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.03.25 19:33:03 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2010.03.25 19:32:10 | 003,396,856 | ---- | C] (Piriform Ltd) -- C:\Users\Sandra\ccsetup229.exe
[2010.03.25 10:47:26 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Local\Deployment
[2010.03.25 10:47:26 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Local\Apps
[2010.03.24 18:30:12 | 000,000,000 | -HSD | C] -- C:\Users\Sandra\AppData\Roaming\lowsec
[2010.03.22 21:22:55 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\streamripper
[2010.03.21 23:03:04 | 000,000,000 | ---D | C] -- C:\Programme\No23 Recorder
[2010.03.13 21:50:43 | 000,000,000 | ---D | C] -- C:\Users\Sandra\Documents\Aufnahmen
[2010.03.13 21:50:36 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\phonostar GmbH
[2010.03.13 21:36:35 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Tobit
[2010.03.13 21:36:18 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Tobit
[2010.03.13 21:23:28 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll
[2010.03.13 21:22:44 | 000,000,000 | ---D | C] -- C:\Programme\Winamp Detect
[2010.03.13 21:22:33 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Winamp
[2010.03.13 21:13:15 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\RadioRipper
[2010.03.12 20:27:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.03.12 20:27:50 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2010.03.12 20:27:34 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010.03.12 20:27:34 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010.03.12 20:27:34 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010.03.11 10:51:26 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\nshhttp.dll
[2010.03.11 10:51:23 | 000,031,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\httpapi.dll
[2009.06.16 14:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll
[2006.11.24 07:14:44 | 000,139,264 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK_wiz.dll
[2006.11.24 07:14:44 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\MACSSDK.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010.04.09 19:35:50 | 007,340,032 | -HS- | M] () -- C:\Users\Sandra\NTUSER.DAT
[2010.04.09 19:33:45 | 000,000,680 | ---- | M] () -- C:\Users\Sandra\AppData\Local\d3d9caps.dat
[2010.04.09 19:33:36 | 000,561,664 | ---- | M] (OldTimer Tools) -- C:\Users\Sandra\Desktop\OTL.exe
[2010.04.09 19:28:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.04.09 19:00:44 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\SupBackGroundTask.job
[2010.04.09 19:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At20.job
[2010.04.09 18:38:17 | 001,602,878 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010.04.09 18:38:17 | 000,688,784 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2010.04.09 18:38:17 | 000,645,558 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010.04.09 18:38:17 | 000,151,782 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2010.04.09 18:38:17 | 000,123,642 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010.04.09 18:32:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.04.09 18:31:57 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010.04.09 18:31:56 | 000,003,296 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010.04.09 18:31:56 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.04.09 18:31:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.04.09 18:31:15 | 3219,308,544 | -HS- | M] () -- C:\hiberfil.sys
[2010.04.09 14:11:31 | 000,524,288 | -HS- | M] () -- C:\Users\Sandra\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2010.04.09 14:11:31 | 000,065,536 | -HS- | M] () -- C:\Users\Sandra\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.04.09 14:11:27 | 002,639,869 | -H-- | M] () -- C:\Users\Sandra\AppData\Local\IconCache.db
[2010.04.09 14:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At15.job
[2010.04.09 08:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At9.job
[2010.04.09 07:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At8.job
[2010.04.08 22:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At23.job
[2010.04.08 21:13:57 | 000,002,869 | ---- | M] () -- C:\Windows\System32\dmlg.dat
[2010.04.08 21:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At22.job
[2010.04.08 20:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At21.job
[2010.04.07 20:16:41 | 000,562,840 | ---- | M] (Google Inc.) -- C:\Users\Sandra\Desktop\ChromeSetup.exe
[2010.04.06 18:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At19.job
[2010.04.05 17:38:16 | 000,000,713 | ---- | M] () -- C:\Users\Sandra\.recently-used.xbel
[2010.04.05 16:59:59 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At18.job
[2010.04.05 15:59:59 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At17.job
[2010.04.05 15:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At16.job
[2010.04.05 13:56:30 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At7.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At6.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At5.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At4.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At3.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At24.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At2.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At14.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At13.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At12.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At11.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At10.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At1.job
[2010.03.30 00:46:30 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010.03.30 00:45:52 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010.03.28 15:31:11 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2010.03.28 14:58:51 | 000,098,304 | ---- | M] () -- C:\Users\Sandra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.25 21:46:21 | 000,781,909 | ---- | M] () -- C:\Users\Sandra\Desktop\RSIT.exe
[2010.03.25 19:50:08 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.03.25 19:33:04 | 000,001,670 | ---- | M] () -- C:\Users\Sandra\Desktop\CCleaner.lnk
[2010.03.25 19:32:26 | 003,396,856 | ---- | M] (Piriform Ltd) -- C:\Users\Sandra\ccsetup229.exe
[2010.03.11 22:35:51 | 000,197,234 | ---- | M] () -- C:\Users\Sandra\Normales Zellbild.docx
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010.04.09 19:33:45 | 000,000,680 | ---- | C] () -- C:\Users\Sandra\AppData\Local\d3d9caps.dat
[2010.04.05 17:38:16 | 000,000,713 | ---- | C] () -- C:\Users\Sandra\.recently-used.xbel
[2010.04.05 13:56:30 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\Inkscape.lnk
[2010.04.05 11:37:53 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At24.job
[2010.04.05 11:37:53 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At23.job
[2010.04.05 11:37:52 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At22.job
[2010.04.05 11:37:51 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At21.job
[2010.04.05 11:37:48 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At20.job
[2010.04.05 11:37:47 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At19.job
[2010.04.05 11:37:46 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At18.job
[2010.04.05 11:37:45 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At17.job
[2010.04.05 11:37:44 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At16.job
[2010.04.05 11:37:43 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At15.job
[2010.04.05 11:37:42 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At14.job
[2010.04.05 11:37:40 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At13.job
[2010.04.05 11:37:39 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At12.job
[2010.04.05 11:37:35 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At11.job
[2010.04.05 11:37:29 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At10.job
[2010.04.05 11:37:21 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At3.job
[2010.04.05 11:37:19 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At2.job
[2010.04.05 11:37:18 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At1.job
[2010.03.28 17:34:41 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At8.job
[2010.03.28 17:34:40 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At7.job
[2010.03.28 17:34:39 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At6.job
[2010.03.28 17:34:38 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At5.job
[2010.03.28 17:34:37 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At4.job
[2010.03.28 13:13:51 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.03.28 13:13:48 | 000,001,092 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.03.27 19:05:31 | 000,000,384 | ---- | C] () -- C:\Windows\tasks\At9.job
[2010.03.25 21:46:18 | 000,781,909 | ---- | C] () -- C:\Users\Sandra\Desktop\RSIT.exe
[2010.03.25 21:36:28 | 000,003,537 | ---- | C] () -- C:\Users\Sandra\mbam-log-2010-03-25 (20-35-30).txt
[2010.03.25 19:50:08 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.03.25 19:33:04 | 000,001,670 | ---- | C] () -- C:\Users\Sandra\Desktop\CCleaner.lnk
[2010.03.24 18:27:47 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2010.03.13 21:36:18 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
[2010.03.11 21:46:18 | 000,197,234 | ---- | C] () -- C:\Users\Sandra\Normales Zellbild.docx
[2010.02.20 19:07:14 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.01.29 22:40:36 | 000,000,094 | ---- | C] () -- C:\Users\Sandra\AppData\Local\fusioncache.dat
[2009.12.25 12:38:50 | 000,721,904 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys
[2009.12.19 16:39:45 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2009.12.19 16:39:45 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.11.17 15:06:54 | 000,019,968 | -HS- | C] () -- C:\Users\Sandra\Thumbs.db
[2009.10.15 15:12:48 | 000,005,697 | ---- | C] () -- C:\Users\Sandra\AppData\Roaming\accounts.txt
[2009.10.03 10:22:32 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.10.01 19:13:37 | 000,085,718 | ---- | C] () -- C:\Users\Sandra\BABY_1.jpg
[2009.10.01 19:10:51 | 000,085,708 | ---- | C] () -- C:\Users\Sandra\BABY_2.jpg
[2009.09.29 21:33:46 | 000,000,268 | RH-- | C] () -- C:\Users\Sandra\AppData\Roaming\CIOSupport
[2009.09.29 21:33:46 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Carbon
[2009.09.29 21:33:46 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLck.DAT
[2009.09.29 21:33:44 | 000,000,268 | RH-- | C] () -- C:\Users\Sandra\AppData\Roaming\CMMs
[2009.09.29 21:33:44 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Channel
[2009.09.29 15:16:01 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLbx.DAT
[2009.09.09 20:48:40 | 000,741,888 | ---- | C] () -- C:\Users\Sandra\Midnight_Sun__12_Kapitel_Deutsch_.doc
[2009.07.15 19:57:15 | 000,000,767 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009.06.16 14:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll
[2009.05.29 08:15:03 | 000,000,000 | ---- | C] () -- C:\ProgramData\Super Strings
[2009.05.29 08:04:33 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009.05.29 08:04:33 | 000,000,000 | ---- | C] () -- C:\Users\Sandra\AppData\Roaming\SystemConfiguration
[2009.04.25 13:40:18 | 000,200,347 | RHS- | C] () -- C:\Programme\Setup.ini
[2008.11.06 18:37:32 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dtu100.dll.manifest
[2008.11.06 18:34:00 | 000,000,416 | ---- | C] () -- C:\Windows\System32\dpl100.dll.manifest
[2008.11.06 18:33:02 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.10.11 14:13:38 | 000,025,834 | ---- | C] () -- C:\Users\Sandra\AppData\Local\derbeagletabelle.png
[2008.10.11 14:13:32 | 000,002,825 | ---- | C] () -- C:\Users\Sandra\AppData\Local\derbeagle.html
[2008.10.09 12:50:45 | 000,002,793 | ---- | C] () -- C:\Users\Sandra\AppData\Local\index.html
[2008.10.05 17:30:26 | 000,026,340 | ---- | C] () -- C:\Users\Sandra\AppData\Roaming\UserTile.png
[2008.10.04 19:57:51 | 000,003,657 | ---- | C] () -- C:\Users\Sandra\AppData\Local\gallerie.html
[2008.10.04 19:47:37 | 000,054,595 | ---- | C] () -- C:\Users\Sandra\AppData\Local\gallerie04.10.2008.png
[2008.10.04 08:37:54 | 000,003,002 | ---- | C] () -- C:\Users\Sandra\AppData\Local\charakter.html
[2008.10.03 22:41:04 | 000,001,945 | ---- | C] () -- C:\Users\Sandra\AppData\Local\kontakt.html
[2008.10.03 22:41:02 | 000,003,154 | ---- | C] () -- C:\Users\Sandra\AppData\Local\jackie.html
[2008.10.03 22:41:00 | 000,006,445 | ---- | C] () -- C:\Users\Sandra\AppData\Local\impressum.html
[2008.10.03 22:40:55 | 000,003,177 | ---- | C] () -- C:\Users\Sandra\AppData\Local\geschichte.html
[2008.10.03 22:33:36 | 000,059,292 | ---- | C] () -- C:\Users\Sandra\AppData\Local\galleriesommer08.png
[2008.10.03 22:29:48 | 000,037,911 | ---- | C] () -- C:\Users\Sandra\AppData\Local\jackietabelle.png
[2008.10.03 22:29:46 | 000,071,081 | ---- | C] () -- C:\Users\Sandra\AppData\Local\jackiebild.png
[2008.10.03 22:29:42 | 000,004,310 | ---- | C] () -- C:\Users\Sandra\AppData\Local\jackie.png
[2008.10.03 22:29:41 | 000,004,250 | ---- | C] () -- C:\Users\Sandra\AppData\Local\impressum.png
[2008.10.03 22:29:40 | 000,005,016 | ---- | C] () -- C:\Users\Sandra\AppData\Local\herzlich.png
[2008.10.03 22:29:39 | 000,004,658 | ---- | C] () -- C:\Users\Sandra\AppData\Local\geschichte.png
[2008.10.03 22:29:35 | 000,004,106 | ---- | C] () -- C:\Users\Sandra\AppData\Local\gallerie.png
[2008.10.03 22:29:34 | 000,140,602 | ---- | C] () -- C:\Users\Sandra\AppData\Local\DSC_0657.png
[2008.10.03 22:29:34 | 000,000,765 | ---- | C] () -- C:\Users\Sandra\AppData\Local\email.png
[2008.10.03 22:29:27 | 000,063,639 | ---- | C] () -- C:\Users\Sandra\AppData\Local\derbeagletabelle.pspimage
[2008.10.03 22:29:22 | 000,006,892 | ---- | C] () -- C:\Users\Sandra\AppData\Local\derbeagle.png
[2008.10.03 22:29:21 | 000,004,356 | ---- | C] () -- C:\Users\Sandra\AppData\Local\charakter.png
[2008.10.03 22:29:16 | 000,218,812 | ---- | C] () -- C:\Users\Sandra\AppData\Local\Bild8.png
[2008.10.03 22:29:06 | 000,050,333 | ---- | C] () -- C:\Users\Sandra\AppData\Local\banner.png
[2008.10.03 15:46:36 | 000,237,481 | ---- | C] () -- C:\Users\Sandra\AppData\Local\Bild7.png
[2008.08.29 20:23:34 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2008.07.05 13:54:46 | 000,098,304 | ---- | C] () -- C:\Users\Sandra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.07.05 12:27:06 | 000,000,020 | -HS- | C] () -- C:\Users\Sandra\ntuser.ini
[2008.07.05 12:27:04 | 007,340,032 | -HS- | C] () -- C:\Users\Sandra\NTUSER.DAT
[2008.07.05 12:27:04 | 000,524,288 | -HS- | C] () -- C:\Users\Sandra\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2008.07.05 12:27:04 | 000,524,288 | -HS- | C] () -- C:\Users\Sandra\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2008.07.05 12:27:04 | 000,262,144 | -H-- | C] () -- C:\Users\Sandra\ntuser.dat.LOG1
[2008.07.05 12:27:04 | 000,065,536 | -HS- | C] () -- C:\Users\Sandra\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2008.07.05 12:27:04 | 000,000,000 | -H-- | C] () -- C:\Users\Sandra\ntuser.dat.LOG2
[2008.04.16 01:44:48 | 000,004,512 | ---- | C] () -- C:\Windows\HotFixList.ini
[2008.04.16 01:37:29 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini
[2008.04.16 01:37:29 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini
[2008.04.15 07:40:46 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008.04.15 07:40:40 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.04.24 11:32:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2007.02.15 09:51:02 | 000,274,432 | ---- | C] () -- C:\Windows\System32\NDADLL.dll
[2006.11.29 10:00:28 | 000,307,200 | ---- | C] () -- C:\Windows\System32\LDBGenWizView.dll
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.10.09 03:01:28 | 000,061,440 | ---- | C] () -- C:\Windows\System32\AVSAudioWideStereoDMO.dll
[2001.11.14 06:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:E44D7155
< End of report >

Alt 09.04.2010, 19:45   #12
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



OTL Extras logfile created on: 09.04.2010 19:34:15 - Run 1
OTL by OldTimer - Version 3.2.1.1 Folder = C:\Users\Sandra\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 59,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 50,33 Gb Free Space | 34,93% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: SANDRA-PC
Current User Name: Sandra
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with Paint Shop Pro 9] -- "C:\Program Files\Jasc Software Inc\Paint Shop Pro 9\\Paint Shop Pro 9.exe" "/Browse" "%L" (Jasc Software, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04B99885-3EEB-4E11-93C8-69A609306F56}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{07CA26B0-4E46-4B70-86E5-C68CD40F0F13}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{0DA039A4-929E-448D-AC1A-E2BEE72A69C0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{11B7F2B0-6619-4E9D-90DF-BC43A8453BCE}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{1AA93F1B-6730-4572-88C3-9FF3ECC0EABD}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{24859C16-C75D-4853-B964-FCC2A6EFBEBF}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{36B14E9E-AE3C-41A7-8CD1-E205DA773BE6}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{3A66AA47-711F-48CE-9B5B-27894A0A6CD2}" = rport=5358 | protocol=6 | dir=out | app=system |
"{42F7A4F6-FDD1-48B7-829F-4FF8393D40F9}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{5574FD38-4777-4C0F-8EFC-0D9682026D98}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{59D7CCF9-83D4-4C64-B174-613A1E1205F1}" = lport=5358 | protocol=6 | dir=in | app=system |
"{62712162-49AC-4BA2-9D86-45E1CB57135D}" = lport=5357 | protocol=6 | dir=in | app=system |
"{70ADF71E-9D8E-4A00-9100-722BC10CA26C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{72B72431-358C-4D06-9B04-3E2DD760AA89}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7A37EF76-D178-4233-933A-4F4130BB9457}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{7BA6B1C6-56CB-4161-AD39-C638FB84FB22}" = lport=3587 | protocol=6 | dir=in | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{8EC03E37-D300-448F-BE80-507089FDA6ED}" = rport=5722 | protocol=6 | dir=out | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{9AEA4EC6-DDF7-47AC-AF53-640EDA4C274D}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{A9E252C8-28AB-4F78-A793-CE3B3CFEBD5E}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{AB18A825-037F-4873-8A6C-5C588CEC81C7}" = lport=5722 | protocol=6 | dir=in | svc=dfsr | app=%systemroot%\system32\dfsr.exe |
"{AECD2677-4D80-4EFF-991A-B7E1CEFFFB76}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{B00E020F-CE39-4C32-9E73-09FDC77E54D8}" = rport=3587 | protocol=6 | dir=out | svc=p2psvc | app=%systemroot%\system32\svchost.exe |
"{C3B5F28A-CB9D-41FC-97CE-5420DAF5B62C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CA0659A6-D133-4EC0-A047-072602918DCE}" = rport=5357 | protocol=6 | dir=out | app=system |
"{CD3D0C66-6133-42BF-BB26-B04703574203}" = lport=3540 | protocol=17 | dir=in | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{D4753C7F-547F-44D9-A25E-518D37062F26}" = lport=3702 | protocol=17 | dir=in | app=%systemroot%\system32\netproj.exe |
"{E1A8742B-291C-4FAA-BE36-B45BD8BE441E}" = rport=3540 | protocol=17 | dir=out | svc=pnrpsvc | app=%systemroot%\system32\svchost.exe |
"{E684F826-312C-466E-A976-B6E47023582F}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{F1A61568-1ABA-442F-9F14-01FFD61085C4}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\netproj.exe |
"{F6C3A18A-2BA6-4FB3-BD23-49611C0BDD58}" = rport=3702 | protocol=17 | dir=out | app=%systemroot%\system32\p2phost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04543734-97B7-4B75-B3E8-B7E5AD70720E}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{062C92EA-A0AA-4D41-BB5A-0C5B010CEE74}" = protocol=6 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{07B5DFDE-770D-41C0-9871-1A5F744C0B0B}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{0F29E20D-1E14-41FE-8FE9-568008EA90C1}" = protocol=6 | dir=in | app=c:\program files\icq7.1\aolload.exe |
"{0F5E85FD-2081-4AF3-8C4E-90846FDEDA0A}" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe |
"{12A57763-74BF-4326-908E-9EE2D7ED46D7}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{1B6CE3DA-5006-4D16-821B-9B550A0F33B8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{1E0063C3-FB49-4DDF-84D7-4B37BFF8B289}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{21B01BDD-1B5B-41C7-B4C5-15A4DD2AD963}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{28921582-6AFB-4AC9-B965-4C940D1647F9}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{2E53035B-AE7F-46AD-B793-3B62913DC5CE}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{30615B0C-26ED-4C1C-945E-9D765704BDF3}" = protocol=6 | dir=out | app=%systemroot%\system32\netproj.exe |
"{363FD5FE-625A-48E2-9C24-9A2958B5E415}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe |
"{3A3E8271-718C-449E-BA5A-538265ACC5E0}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{3ACC9605-9769-4999-BD81-DA17CE3D273F}" = protocol=17 | dir=in | app=c:\program files\icq7.1\aolload.exe |
"{3B4F65A5-C7AA-467A-BA38-1D49DE2640BD}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{50169631-4934-4D55-83CB-5A3D21A96A89}" = protocol=17 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{511ACEB1-CA6D-4C55-9AA9-7D5F25C3EEB0}" = protocol=17 | dir=in | app=c:\program files\icq7.1\aolload.exe |
"{55F1CA19-3C1B-475C-B07B-85DD8996B635}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{59ADA7B4-9379-444A-9EC1-C74D2DE802B8}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{686282BC-0976-4785-A91A-EEEFC2DF9172}" = protocol=17 | dir=in | app=c:\program files\dna\btdna .exe |
"{7271579C-6A76-46DE-A725-6E1317AEC490}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{73236B19-42A8-43FF-BC5F-4B57ED5174DC}" = protocol=17 | dir=in | app=c:\program files\tobit radio.fx\client\rfx-client.exe |
"{7BD0780C-DC17-40F2-91F9-51C0730A1591}" = protocol=6 | dir=out | app=%systemroot%\system32\p2phost.exe |
"{81CD75C3-509A-44C4-9678-B7A7DBF4D817}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{844F3AB4-321F-4189-9CD8-247A934DC678}" = protocol=6 | dir=in | app=%systemroot%\system32\p2phost.exe |
"{869031AA-F1EA-46DE-BF3C-033F79EE7283}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{86A1E582-45E3-487A-8FD8-03C64358C819}" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe |
"{87E70B79-581D-48F9-B502-F1F7B694F9EA}" = protocol=6 | dir=in | app=%systemroot%\system32\netproj.exe |
"{8E271DED-B96F-4FAC-8754-42F2AA31B301}" = protocol=6 | dir=in | app=c:\program files\tobit radio.fx\client\rfx-client.exe |
"{917162C2-AB40-4B59-8C2A-E5DDA482BA3C}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{9631F311-1A69-40BD-9395-5DC3684A8DAD}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{97ECB7D4-1944-4ED5-8649-69FA5D34B0CD}" = protocol=17 | dir=in | app=c:\program files\ubisoft\demo\james cameron's avatar - das spiel (demo)\bin\avatardemo.exe |
"{A15B39FE-26DE-4CC8-9F74-FA1460E74C7C}" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{A29DD84A-F82C-4E90-ADAC-5F423AF2291B}" = protocol=17 | dir=in | app=c:\program files\tobit radio.fx\server\rfx-server.exe |
"{A375FF18-09EB-4973-A31F-BE9BA8491157}" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{A7058065-D245-4957-8E25-2F16085DF306}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{A76195EB-D712-4CA2-8934-BEC8FD1C3FD3}" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe |
"{AA43B5A1-CE35-4780-B7AD-431B055DD84B}" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe |
"{AAC25A60-4AEF-45F0-99F6-5316126E23A4}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{ABC1DB21-DAF4-49DA-BC17-583295318FFB}" = protocol=17 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{B4A8526E-7ED6-426A-9328-3BEDF591BE93}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B617D78C-9BD4-4DE2-BB69-F4CB4D6113E7}" = protocol=6 | dir=in | app=c:\program files\dna\btdna .exe |
"{B694E2CC-4C5A-4C86-9EBB-B194056454CD}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{B9C72945-A005-4C50-87A2-174DBB8FA498}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{BB6124AA-A897-459E-AA76-0A8CCB406267}" = protocol=6 | dir=in | app=c:\program files\icq7.1\aolload.exe |
"{C209B92F-E660-42CF-8B59-3DB9D3ED8383}" = protocol=6 | dir=in | app=c:\program files\ivt corporation\bluesoleil\bluesoleil.exe |
"{C3675925-9DB9-48B3-A2E3-A42C0BEC5F4C}" = protocol=17 | dir=in | app=c:\program files\smartftp client\smartftp.exe |
"{C3D53EEF-6838-406A-A757-AF6E335B2190}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{D9DAF535-D54F-4C20-9C98-55F2E90052B3}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{DE5B8A7F-9F74-4AA7-937D-FDC4F990E562}" = protocol=6 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{DF937D63-297E-451B-BBFF-51B7B1636DF7}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{E144BFEF-8533-4205-ADD8-85DCD82F1E0C}" = protocol=17 | dir=in | app=%programfiles%\windows collaboration\wincollab.exe |
"{E148909C-AC37-4251-82EB-E1BFE60F735D}" = protocol=6 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{E5D2A698-1E22-4B38-B225-64AC140D4BE5}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{EA582196-66A7-4A0A-9206-25E58E1CE5E5}" = protocol=17 | dir=out | app=%programfiles%\windows collaboration\wincollab.exe |
"{ECCBDE55-B7BD-4D33-95D8-6E07207B8204}" = protocol=6 | dir=in | app=c:\program files\bitcomet\bitcomet.exe |
"{F3E591F4-0F82-4E86-AB96-D86BA5FCD33B}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{F5E9EEBD-EC10-4057-8EF2-07EC551D54BB}" = protocol=6 | dir=in | app=c:\program files\tobit radio.fx\server\rfx-server.exe |
"{F6BBC102-DF1E-4B9B-94F6-DCA2B1CB2FCE}" = protocol=6 | dir=in | app=c:\program files\ubisoft\demo\james cameron's avatar - das spiel (demo)\bin\avatardemo.exe |
"{F73EF69F-978F-4BB1-9C41-B449AB7EF792}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
"TCP Query User{0097E839-CE24-4388-B8BB-11BB70141042}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{087B874D-FAE8-4B4B-B5B7-836AE96FD18E}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{0F0958B9-0297-4490-83C4-759F17B6C558}C:\users\sandra\appdata\local\google\chrome\application\chrome.exe" = protocol=6 | dir=in | app=c:\users\sandra\appdata\local\google\chrome\application\chrome.exe |
"TCP Query User{15EF133B-8A71-4C28-8634-FFC9A4650EC2}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{191979C0-C9C6-4A08-A363-1EE95466518D}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{30B320A7-1F4F-4D52-BBBC-2DF5745D044A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{369B466E-F358-4413-AB18-085334954C22}C:\program files\radioripper\radioripper.exe" = protocol=6 | dir=in | app=c:\program files\radioripper\radioripper.exe |
"TCP Query User{691089E3-8067-418F-BDCE-196A62376994}C:\users\sandra\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\sandra\program files\dna\btdna.exe |
"TCP Query User{74BFBF5D-5A1E-4782-9F5F-E0EF52477E59}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{7A6BE00D-D07C-4BD4-AA31-F7A4897AAAAA}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{82E14D42-DED2-4885-A51E-BCBAB54DB3AE}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{96B93DC3-CA51-4B7A-A208-CABE57C71FFF}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"TCP Query User{A9048815-558E-4016-9E6B-9C33B9E6FA2B}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{B399342F-BB8A-4DBC-9363-FDA02F4E3874}C:\users\sandra\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\sandra\program files\dna\btdna.exe |
"TCP Query User{CA6E1FE4-02B9-4935-BB48-31BE931C524D}C:\program files\icq7.1\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe |
"TCP Query User{E0F11DAC-5E26-409A-94F4-F193F65C9035}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{EECC684E-087E-4529-8AEA-ADA74D563818}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{F0C7FB76-BF13-49E4-AF24-A4A5E0E68DCC}C:\program files\anno 1701 demo\anno1701_demo.exe" = protocol=6 | dir=in | app=c:\program files\anno 1701 demo\anno1701_demo.exe |
"TCP Query User{F5380B56-586E-457C-BCBB-E05D613BE3A9}C:\program files\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{0E600685-F22B-4378-A1E3-179B193DDE09}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{123E59AC-B07B-4C9D-826C-767B894A2F03}C:\users\sandra\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\sandra\program files\dna\btdna.exe |
"UDP Query User{1D8C0621-E1F1-4BD6-B1A0-9C45AD228DF1}C:\users\sandra\appdata\local\google\chrome\application\chrome.exe" = protocol=17 | dir=in | app=c:\users\sandra\appdata\local\google\chrome\application\chrome.exe |
"UDP Query User{1EDE5492-E78D-4FD5-9A45-5A50E7A4003E}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{200373C9-1556-4B5B-BFF1-3CD0C3C876FA}C:\program files\icq7.1\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe |
"UDP Query User{311280AB-57B8-4193-A23A-F856A8F9E36E}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{3B1F42F8-E997-4FF4-B7B4-BCDFDB5D87FC}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{71BE9F77-3770-4EC1-AE61-40F8D3644F3F}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{7C17B6F9-7DF0-4715-B468-AB92E7EC2C1F}C:\program files\anno 1701 demo\anno1701_demo.exe" = protocol=17 | dir=in | app=c:\program files\anno 1701 demo\anno1701_demo.exe |
"UDP Query User{903C5A9C-D720-40CB-9CD3-C0284C0A06AD}C:\users\sandra\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\sandra\program files\dna\btdna.exe |
"UDP Query User{950F8F65-FE73-4DE1-AC21-24903D1F06DA}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{AE639A15-7EB6-4A3B-8960-2AC09AEAB048}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe |
"UDP Query User{BD962C60-D063-4D28-AC58-70635B419634}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{CEF9DD79-B1FD-42B1-8806-C1EF5A426570}C:\program files\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"UDP Query User{D29EA81C-10A4-420C-997E-BF811F647A20}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{DF0263E8-7B83-4BC7-A2E9-05FA701FA001}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{E2A52229-EE17-4A6B-9496-E30D1A6891DF}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{F9DD291C-3CB1-40C9-B7B9-0EC55114E90D}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{FA5DE53B-8F88-474F-895F-B5ACA7C3ACAB}C:\program files\radioripper\radioripper.exe" = protocol=17 | dir=in | app=c:\program files\radioripper\radioripper.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00300409-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Proofing Tools Disc 1
"{0046FA01-C5B9-4985-BACB-398DC480FC05}" = Adobe Photoshop CS3
"{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}" = imagine digital freedom - Samsung
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{018FE763-ECD9-577B-05D5-3A67364FBAAA}" = Catalyst Control Center Localization Hungarian
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.5000
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1252B4EB-51F1-F349-6D79-954D877FB865}" = Catalyst Control Center Localization Swedish
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution II
"{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}" = Adobe Setup
"{14F91018-2A76-725D-056C-ECFF03F40F54}" = CCC Help Swedish
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{1F7A2A3A-B874-1E81-D291-A5ACB452F23F}" = CCC Help Italian
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = DVD Suite
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{2433BAD7-453F-473D-BE81-455E68940DEB}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 18
"{282E5AB2-8E47-4571-B6FA-6B512555B557}" = HP Photosmart.All-In-One Driver Software 8.0 .A
"{28A78C92-AC8C-DA80-6100-99A3AC4C3911}" = CCC Help Turkish
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2DFB5485-A3EF-4298-9280-4AF80C9F4BE9}" = Microsoft SQL Server VSS Writer
"{303A3978-8F11-DAAB-6F72-3D399477CC31}" = Catalyst Control Center Localization Chinese Standard
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3260D61B-DCA6-4ec6-8A41-DCCE01BC6EE4}" = c4100_Help
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{44F5A980-8A6B-4aca-8D85-EFCE5D67D379}" = AIO_CDA_ProductContext
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{4890127D-D62F-C496-9EFF-89FC910ABFE5}" = Catalyst Control Center Localization Polish
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C82121C-EB17-CEB0-996B-4D73FA0FAB47}" = Catalyst Control Center Graphics Light
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007
"{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{5466620C-3B00-0BEE-D626-1FBE29A16AC4}" = Catalyst Control Center Localization Russian
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{547DCEC7-DD2A-47E9-82C7-5CF1EAB526DA}" = Microsoft SQL Server Native Client
"{5508C9EB-5336-87F4-C2DB-53F2B3A482E7}" = Catalyst Control Center Graphics Previews Vista
"{5611C71F-AFC6-EBA3-E3E1-9FCCEC9647EE}" = ccc-core-static
"{5D7D1784-84A9-0EDB-62A6-D479F7F75DF6}" = CCC Help Chinese Traditional
"{62172AFD-E7F0-CAC1-1334-CB0159566F6C}" = Catalyst Control Center Localization Greek
"{65A0F799-1E9A-093B-BB8B-986203DAD390}" = Catalyst Control Center Core Implementation
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67B41BEF-F407-D81D-762F-CC44CC6FEB7A}" = Catalyst Control Center Localization Italian
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6AEE2B0B-B3C1-4367-B1EF-FC4ED98DEED1}" = C4100
"{6DFBD0A2-C692-44F5-1C96-773ED9B16002}" = Catalyst Control Center Graphics Full Existing
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{71BFC818-0CED-42D6-9C87-5142918957EE}" = ICQ7.1
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{768361B2-F78F-FFAA-5B1F-EFDB41C70D95}" = CCC Help French
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7A98B8DF-687E-8F7F-9A4A-ED1D9B306EAF}" = CCC Help Russian
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{818F922E-DE7A-6FC1-D85C-C44495070174}" = Catalyst Control Center Localization Dutch
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DB12734-9543-FBB3-E94D-3BE397ED8078}" = Catalyst Control Center Localization Japanese
"{9001B8A7-B591-7559-2264-B4A0F480D1A8}" = CCC Help Polish
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" =
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{905DF41F-D74C-6DF4-9453-D29CDE46A4A4}" = CCC Help Finnish
"{92041735-0623-CD56-9BCB-6CD4385232B0}" = CCC Help Thai
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{96A1E845-A730-4488-99A2-054C5BFAB9D1}" = CCC Help Greek
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{97EE277B-C0D9-6394-9A01-7681086EED5C}" = Catalyst Control Center Localization Portuguese
"{99F9ACB2-BCD2-B5A7-7738-24FB0B7B7763}" = ccc-utility
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9D669429-A2E4-4793-B7A0-283D259F39AF}" = Adobe Photoshop Lightroom 2.5
"{9DCC214C-CD1A-1115-6775-A9056185FE4E}" = ATI Catalyst Install Manager
"{9F06F30E-5138-2315-EC57-D4A23D572649}" = CCC Help Portuguese
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A3D22413-28D3-636E-1CE9-BC55C46364C3}" = Catalyst Control Center Graphics Full New
"{A53EA764-AB97-445E-002B-A32165BB0B3B}" = CCC Help Dutch
"{A586A89F-2BC4-CEB3-3C52-D1F4B57F572F}" = Catalyst Control Center Localization Turkish
"{A5EF9152-55CC-DF0E-AEDA-98D20EC3293E}" = CCC Help Japanese
"{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A952B4E1-913A-1492-A551-43EAE1D44E1D}" = Catalyst Control Center Localization Chinese Traditional
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.0 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{AF1C9345-B53D-4110-BFBF-A0DD83AEAB83}" = AIO_CDA_Software
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{AF98AF15-161E-42EC-9008-1CCF9BB83961}" = Bluesoleil3.2.1.2 Release 070314
"{B0524CD7-2B3F-50C1-B3AD-87457B7FF852}" = Catalyst Control Center Localization Spanish
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe 1.8.15.1
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BD11E3C6-065E-40BB-A129-435C4530A159}_is1" = Jewel Master - Cradle Of Rome
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C359699C-2D0A-5F08-9C44-4C1A508C4990}" = CCC Help Hungarian
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint 2.0
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CDA83283-8D9F-321F-5C76-AF68D3039B87}" = Catalyst Control Center Localization Czech
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D1BB4446-AE9C-4256-9A7F-4D46604D2462}" = Adobe Setup
"{D1C099EA-C28C-6593-8CE1-38F63EBD22F4}" = CCC Help Korean
"{D885CD8B-343B-271D-85EB-DFE5BE962C0D}" = Catalyst Control Center Localization Norwegian
"{D8CE69B0-9274-4b8c-BA49-0FF6A20A3C65}" = SAMSUNG SYMBIAN USB Download Driver
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DDDA0B2B-674E-A49F-6E31-184F00BDDC85}" = CCC Help Czech
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E2430405-1983-852E-B297-4FF9207E6C16}" = CCC Help German
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E596EC1C-4C61-2457-21B3-EDDA326E8157}" = CCC Help English
"{E64D1146-55AE-61E3-7C43-0DA16C0E4416}" = CCC Help Spanish
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{ED924786-EFE7-392D-F37C-64F4B6E19C2F}" = CCC Help Danish
"{EE174D9D-EF64-9FC7-C900-57C64F02E80D}" = Catalyst Control Center Localization Danish
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{EF71A531-5B6C-4B20-8D1E-E6379C7FB6D3}" = Microsoft IntelliPoint 7.0
"{EFF43C31-5F5A-574E-563C-68190FA13F0C}" = CCC Help Chinese Standard
"{F023B88F-DD32-8C85-F372-5319180597A5}" = Catalyst Control Center Localization Thai
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F2912763-486E-B5D1-D0C6-BD1AE24D0C20}" = Catalyst Control Center Localization Korean
"{F2D65205-A1D0-5B53-4399-8AA39F738D9D}" = CCC Help Norwegian
"{F4ECB8B5-737F-6910-C26F-7DA94A2C0710}" = Catalyst Control Center Localization Finnish
"{F59778FB-4F31-0ADE-84C3-D7D77676A1A5}" = Catalyst Control Center Localization French
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FAAE0782-8073-112D-BC19-12C64A2D90D9}" = Skins
"{FAC15A44-64C7-1908-CC36-83BC9A308EA9}" = Catalyst Control Center Localization German
"{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows-Treiberpaket - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe_2ac78060bc5856b0c1cf873bb919b58" = Adobe Photoshop CS3
"Adobe_acce07fd2c8fe7f9e3f26243e626578" = Adobe Dreamweaver CS4
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Business Contact Manager für Outlook 2007" = Business Contact Manager für Outlook 2007
"CameraWindowDVC6" = Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX
"CameraWindowLauncher" = Canon Utilities CameraWindow
"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX
"Canon MOV Decoder" = Canon MOV Decoder
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"Core FTP LE 2.1" = Core FTP LE 2.1
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DPP" = Canon Utilities Digital Photo Professional 3.6
"E24870CB6AA1C3511635FF9020A3E9471287FBE7" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem (01/26/2008 2.6.0.0)
"EADM" = EA Download Manager
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EOS Utility" = Canon Utilities EOS Utility
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free HD Converter_is1" = Free HD Converter V 1.2
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"ICQToolbar" = ICQ Toolbar
"Inkscape" = Inkscape 0.47
"InstallShield_{4EA8EA5D-8E46-4698-9BF7-2F2AD8E1C185}" = Easy Network Manager 3.0
"InstallShield_{955597D8-E5E1-474D-B647-60AC44566D24}" = Play AVStation
"InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"InstallShield_{FD53302C-8E7B-4730-8AD8-86A889BDBFAB}" = AVStation Now
"Jalbum_0" = Jalbum 8.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MyCamera" = Canon Utilities MyCamera
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picasa 3" = Picasa 3
"Picture Style Editor" = Canon Utilities Picture Style Editor
"RemoteCaptureTask" = Canon Utilities RemoteCapture Task for ZoomBrowser EX
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"SAMSUNG Mobile Modem V2" = SAMSUNG Mobile Modem V2 Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"SystemRequirementsLab" = System Requirements Lab
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"WFTK" = Canon Utilities WFT-E1/E2/E3/E4 Utility
"Winamp" = Winamp
"WinRAR archiver" = WinRAR
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"BitTorrent DNA" = DNA
"Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
"Winamp Detect" = Winamp Erkennungs-Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 09.04.2010 07:54:47 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
0x80.

Error - 09.04.2010 07:54:47 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
0x1.

Error - 09.04.2010 07:54:47 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17826
Description = Aufgrund eines internen Fehlers in einer Netzwerkbibliothek konnte
die Netzwerkbibliothek nicht gestartet werden. Überprüfen Sie zum Bestimmen der
Ursache die diesem Fehler unmittelbar vorhergehenden Fehler im Fehlerprotokoll.

Error - 09.04.2010 07:54:47 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17120
Description = SQL Server konnte den Thread FRunCM nicht erzeugen. Suchen Sie im
SQL Server-Fehlerprotokoll und in den Windows-Ereignisprotokollen nach Informationen
zu möglichen verwandten Problemen.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17190
Description = Fehler beim Initialisieren des FallBack-Zertifikats. Fehlercode: 4.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 26015
Description = Das vom Benutzer angegebene Zertifikat kann nicht geladen werden.
Da die Verbindungsverschlüsselung erforderlich ist, wird vom Server keine Verbindung
akzeptiert. Überprüfen Sie, ob das Zertifikat richtig installiert ist. Lesen Sie
'Konfigurieren eines Zertifikats zur Verwendung durch SSL' in der Onlinedokumentation.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
0x80.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17182
Description = Fehler bei der TDSSNIClient-Initialisierung. Fehler 0x80092004, Statuscode
0x1.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17826
Description = Aufgrund eines internen Fehlers in einer Netzwerkbibliothek konnte
die Netzwerkbibliothek nicht gestartet werden. Überprüfen Sie zum Bestimmen der
Ursache die diesem Fehler unmittelbar vorhergehenden Fehler im Fehlerprotokoll.

Error - 09.04.2010 12:32:15 | Computer Name = Sandra-PC | Source = MSSQL$MSSMLBIZ | ID = 17120
Description = SQL Server konnte den Thread FRunCM nicht erzeugen. Suchen Sie im
SQL Server-Fehlerprotokoll und in den Windows-Ereignisprotokollen nach Informationen
zu möglichen verwandten Problemen.

[ OSession Events ]
Error - 21.08.2008 05:47:35 | Computer Name = Sandra-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 8, Application Name: Microsoft Office Publisher, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4
seconds with 0 seconds of active time. This session ended with a crash.

Error - 14.10.2009 03:38:21 | Computer Name = Sandra-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 6 seconds with 0 seconds of active time. This session ended with a crash.

Error - 14.10.2009 04:29:37 | Computer Name = Sandra-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 15
seconds with 0 seconds of active time. This session ended with a crash.

Error - 15.10.2009 13:07:29 | Computer Name = Sandra-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application
Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session
lasted 5 seconds with 0 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 08.04.2010 15:14:22 | Computer Name = Sandra-PC | Source = Service Control Manager | ID = 7032
Description =

Error - 09.04.2010 00:57:29 | Computer Name = Sandra-PC | Source = HTTP | ID = 15016
Description =

Error - 09.04.2010 00:58:29 | Computer Name = Sandra-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 09.04.2010 00:58:35 | Computer Name = Sandra-PC | Source = DCOM | ID = 10001
Description =

Error - 09.04.2010 07:54:04 | Computer Name = Sandra-PC | Source = HTTP | ID = 15016
Description =

Error - 09.04.2010 07:55:03 | Computer Name = Sandra-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 09.04.2010 07:55:37 | Computer Name = Sandra-PC | Source = DCOM | ID = 10001
Description =

Error - 09.04.2010 12:31:56 | Computer Name = Sandra-PC | Source = HTTP | ID = 15016
Description =

Error - 09.04.2010 12:32:51 | Computer Name = Sandra-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 09.04.2010 12:32:53 | Computer Name = Sandra-PC | Source = DCOM | ID = 10001
Description =


< End of report >

Alt 09.04.2010, 19:56   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
Code:
ATTFilter
:OTL
SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe ()
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
[2009.07.17 10:40:12 | 000,704,512 | ---- | M] (BitComet) -- C:\Programme\Mozilla Firefox\plugins\npBitCometAgent.dll
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe File not found
O9 - Extra Button: ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.1 - {71BFC818-0CED-42D6-9C87-5142918957EE} - C:\Programme\ICQ7.1\ICQ.exe (ICQ, LLC.)
File not found -- C:\Users\Sandra\AppData\Roaming\sdra64 .exe
[2010.04.09 19:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At20.job
[2010.04.09 14:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At15.job
[2010.04.09 08:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At9.job
[2010.04.09 07:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At8.job
[2010.04.08 22:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At23.job
[2010.04.08 21:13:57 | 000,002,869 | ---- | M] () -- C:\Windows\System32\dmlg.dat
[2010.04.08 21:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At22.job
[2010.04.08 20:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At21.job
[2010.04.06 18:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At19.job
[2010.04.05 16:59:59 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At18.job
[2010.04.05 15:59:59 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At17.job
[2010.04.05 15:00:00 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At16.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At7.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At6.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At5.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At4.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At3.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At24.job
[2010.04.05 11:53:47 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At2.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At14.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At13.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At12.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At11.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At10.job
[2010.04.05 11:53:46 | 000,000,384 | ---- | M] () -- C:\Windows\tasks\At1.job
[2010.03.13 21:36:18 | 000,554,496 | ---- | C] () -- C:\Windows\System32\dvmsg.dll
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKCU..\Run: [AdobeBridge] File not found
         
Klick dann auf den Button Run Fixes!
Das Logfile nach dem Fixen müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 09.04.2010, 19:58   #14
Jackie111
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



========== OTL ==========
Service ICQ Service stopped successfully!
Service ICQ Service deleted successfully!
C:\Programme\ICQ6Toolbar\ICQ Service.exe moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
C:\Programme\Mozilla Firefox\plugins\npBitCometAgent.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{71BFC818-0CED-42D6-9C87-5142918957EE}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71BFC818-0CED-42D6-9C87-5142918957EE}\ not found.
C:\Programme\ICQ7.1\ICQ.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{71BFC818-0CED-42D6-9C87-5142918957EE}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{71BFC818-0CED-42D6-9C87-5142918957EE}\ not found.
File C:\Programme\ICQ7.1\ICQ.exe not found.
C:\Windows\Tasks\At20.job moved successfully.
C:\Windows\Tasks\At15.job moved successfully.
C:\Windows\Tasks\At9.job moved successfully.
C:\Windows\Tasks\At8.job moved successfully.
C:\Windows\Tasks\At23.job moved successfully.
C:\Windows\System32\dmlg.dat moved successfully.
C:\Windows\Tasks\At22.job moved successfully.
C:\Windows\Tasks\At21.job moved successfully.
C:\Windows\Tasks\At19.job moved successfully.
C:\Windows\Tasks\At18.job moved successfully.
C:\Windows\Tasks\At17.job moved successfully.
C:\Windows\Tasks\At16.job moved successfully.
C:\Windows\Tasks\At7.job moved successfully.
C:\Windows\Tasks\At6.job moved successfully.
C:\Windows\Tasks\At5.job moved successfully.
C:\Windows\Tasks\At4.job moved successfully.
C:\Windows\Tasks\At3.job moved successfully.
C:\Windows\Tasks\At24.job moved successfully.
C:\Windows\Tasks\At2.job moved successfully.
C:\Windows\Tasks\At14.job moved successfully.
C:\Windows\Tasks\At13.job moved successfully.
C:\Windows\Tasks\At12.job moved successfully.
C:\Windows\Tasks\At11.job moved successfully.
C:\Windows\Tasks\At10.job moved successfully.
C:\Windows\Tasks\At1.job moved successfully.
C:\Windows\System32\dvmsg.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NPSStartup deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AdobeBridge deleted successfully.

OTL by OldTimer - Version 3.2.1.1 log created on 04092010_195709

Alt 09.04.2010, 20:14   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Standard

Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile



Schön
Noch Probleme? Wenn nicht bitte Updates prüfen. Dir fehlt das wichtige Vista-SP2!!

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Antwort

Themen zu Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile
adobe, agere systems, antivir, antivir guard, avg, avira, bho, bonjour, browser, defender, desktop, google, google chrome, hijack, hijackthis, hkus\s-1-5-18, internet, internet explorer, locker, logfile, malwarebytes' anti-malware, nicht öffnen, opera.exe, problem, rundll, software, svchost.exe, system, temp, userinit.exe, verdacht auf virus, virus, virus auf dem pc, windows, öffnet



Ähnliche Themen: Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile


  1. Windows 7: Problem mit tradeadexchange-Virus Google Chrome
    Log-Analyse und Auswertung - 21.10.2015 (11)
  2. Verdacht auf Virus, Internet connecten dauert lange, Viele Dienste starten nicht. Avira sowie Malwarebytes meckern nicht.
    Plagegeister aller Art und deren Bekämpfung - 23.08.2014 (1)
  3. LogFile MalwareBytes, Problem: "Search Assistant"
    Log-Analyse und Auswertung - 17.02.2014 (11)
  4. Problem: Facebook Virus mit Chrome!
    Plagegeister aller Art und deren Bekämpfung - 15.04.2013 (8)
  5. SVCHOST.exe problem und verdacht auf virus
    Plagegeister aller Art und deren Bekämpfung - 25.01.2013 (1)
  6. OTL logfile auswerten verdacht auf virus
    Log-Analyse und Auswertung - 26.10.2012 (3)
  7. Logfile Malwarebytes - Virus TR/Hiloti.D.1069 ?
    Log-Analyse und Auswertung - 14.08.2012 (12)
  8. HiJack This Logfile Post; evtl. Virus?
    Log-Analyse und Auswertung - 06.12.2010 (24)
  9. Mein Hijack Logfile - MSN Link Virus
    Log-Analyse und Auswertung - 26.07.2010 (1)
  10. Logfile wegen Verdacht auf Virus/Trojaner
    Log-Analyse und Auswertung - 03.07.2010 (7)
  11. HiJack Logfile - Habe ich noch einen Virus auf meinem PC?
    Log-Analyse und Auswertung - 10.05.2010 (3)
  12. HijackThis Logfile Auswertung, Verdacht auf Virus:Antivirenprogramm wurde deaktiviert
    Log-Analyse und Auswertung - 18.02.2010 (1)
  13. bitte um Logfile Prüfung - Virus Verdacht
    Log-Analyse und Auswertung - 11.12.2009 (10)
  14. Hijack-Logfile (Rootkit-Verdacht unter Vista)
    Log-Analyse und Auswertung - 02.07.2008 (0)
  15. Hijack this Logfile Auswertung-Problem beim googlen, Umleitung via maxifiles
    Log-Analyse und Auswertung - 22.04.2007 (50)
  16. Se.dll Problem! Bitte Hilfe mit Hijack Logfile
    Log-Analyse und Auswertung - 28.02.2005 (1)
  17. Hijack This Logfile dr/180solutions Problem. Danke im Voraus!
    Log-Analyse und Auswertung - 27.01.2005 (3)

Zum Thema Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile - Hallo, ich habe seid längerer Zeit ein Problem mit meinem PC. Ich habe Google Chrome Installiert und kann es nicht öffnen, also immer wenn ich Chrome öffnen will öffnet sich - Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile...
Archiv
Du betrachtest: Chrome Problem, Verdacht auf Virus auf dem PC! Hijack+Malwarebytes logfile auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.