Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Internet Explorer öffnet automatisch Werbung

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 12.12.2010, 13:32   #1
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Hallo.
Seit einigen Tagen öffnet sich alle paar Minuten ein Internet Explorer mit Werbung (ich benutze aber Firefox als Standartbrowser). Ich habe hier schon verschiedenes über das selbe Problem gelesen, aber man soll ja immer einen neuen Thread aufmachen...
Mein Virenprogramm (Avira AntiVir Free 10) hat nichts gefunden, es kann allerdings sein, dass ich mir das Ding ausversehen "absichtlich" installiert habe.
Ich benutze Windows 7 64Bit, und das hat HijackThis ausgspuckt:

Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 13:23:39, on 12.12.2010
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe
C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe
C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe
C:\Program Files (x86)\FeedDemon\FeedDemon.exe
C:\Program Files (x86)\Pidgin\pidgin.exe
C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Users\Christoph\AppData\Local\Temp\Rnv.exe
C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von ARLT Computer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O2 - BHO: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Lexmark  - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [FeedDemon] "C:\Program Files (x86)\FeedDemon\FeedDemon.exe" /startminimized
O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ6.5\ICQ.exe" silent
O4 - HKCU\..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe
O4 - HKCU\..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O8 - Extra context menu item: Add to &Evernote - res://C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll/2000
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: lxebCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe
O23 - Service: lxeb_device -   - C:\Windows\system32\lxebcoms.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: Druckwarteschlange (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: TabletServicePen - Unknown owner - C:\Windows\system32\Pen_Tablet.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: WTouch Service (WTouchService) - Wacom Technology, Corp. - C:\Program Files\WTouch\WTouchService.exe

--
End of file - 10904 bytes
         
Ich hoffe ihr könnt mir helfen!

Craep

P.S.:
In meiner Hosts Datei steht unter anderem folgendes:
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 atwola.com

Vielleicht hat das etwas damit zu tun...

Ach ja, außerdem werd ich, wenn ich ein Video im Vollbild Modus angucke (egal ob mit VLC oder auf YouTube) ca. alle 20 Sekunden "rausgeworfen" und wenn ich auch Websites in ein Textfeld schreibe (wie jetz) wird der Fokus vom Textfeld genommen...

Geändert von craep (12.12.2010 um 13:40 Uhr)

Alt 12.12.2010, 13:39   #2
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



1. nimm keinerlei reinigung selbstständig vor, sonst ist das nur störend.
2. reiche alle evtl vorhandenen scan logs nach. ootl:
3.
Systemscan mit OTL
download otl:
http://filepony.de/download-otl/

Doppelklick auf die OTL.exe
(user von Windows 7 und Vista: Rechtsklick als Administrator ausführen)
1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
2. Hake an "scan all users"
3. Unter "Extra Registry wähle:
"Use Safelist" "LOP Check" "Purity Check"
4. Kopiere in die Textbox:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
5. Klicke "Scan"
6. 2 reporte werden erstellt:
OTL.Txt
Extras.Txt
__________________

__________________

Alt 12.12.2010, 14:07   #3
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



ICh hab den Scan ausversehen nur von einm Adminkonto aus gemacht, nicht ausdrücklich als Admin gestartet, ich hoffe das macht nichts aus, falls doch mach ich natürlich noch einen!

OTL:
Code:
ATTFilter
OTL logfile created on: 12.12.2010 13:51:25 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Christoph\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS
Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe ()
PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community)
PRC - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe ()
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe ()
PRC - C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (lxeb_device) -- C:\Windows\SysNative\lxebcoms.exe ( )
SRV:64bit: - (lxebCATSCustConnectService) -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxebserv.exe ()
SRV:64bit: - (TabletServicePen) -- C:\Windows\SysNative\Pen_Tablet.exe (Wacom Technology, Corp.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (lxeb_device) -- C:\Windows\SysWow64\lxebcoms.exe ( )
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (WTouchService) -- C:\Programme\WTouch\WTouchService.exe (Wacom Technology, Corp.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.)
SRV - (MSSQL$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (VMnetAdapter) -- C:\Windows\SysNative\DRIVERS\vmnetadapter.sys File not found
DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\Drivers\TFsExDisk.sys File not found
DRV:64bit: - (nmserial) -- C:\Windows\SysNative\DRIVERS\nmserial.sys File not found
DRV:64bit: - (NmPar) -- C:\Windows\SysNative\DRIVERS\NmPar.sys File not found
DRV:64bit: - (limsgt) -- C:\Windows\SysNative\DRIVERS\limsgt.sys File not found
DRV:64bit: - (athsgt) -- C:\Windows\SysNative\DRIVERS\athsgt.sys File not found
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Sun Microsystems, Inc.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation)
DRV:64bit: - (RT73) -- C:\Windows\SysNative\drivers\rt73.sys (Ralink Technology, Corp.)
DRV:64bit: - (nvamacpi) -- C:\Windows\SysNative\drivers\nvamacpi.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology)
DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys ()
DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology)
DRV:64bit: - (ahcix64s) -- C:\Windows\SysNative\drivers\ahcix64s.sys (AMD Technologies Inc.)
DRV:64bit: - (PciIsaSerial) -- C:\Windows\SysNative\drivers\PciIsaSerial.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (PciPPorts) -- C:\Windows\SysNative\drivers\PciPPorts.sys ()
DRV:64bit: - (PciSPorts) -- C:\Windows\SysNative\drivers\PciSPorts.sys ()
DRV:64bit: - (SPorts) -- C:\Windows\SysNative\drivers\SPorts.sys ()
DRV:64bit: - (PPorts) -- C:\Windows\SysNative\drivers\PPorts.sys ()
DRV:64bit: - (ISASerial) -- C:\Windows\SysNative\drivers\ISASerial.sys (Windows (R) Codename Longhorn DDK provider)
DRV:64bit: - (amdide64) -- C:\Windows\SysNative\drivers\amdide64.sys (Advanced Micro Devices)
DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia)
DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology)
DRV:64bit: - (WacomVKHid) -- C:\Windows\SysNative\drivers\WacomVKHid.sys (Wacom Technology)
DRV:64bit: - (SynasUSB) -- C:\Windows\SysNative\drivers\synUSB64.sys (SIA Syncrosoft)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc)
DRV - (athsgt) -- C:\Windows\SysWOW64\drivers\athsgt.sys ()
DRV - (limsgt) -- C:\Windows\SysWOW64\drivers\limsgt.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 25 5A 5A 33 96 CA 01  [binary data]
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.de/search?q="
FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.wisedock.de/m.php?id=3864ae9136fc9f501194544ec2372e288d51"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2
FF - prefs.js..extensions.enabledItems: apptabs@frankyan.com:0.6.2
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:2.23b2
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.0
FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.11
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3
FF - prefs.js..extensions.enabledItems: StrataBuddy@ReduxTeam:0.6.2
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11
FF - prefs.js..extensions.enabledItems: tabprogressbar@studio17.wordpress.com:0.6
FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8
FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3
FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.5.17s
FF - prefs.js..extensions.enabledItems: yawr@sdx.hu:1.21
FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602
FF - prefs.js..extensions.enabledItems: pastebin.com@gmail.com:2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.2.2
FF - prefs.js..extensions.enabledItems: firegestures@xuldev.org:1.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: https-everywhere@eff.org:0.9.2
FF - prefs.js..extensions.enabledItems: Strata40@SpewBoy.au:0.6.2
FF - prefs.js..extensions.enabledItems: chromifox@altmusictv.com:3.6.5
FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?q="
FF - prefs.js..network.proxy.backup.ftp: "193.174.155.26"
FF - prefs.js..network.proxy.backup.ftp_port: 3124
FF - prefs.js..network.proxy.backup.gopher: "193.174.155.26"
FF - prefs.js..network.proxy.backup.gopher_port: 3124
FF - prefs.js..network.proxy.backup.socks: "193.174.155.26"
FF - prefs.js..network.proxy.backup.socks_port: 3124
FF - prefs.js..network.proxy.backup.ssl: "193.174.155.26"
FF - prefs.js..network.proxy.backup.ssl_port: 3124
FF - prefs.js..network.proxy.ftp: "193.174.155.26"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "193.174.155.26"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.http: "193.174.155.26"
FF - prefs.js..network.proxy.http_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "193.174.155.26"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "193.174.155.26"
FF - prefs.js..network.proxy.ssl_port: 3124
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.08.01 14:13:28 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.12 13:24:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 10:13:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.10.28 14:40:30 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\xulapp@opencube.com
[2010.12.12 13:26:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions
[2010.12.11 11:42:05 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.12.12 13:08:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions
[2010.03.26 12:42:16 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
[2010.11.09 19:05:27 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010.01.21 19:35:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41}
[2010.01.02 21:00:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{24d1fe20-76df-11de-8a39-0800200c9a66}
[2010.08.20 21:17:15 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010.09.11 15:27:12 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
[2010.11.12 23:47:50 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2010.01.02 19:01:10 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
[2010.12.10 22:34:59 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.07.30 11:30:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
[2010.10.26 19:39:34 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
[2010.04.10 10:54:59 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2010.01.21 19:08:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com
[2010.09.21 20:48:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com
[2010.03.11 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com
[2010.07.20 17:16:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us
[2010.11.30 17:43:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com
[2010.12.02 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org
[2010.11.26 22:59:33 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org
[2010.08.22 22:15:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com
[2010.12.04 11:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen
[2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au
[2010.04.15 19:26:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam
[2010.01.21 19:35:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com
[2010.04.04 22:26:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu
[2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au\chrome\mozapps\extensions
[2010.10.13 19:28:25 | 000,001,998 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\grooveshark.xml
[2010.10.13 19:29:01 | 000,001,330 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wikipedia-en.xml
[2010.11.21 21:20:25 | 000,001,334 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wiktionary-de.xml
[2010.10.13 19:24:01 | 000,004,140 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\youtube.xml
[2010.11.15 14:15:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.08.23 12:05:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.15 14:15:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.03.27 17:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npContribute.dll
[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2009.10.26 15:53:52 | 000,102,400 | ---- | M] (Zylom) -- C:\Program Files (x86)\mozilla firefox\plugins\npzylomgamesplayer.dll
[2010.10.24 12:35:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.10.24 12:35:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.10.24 12:35:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.10.24 12:35:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.10.24 12:35:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.08.02 11:47:25 | 000,001,028 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 im.adtech.de
O1 - Hosts: 127.0.0.1 adserver.adtech.de
O1 - Hosts: 127.0.0.1 adtech.de
O1 - Hosts: 127.0.0.1 atwola.com
O1 - Hosts: 127.0.0.1 adserver.71i.de
O1 - Hosts: 127.0.0.1 adicqserver.71i.de
O1 - Hosts: 127.0.0.1 71i.de
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll ()
O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe ()
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [lxebmon.exe] C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe ()
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [FeedDemon] C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.)
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ6.5\ICQ.exe File not found
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1
O8:64bit: - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O8 - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\WB: DllName - Reg Error: Key error. - C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
 
MsConfig:64bit - StartUpReg: AdobeCS5ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Bamboo Dock - hkey= - key= - C:\Program Files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe ()
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.)
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L)
Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/)
Drivers32: VIDC.CFHD - C:\Windows\SysWow64\cfhd.dll (CineForm Inc.)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L)
Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll ()
Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.12 13:50:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe
[2010.12.12 13:19:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HiJackThis
[2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.11.27 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.11.26 23:31:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MockFlow
[2010.11.26 22:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\WorldWindData
[2010.11.23 15:12:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\sun
[2010.11.16 18:45:38 | 000,836,608 | ---- | C] ( ) -- C:\Windows\SysNative\lxebcoin.dll
[2010.11.15 14:15:48 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.11.14 20:19:23 | 000,905,728 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\synsoacc.dll
[2010.11.14 20:19:16 | 000,031,248 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\drivers\synUSB64.sys
[2010.11.14 20:19:15 | 000,045,056 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\Synsopos.exe
[2010.11.14 20:19:13 | 000,401,462 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\temp.000
[2010.11.14 20:19:08 | 000,757,760 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SYNSOACC.dll
[2010.11.14 20:19:08 | 000,147,456 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SynsoLChk.dll
[2010.11.14 20:19:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Syncrosoft
[2010.11.14 20:16:27 | 000,000,000 | ---D | C] -- C:\Install
[2010.11.13 18:17:27 | 000,000,000 | ---D | C] -- C:\Programme\Blender
[2010.06.01 17:23:13 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebinpa.dll
[2010.06.01 17:23:12 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebiesc.dll
[2010.06.01 17:23:11 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebpmui.dll
[2010.06.01 17:23:10 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebserv.dll
[2010.06.01 17:23:10 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebusb1.dll
[2010.06.01 17:23:10 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeblmpm.dll
[2010.06.01 17:23:09 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebhbn3.dll
[2010.06.01 17:23:08 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomc.dll
[2010.06.01 17:23:08 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomm.dll
[4 C:\Windows\Fonts\*.tmp files -> C:\Windows\Fonts\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.12 13:50:15 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe
[2010.12.12 13:48:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:19:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.12.12 12:56:07 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010.12.12 12:55:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.12.12 12:55:21 | 3214,237,696 | -HS- | M] () -- C:\hiberfil.sys
[2010.12.11 19:00:38 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job
[2010.12.09 22:03:24 | 000,001,239 | ---- | M] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk
[2010.12.09 20:07:19 | 001,550,914 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.12.09 20:07:19 | 000,671,758 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.12.09 20:07:19 | 000,633,640 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.12.09 20:07:19 | 000,137,484 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.12.09 20:07:19 | 000,113,874 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.12.08 14:51:41 | 007,413,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.12.03 23:53:29 | 000,005,990 | ---- | M] () -- C:\Users\Christoph\.recently-used.xbel
[2010.11.26 23:31:04 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\MockFlow.lnk
[2010.11.22 14:17:01 | 000,083,120 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.11.16 18:46:50 | 000,226,478 | ---- | M] () -- C:\Windows\SysNative\LexFiles.ulf
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.10 22:40:53 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.10 22:40:49 | 000,000,302 | -H-- | C] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.10 22:40:46 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.09 22:03:24 | 000,001,239 | ---- | C] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk
[2010.12.03 23:53:29 | 000,005,990 | ---- | C] () -- C:\Users\Christoph\.recently-used.xbel
[2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\lxebsmr.dll
[2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysNative\lxebsmr.dll
[2010.11.16 18:45:37 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\lxebins.dll
[2010.11.16 18:45:37 | 000,399,360 | ---- | C] () -- C:\Windows\SysNative\lxebcui.dll
[2010.11.16 18:45:37 | 000,378,368 | ---- | C] () -- C:\Windows\SysNative\lxebcu.dll
[2010.11.16 18:45:37 | 000,245,248 | ---- | C] () -- C:\Windows\SysNative\lxebinsb.dll
[2010.11.16 18:45:37 | 000,148,480 | ---- | C] () -- C:\Windows\SysNative\lxebcuir.dll
[2010.11.16 18:45:37 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\lxebgcfg.dll
[2010.11.14 20:19:23 | 000,147,425 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Aide.chm
[2010.11.14 20:19:23 | 000,120,468 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Hilfe.chm
[2010.11.14 20:19:23 | 000,114,279 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Help.chm
[2010.11.14 20:19:22 | 000,147,425 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Aide.chm
[2010.11.14 20:19:22 | 000,120,468 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Hilfe.chm
[2010.11.14 20:19:22 | 000,114,279 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Help.chm
[2010.10.31 18:42:32 | 000,000,016 | ---- | C] () -- C:\Windows\SysWow64\msvcsv60.dll
[2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\LxWbGwLog.log
[2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\cmn_upld.log
[2010.07.18 19:09:49 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.07.18 19:09:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.06.24 15:58:17 | 001,508,283 | ---- | C] () -- C:\Program Files (x86)\Euthymia Electronic Organ V2.dll
[2010.06.19 14:20:18 | 000,013,256 | ---- | C] () -- C:\ProgramData\lxebJSW.log
[2010.06.01 22:48:18 | 000,000,000 | ---- | C] () -- C:\Users\Christoph\AppData\Local\eab2d51e-4aba-4bfa-b171-72e2c2a32088
[2010.06.01 17:47:11 | 000,000,675 | ---- | C] () -- C:\ProgramData\lxebDiagnostics.log
[2010.06.01 17:28:38 | 000,000,252 | ---- | C] () -- C:\ProgramData\FastPics.log
[2010.06.01 17:27:23 | 000,000,394 | ---- | C] () -- C:\ProgramData\lxeb.log
[2010.06.01 17:25:02 | 000,026,813 | ---- | C] () -- C:\ProgramData\lxebscan.log
[2010.06.01 17:23:13 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxebcomx.dll
[2010.06.01 17:23:13 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEBinst.dll
[2010.06.01 17:23:12 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxebinsr.dll
[2010.06.01 17:23:12 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxebjswr.dll
[2010.06.01 17:23:11 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxebins.dll
[2010.06.01 17:23:11 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxebinsb.dll
[2010.06.01 17:23:11 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxebcur.dll
[2010.06.01 17:23:10 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxebcu.dll
[2010.06.01 17:23:10 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxebcub.dll
[2010.06.01 17:22:32 | 000,000,000 | ---- | C] () -- C:\ProgramData\UpdaterLog.txt
[2010.06.01 17:22:21 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEBsm.dll
[2010.05.05 14:04:09 | 000,000,031 | ---- | C] () -- C:\Windows\SysWow64\m12vt4osini.dll
[2010.04.27 20:49:19 | 000,007,597 | ---- | C] () -- C:\Users\Christoph\AppData\Local\resmon.resmoncfg
[2010.04.18 21:47:31 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\NSREG.DLL
[2010.04.09 18:48:18 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI
[2010.03.15 11:53:09 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.02.04 21:30:19 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll
[2010.02.04 21:30:19 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll
[2010.02.04 21:30:18 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll
[2010.02.03 19:10:53 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.01.03 11:08:43 | 000,000,031 | ---- | C] () -- C:\Windows\iexplore.ini
[2009.12.30 19:32:27 | 000,164,992 | ---- | C] () -- C:\Windows\SysWow64\drivers\athsgt.sys
[2009.12.30 19:32:27 | 000,012,544 | ---- | C] () -- C:\Windows\SysWow64\drivers\limsgt.sys
[2009.12.29 18:12:31 | 001,551,964 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys
[2006.12.08 13:58:14 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\FxShared.dll
[2006.12.08 02:52:50 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\com.fxpansion.fxshared.dll
[1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80
[1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\4C3B2B99-ECAA-4D9D-B9D5-9F7442A71C71
 
========== LOP Check ==========
 
[2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft
[2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple
[2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design
[2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft
[2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems
[2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org
[2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore
[2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe
[2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation
[2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc
[2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge
[2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH
[2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage
[2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer
[2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1
[2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design
[2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot
[2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org
[2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org
[2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000
[2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo
[2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg
[2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0
[2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore
[2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn
[2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape
[2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host
[2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy
[2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts
[2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX
[2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad
[2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow
[2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag
[2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound
[2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World
[2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++
[2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc
[2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org
[2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera
[2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy
[2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite
[2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer
[2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst
[2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers
[2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung
[2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM
[2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra
[2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel
[2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony
[2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird
[2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian
[2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt
[2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software
[2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft
[2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent
[2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft
[2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom
[2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5
[2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D
[2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch
[2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode
[2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom
[2010.02.10 21:04:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\TuneUp Software
[2010.02.10 21:02:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\WTouch
[2010.09.15 12:36:12 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft
[2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple
[2010.11.26 23:24:47 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Adobe
[2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design
[2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft
[2010.01.15 23:34:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Apple Computer
[2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems
[2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org
[2010.03.25 18:22:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Avira
[2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore
[2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe
[2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation
[2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc
[2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge
[2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH
[2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage
[2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer
[2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1
[2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design
[2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot
[2010.07.11 14:42:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\DivX
[2010.12.04 20:43:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\dvdcss
[2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org
[2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org
[2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000
[2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo
[2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg
[2010.03.21 14:30:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Google
[2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0
[2010.09.14 19:55:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hamachi
[2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Identities
[2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn
[2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape
[2010.01.02 18:29:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\InstallShield
[2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host
[2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy
[2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts
[2010.02.10 14:07:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Macromedia
[2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX
[2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad
[2009.07.14 19:18:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Media Center Programs
[2010.10.17 18:54:29 | 000,000,000 | --SD | M] -- C:\Users\Christoph\AppData\Roaming\Microsoft
[2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow
[2010.01.02 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mozilla
[2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag
[2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound
[2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World
[2010.01.06 22:01:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Nero
[2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++
[2010.08.26 21:37:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NVIDIA
[2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc
[2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org
[2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera
[2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy
[2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite
[2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer
[2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst
[2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers
[2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1
[2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung
[2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM
[2010.06.25 16:07:48 | 000,000,000 | RH-D | M] -- C:\Users\Christoph\AppData\Roaming\SecuROM
[2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra
[2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel
[2010.12.02 19:21:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Skype
[2010.06.17 17:23:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\skypePM
[2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony
[2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds
[2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird
[2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian
[2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3
[2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt
[2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software
[2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft
[2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent
[2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft
[2010.12.11 19:09:57 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\vlc
[2010.03.02 19:24:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\VMware
[2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom
[2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5
[2010.12.02 21:32:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Winamp
[2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D
[2010.02.13 14:35:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WinRAR
[2010.12.12 12:56:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTablet
[2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch
[2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode
[2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems
[2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom
 
< %APPDATA%\*.exe /s >
[2010.11.02 12:38:36 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Christoph\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.08.01 14:09:12 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe
[2010.01.03 15:55:40 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe
[2010.01.03 15:55:40 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe
[2010.12.12 13:19:48 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
[2010.01.04 14:12:35 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}\ARPPRODUCTICON.exe
[2010.08.19 22:46:28 | 001,312,120 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe
[2010.09.26 15:44:24 | 089,280,248 | ---- | M] (Samsung Electronics Co., Ltd.                                ) -- C:\Users\Christoph\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2009.12.19 23:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\Christoph\Christoph\Produktionen\Webdesign\In Bearbeitung\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll
 
< MD5 for: EXPLORER.EXE  >
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe
[2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys
[2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastor.inf_amd64_neutral_c065a1006c648409\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll
[2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:DD4DD9B9

< End of report >
         


Extras:
Code:
ATTFilter
OTL Extras logfile created on: 12.12.2010 13:51:25 - Run 1
OTL by OldTimer - Version 3.2.17.3     Folder = C:\Users\Christoph\Desktop
64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS
Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
 
Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}" = GEAR driver installer for AMD64 and Intel EM64T
"{563F041C-DFDB-437B-A1E8-E141E0906076}" = Microsoft IntelliPoint 8.0
"{6BED4DFE-C527-463E-B93A-6F6848B74DD0}" = Native Instruments Battery 3
"{70AC9B8B-5DC4-4E5E-964B-2A695D157FCB}" = Sun VirtualBox
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"BC15EA930074932BB2C4B4493C9FD4EA95087D1A" = Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1159
"CCleaner" = CCleaner
"Lexmark Pro200-S500 Series" = Lexmark Pro200-S500 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"UDK-253020cb-36fa-46d8-b003-ff05a0f0d427" = Unreal Development Kit: 2010-01
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0341796A-9224-48FB-AAE1-4079C7AE375E}" = DDXRenderer
"{03534DA5-2F88-4B8E-A978-849B979E1B8F}" = TuxGuitar
"{03DEAAE3-8668-70F6-8E11-2FE466B63806}" = MockFlow Desktop
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{08581E23-EC5B-4AEC-8DB9-F186D751129F}" = Bamboo Scribe Shared Files
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F4B91C5-4524-02A6-1D9B-5AE52CE2E0F4}" = Bamboo Dock
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{10812DE7-2E57-4740-B226-6B3BE34AF9D7}" = Lexmark Tools for Office
"{15A60757-91A9-8875-17C4-7E5C4A7E17AF}" = Livebrush Mini
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1AC38EA5-454C-4443-834F-6B34106581E1}" = Sony DVD Architect 4.0
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2B7E4354-0492-460A-BDB1-1F59EE141025}" = AirPlus XtremeG DWL-G122
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{3763A2B4-B07A-4E4D-994D-7D2C6AF0CF9E}" = Safari
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5
"{45873324-094C-4516-A84A-134A175A1CD6}" = PDFExport
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5
"{47CC1AED-3A94-47FC-AE9D-902C55B1AE7D}" = Microsoft® Office-Add-In for Moodle
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{548CDAD3-9144-4B04-977C-30CAB4838976}" = Grip points
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57E7F262-3B6A-403E-81C2-E9D2B196D00C}" = DDXSheetSets
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6559654F-2F38-491F-8411-211517C3E635}" = SampleTank FREE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7BD0D8F8-A13C-48D2-B201-4AD29A48AF34}" = Google SketchUp 7
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{88871882-f889-4732-b8dc-87f31cdcde40}" = Nero 9 Essentials
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92377672-DF6E-4D7C-AFFC-50B01254C488}" = DDXViewX
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{96965E6C-41DB-4E0A-BC65-D92381D51D2A}" = Sony Vegas 7.0
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}" = Tycoon City - New York
"{A7385936-7917-4210-9471-ECDF300D1D02}" = DWGdirectX Core
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A837BCE6-BCB1-4A44-8807-A678EAF06933}" = ANNO 1404 Entwickler-Tools
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{B9BD670E-E9BF-494A-9843-F20C13EE8C4C}" = ArtRage 2
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C51496B3-E15E-41D8-B812-9492E4EC86E0}" = DDX DWF Support
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{C9E129BC-27D3-436E-BAAC-4CE81E0962F1}" = Sony Media Manager 2.2
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CD7DB485-A1D7-4FA5-B66B-587CFF6CA361}" = DDX Field Evaluator
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark 
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EC9A0711-9823-4DD2-83C4-039886A3ECF6}" = Melodyne 3.2 Demo
"{EC9F368A-79DC-4AAE-907A-FC02D512034E}" = RippMe
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{FB8148DD-C575-4B0A-9F6C-0CFC46937930}" = Opera 10.10
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Afterburner" = MSI Afterburner 1.0.0
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Bamboo Dock" = Bamboo Dock 3.3
"Bamboo Explore" = Bamboo Explore
"Bamboo Scribe_is1" = Bamboo Scribe
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1" = Livebrush Mini
"DivX Setup.divx.com" = DivX-Setup
"DVD Shrink_is1" = DVD Shrink 3.2
"Edirol HQ Orchestral VSTi v1.03" = Edirol HQ Orchestral VSTi v1.03
"ENTERPRISER" = Microsoft Office Enterprise 2007
"FeedDemon_is1" = FeedDemon
"FL Studio 9" = FL Studio 9
"foobar2000" = foobar2000 v1.0.1
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"GameSpy Arcade" = GameSpy Arcade
"GnuPG" = GNU Privacy Guard
"GPL Ghostscript 8.64" = GPL Ghostscript 8.64
"Grand Theft Auto" = Grand Theft Auto
"Hamachi" = Hamachi 1.0.1.5
"Hardcore" = Hardcore
"iecollection_is1" = Internet Explorer Collection 1.6.0.4
"IETester" = IETester v0.4.4 (remove only)
"IL Download Manager" = IL Download Manager
"ImgBurn" = ImgBurn
"Inkscape" = Inkscape 0.47
"LeechFTP" = LeechFTP 
"LMMS 0.4.6" = Linux MultiMedia Studio (LMMS)
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"MockFlow" = MockFlow Desktop
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"Mp3tag" = Mp3tag v2.45a
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Native Instruments Absynth 4" = Native Instruments Absynth 4
"Native Instruments Battery 3" = Native Instruments Battery 3
"Native Instruments FM8" = Native Instruments FM8
"Native Instruments Massive" = Native Instruments Massive
"Native Instruments Pro-53" = Native Instruments Pro-53
"Native Instruments Service Center" = Native Instruments Service Center
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Pen Tablet Driver" = Bamboo
"Pidgin" = Pidgin
"PoiZone" = PoiZone
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"Sakura" = Sakura
"Sawer" = Sawer
"Scribus 1.3.3.13" = Scribus 1.3.3.13
"ScummVM_is1" = ScummVM 1.0.0
"Sigel Professional Label Software SE" = Sigel Professional Label Software SE
"Sonik Synth 2 Free" = Sonik Synth 2 Free
"Steam App 23490" = Tropico 3 - Steam Special Edition
"Steam App 32360" = The Secret of Monkey Island: Special Edition
"Steam App 32460" = Monkey Island 2: Special Edition
"Steam App 37600" = Windosill
"Steam App 410" = Portal: The First Slice
"Steam App 57600" = Tropico 3: Absolute Power
"Steam App 630" = Alien Swarm
"Steam App 640" = Alien Swarm - SDK
"Syncrosoft License Control" = Syncrosoft Lizenz Kontrolle
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.1
"Toxic Biohazard" = Toxic Biohazard
"TrueCrypt" = TrueCrypt
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.5
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.10
"Wings 3D 1.0.1" = Wings 3D 1.0.1
"XMedia Recode" = XMedia Recode 2.2.7.7
"Xvid_is1" = Xvid 1.2.2 final uninstall
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dexpot" = Dexpot
"Google Chrome" = Google Chrome
"NCsoft-Exteel" = Exteel (US)
"Winamp Detect" = Winamp Anwendungserkennung
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 11.12.2010 10:40:45 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9001
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10015
 
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10015
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11014
 
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11014
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 12012
 
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12012
 
[ Media Center Events ]
Error - 03.02.2010 06:07:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:17 - Fehler beim Herstellen der Internetverbindung.  11:07:17 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 03.02.2010 06:07:26 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:22 - Fehler beim Herstellen der Internetverbindung.  11:07:22 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 07:35:09 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:08 - Fehler beim Herstellen der Internetverbindung.  13:35:09 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 07:35:31 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:15 - Fehler beim Herstellen der Internetverbindung.  13:35:15 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 08:35:37 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:37 - Fehler beim Herstellen der Internetverbindung.  14:35:37 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 08:35:43 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:42 - Fehler beim Herstellen der Internetverbindung.  14:35:42 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 09:43:58 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:43:57 - Fehler beim Herstellen der Internetverbindung.  15:43:57 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 01.10.2010 09:44:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:44:03 - Fehler beim Herstellen der Internetverbindung.  15:44:03 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.10.2010 22:31:45 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:31:45 - Fehler beim Herstellen der Internetverbindung.  04:31:45 
-     Serververbindung konnte nicht hergestellt werden..  
 
Error - 04.10.2010 22:32:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:32:14 - Fehler beim Herstellen der Internetverbindung.  04:32:14 
-     Serververbindung konnte nicht hergestellt werden..  
 
[ OSession Events ]
Error - 25.05.2010 06:14:44 | Computer Name = Christoph-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 55
 seconds with 0 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 11.12.2010 07:21:00 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description = 
 
Error - 11.12.2010 07:28:57 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description = 
 
Error - 11.12.2010 07:52:58 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description = 
 
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\athsgt.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "athsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1275
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\limsgt.sys
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "limsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
   %%1275
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 lxebCATSCustConnectService erreicht.
 
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lxebCATSCustConnectService" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
Error - 12.12.2010 07:56:47 | Computer Name = Christoph-PC | Source = DCOM | ID = 10016
Description = 
 
 
< End of report >
         
__________________

Alt 12.12.2010, 14:44   #4
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe ()
PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe ()
O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe ()
[2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job

:Files
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.


öffne mein computer, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.12.2010, 15:02   #5
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Code:
ATTFilter
All processes killed
========== OTL ==========
No active process named Rnx.exe was found!
No active process named Rnv.exe was found!
No active process named Rnw.exe was found!
Registry value HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Run\\JP595IR86O deleted successfully.
C:\Users\Christoph\AppData\Local\Temp\Rnv.exe moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg\de_DE folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#ApplicationUpdater folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job moved successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job moved successfully.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job moved successfully.
========== FILES ==========
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: All Users
 
User: Christoph
->Flash cache emptied: 60817 bytes
 
User: Default
->Flash cache emptied: 56502 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Mit Gästen
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
[EMPTYTEMP]
 
User: All Users
 
User: Christoph
->Temp folder emptied: 178073082 bytes
->Temporary Internet Files folder emptied: 86746521 bytes
->Java cache emptied: 38798320 bytes
->FireFox cache emptied: 105115126 bytes
->Google Chrome cache emptied: 12916663 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 1787727 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Mit Gästen
->Temp folder emptied: 32799 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 36168 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 701976 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 1844458 bytes
 
Total Files Cleaned = 407,00 mb
 
 
OTL by OldTimer - Version 3.2.17.3 log created on 12122010_145442

Files\Folders moved on Reboot...
C:\Users\Christoph\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\TMP00000554C0B6FC6017459710 moved successfully.

Registry entries deleted on Reboot...
         

Die Moved Files Datei ist hochgeladen als movedfiles.rar_1 oder so ähnlich.


Alt 12.12.2010, 15:06   #6
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



wunderbar.
pc neustarten.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________
--> Internet Explorer öffnet automatisch Werbung

Alt 12.12.2010, 15:31   #7
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Code:
ATTFilter
ComboFix 10-12-11.06 - Christoph 12.12.2010  15:21:23.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.4087.2776 [GMT 1:00]
ausgeführt von:: c:\users\Christoph\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe
c:\program files\Blender
c:\program files\Blender\.blender\.bfont.ttf
c:\program files\Blender\.blender\.Blanguages
c:\program files\Blender\.blender\Bpymenus
c:\program files\Blender\.blender\locale\ar\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\bg\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ca\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\cs\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\de\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\el\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\es\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fi\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr_HR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\it\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ja\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ko\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\nl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pt_BR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ro\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ru\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr@Latn\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sv\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\uk\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\zh_CN\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\scripts\3ds_export.py
c:\program files\Blender\.blender\scripts\3ds_import.py
c:\program files\Blender\.blender\scripts\ac3d_export.py
c:\program files\Blender\.blender\scripts\ac3d_import.py
c:\program files\Blender\.blender\scripts\add_mesh_empty.py
c:\program files\Blender\.blender\scripts\add_mesh_torus.py
c:\program files\Blender\.blender\scripts\animation_bake_constraints.py
c:\program files\Blender\.blender\scripts\animation_clean.py
c:\program files\Blender\.blender\scripts\animation_trajectory.py
c:\program files\Blender\.blender\scripts\armature_symmetry.py
c:\program files\Blender\.blender\scripts\Axiscopy.py
c:\program files\Blender\.blender\scripts\bevel_center.py
c:\program files\Blender\.blender\scripts\blenderLipSynchro.py
c:\program files\Blender\.blender\scripts\bpydata\config\readme.txt
c:\program files\Blender\.blender\scripts\bpydata\KUlang.txt
c:\program files\Blender\.blender\scripts\bpydata\readme.txt
c:\program files\Blender\.blender\scripts\bpymodules\blend2renderinfo.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyAddMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyArmature.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyBlender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyCurve.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyImage.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMathutils.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh_redux.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMessages.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyNMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyObject.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRegistry.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPySys.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyTextPlugin.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyWindow.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\__init__.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\collada.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cstartup.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cutils.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\helperObjects.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\logo.png
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\translator.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\xmlUtils.py
c:\program files\Blender\.blender\scripts\bpymodules\defaultdoodads.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfColorMap.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfLibrary.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfReader.py
c:\program files\Blender\.blender\scripts\bpymodules\mesh_gradient.py
c:\program files\Blender\.blender\scripts\bpymodules\meshtools.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_ai2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_eps2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_gimp2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_svg2obj.py
c:\program files\Blender\.blender\scripts\bvh_import.py
c:\program files\Blender\.blender\scripts\c3d_import.py
c:\program files\Blender\.blender\scripts\camera_changer.py
c:\program files\Blender\.blender\scripts\collada_export.py
c:\program files\Blender\.blender\scripts\collada_import.py
c:\program files\Blender\.blender\scripts\colladaExport14.py
c:\program files\Blender\.blender\scripts\colladaImport14.py
c:\program files\Blender\.blender\scripts\config.py
c:\program files\Blender\.blender\scripts\console.py
c:\program files\Blender\.blender\scripts\DirectX8Exporter.py
c:\program files\Blender\.blender\scripts\DirectX8Importer.py
c:\program files\Blender\.blender\scripts\discombobulator.py
c:\program files\Blender\.blender\scripts\envelope_symmetry.py
c:\program files\Blender\.blender\scripts\export-iv-0.1.py
c:\program files\Blender\.blender\scripts\export_dxf.py
c:\program files\Blender\.blender\scripts\export_fbx.py
c:\program files\Blender\.blender\scripts\export_lightwave_motion.py
c:\program files\Blender\.blender\scripts\export_m3g.py
c:\program files\Blender\.blender\scripts\export_map.py
c:\program files\Blender\.blender\scripts\export_mdd.py
c:\program files\Blender\.blender\scripts\export_obj.py
c:\program files\Blender\.blender\scripts\faceselect_same_weights.py
c:\program files\Blender\.blender\scripts\flt_defaultp.py
c:\program files\Blender\.blender\scripts\flt_dofedit.py
c:\program files\Blender\.blender\scripts\flt_export.py
c:\program files\Blender\.blender\scripts\flt_filewalker.py
c:\program files\Blender\.blender\scripts\flt_import.py
c:\program files\Blender\.blender\scripts\flt_lodedit.py
c:\program files\Blender\.blender\scripts\flt_palettemanager.py
c:\program files\Blender\.blender\scripts\flt_properties.py
c:\program files\Blender\.blender\scripts\flt_toolbar.py
c:\program files\Blender\.blender\scripts\help_bpy_api.py
c:\program files\Blender\.blender\scripts\help_browser.py
c:\program files\Blender\.blender\scripts\help_getting_started.py
c:\program files\Blender\.blender\scripts\help_manual.py
c:\program files\Blender\.blender\scripts\help_release_notes.py
c:\program files\Blender\.blender\scripts\help_tutorials.py
c:\program files\Blender\.blender\scripts\help_web_blender.py
c:\program files\Blender\.blender\scripts\help_web_devcomm.py
c:\program files\Blender\.blender\scripts\help_web_eshop.py
c:\program files\Blender\.blender\scripts\help_web_usercomm.py
c:\program files\Blender\.blender\scripts\hotkeys.py
c:\program files\Blender\.blender\scripts\IDPropBrowser.py
c:\program files\Blender\.blender\scripts\image_2d_cutout.py
c:\program files\Blender\.blender\scripts\image_auto_layout.py
c:\program files\Blender\.blender\scripts\image_billboard.py
c:\program files\Blender\.blender\scripts\image_edit.py
c:\program files\Blender\.blender\scripts\import_dxf.py
c:\program files\Blender\.blender\scripts\import_edl.py
c:\program files\Blender\.blender\scripts\import_lightwave_motion.py
c:\program files\Blender\.blender\scripts\import_mdd.py
c:\program files\Blender\.blender\scripts\import_obj.py
c:\program files\Blender\.blender\scripts\import_web3d.py
c:\program files\Blender\.blender\scripts\lightwave_export.py
c:\program files\Blender\.blender\scripts\lightwave_import.py
c:\program files\Blender\.blender\scripts\md2_export.py
c:\program files\Blender\.blender\scripts\md2_import.py
c:\program files\Blender\.blender\scripts\mesh_boneweight_copy.py
c:\program files\Blender\.blender\scripts\mesh_cleanup.py
c:\program files\Blender\.blender\scripts\mesh_edges2curves.py
c:\program files\Blender\.blender\scripts\mesh_mirror_tool.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce_grid.py
c:\program files\Blender\.blender\scripts\mesh_skin.py
c:\program files\Blender\.blender\scripts\mesh_solidify.py
c:\program files\Blender\.blender\scripts\mesh_unfolder.py
c:\program files\Blender\.blender\scripts\mesh_wire.py
c:\program files\Blender\.blender\scripts\ms3d_import.py
c:\program files\Blender\.blender\scripts\ms3d_import_ascii.py
c:\program files\Blender\.blender\scripts\obdatacopier.py
c:\program files\Blender\.blender\scripts\object_active_to_other.py
c:\program files\Blender\.blender\scripts\object_apply_def.py
c:\program files\Blender\.blender\scripts\object_batch_name_edit.py
c:\program files\Blender\.blender\scripts\object_cookie_cutter.py
c:\program files\Blender\.blender\scripts\object_drop.py
c:\program files\Blender\.blender\scripts\object_find.py
c:\program files\Blender\.blender\scripts\object_random_loc_sz_rot.py
c:\program files\Blender\.blender\scripts\object_sel2dupgroup.py
c:\program files\Blender\.blender\scripts\object_timeofs_follow_act.py
c:\program files\Blender\.blender\scripts\off_export.py
c:\program files\Blender\.blender\scripts\off_import.py
c:\program files\Blender\.blender\scripts\paths_import.py
c:\program files\Blender\.blender\scripts\ply_export.py
c:\program files\Blender\.blender\scripts\ply_import.py
c:\program files\Blender\.blender\scripts\raw_export.py
c:\program files\Blender\.blender\scripts\raw_import.py
c:\program files\Blender\.blender\scripts\renameobjectbyblock.py
c:\program files\Blender\.blender\scripts\render_save_layers.py
c:\program files\Blender\.blender\scripts\rvk1_torvk2.py
c:\program files\Blender\.blender\scripts\save_theme.py
c:\program files\Blender\.blender\scripts\scripttemplate_background_job.py
c:\program files\Blender\.blender\scripts\scripttemplate_camera_object.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_basic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_module.py
c:\program files\Blender\.blender\scripts\scripttemplate_ipo_gen.py
c:\program files\Blender\.blender\scripts\scripttemplate_mesh_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_metaball_create.py
c:\program files\Blender\.blender\scripts\scripttemplate_object_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_pyconstraint.py
c:\program files\Blender\.blender\scripts\scripttemplate_text_plugin.py
c:\program files\Blender\.blender\scripts\slp_import.py
c:\program files\Blender\.blender\scripts\sysinfo.py
c:\program files\Blender\.blender\scripts\textplugin_convert_ge.py
c:\program files\Blender\.blender\scripts\textplugin_functiondocs.py
c:\program files\Blender\.blender\scripts\textplugin_imports.py
c:\program files\Blender\.blender\scripts\textplugin_membersuggest.py
c:\program files\Blender\.blender\scripts\textplugin_outliner.py
c:\program files\Blender\.blender\scripts\textplugin_suggest.py
c:\program files\Blender\.blender\scripts\textplugin_templates.py
c:\program files\Blender\.blender\scripts\unweld.py
c:\program files\Blender\.blender\scripts\uv_export.py
c:\program files\Blender\.blender\scripts\uv_seams_from_islands.py
c:\program files\Blender\.blender\scripts\uvcalc_follow_active_coords.py
c:\program files\Blender\.blender\scripts\uvcalc_lightmap.py
c:\program files\Blender\.blender\scripts\uvcalc_quad_clickproj.py
c:\program files\Blender\.blender\scripts\uvcalc_smart_project.py
c:\program files\Blender\.blender\scripts\uvcopy.py
c:\program files\Blender\.blender\scripts\vertexpaint_from_material.py
c:\program files\Blender\.blender\scripts\vertexpaint_gradient.py
c:\program files\Blender\.blender\scripts\vertexpaint_selfshadow_ao.py
c:\program files\Blender\.blender\scripts\vrml97_export.py
c:\program files\Blender\.blender\scripts\weightpaint_average.py
c:\program files\Blender\.blender\scripts\weightpaint_clean.py
c:\program files\Blender\.blender\scripts\weightpaint_copy.py
c:\program files\Blender\.blender\scripts\weightpaint_envelope_assign.py
c:\program files\Blender\.blender\scripts\weightpaint_gradient.py
c:\program files\Blender\.blender\scripts\weightpaint_grow_shrink.py
c:\program files\Blender\.blender\scripts\weightpaint_invert.py
c:\program files\Blender\.blender\scripts\weightpaint_normalize.py
c:\program files\Blender\.blender\scripts\widgetwizard.py
c:\program files\Blender\.blender\scripts\wizard_bolt_factory.py
c:\program files\Blender\.blender\scripts\wizard_curve2tree.py
c:\program files\Blender\.blender\scripts\wizard_landscape_ant.py
c:\program files\Blender\.blender\scripts\x3d_export.py
c:\program files\Blender\.blender\scripts\xsi_export.py
c:\program files\Blender\blender-2.49b-win64-python26.zip
c:\program files\Blender\blender.exe
c:\program files\Blender\blender.exe.manifest
c:\program files\Blender\blender.html
c:\program files\Blender\blenderplayer.exe
c:\program files\Blender\BlenderQuickStart.pdf
c:\program files\Blender\copyright.txt
c:\program files\Blender\GPL-license.txt
c:\program files\Blender\libtiff.dll
c:\program files\Blender\makesdna.exe
c:\program files\Blender\makesdna.idb
c:\program files\Blender\plugins\bmake
c:\program files\Blender\plugins\Makefile
c:\program files\Blender\plugins\sequence\blur.c
c:\program files\Blender\plugins\sequence\color-correction-hsv.c
c:\program files\Blender\plugins\sequence\color-correction-yuv.c
c:\program files\Blender\plugins\sequence\dnr.c
c:\program files\Blender\plugins\sequence\gamma.c
c:\program files\Blender\plugins\sequence\Makefile
c:\program files\Blender\plugins\sequence\scatter.c
c:\program files\Blender\plugins\texture\clouds2.c
c:\program files\Blender\plugins\texture\Makefile
c:\program files\Blender\plugins\texture\tiles.c
c:\program files\Blender\pthreadVC2.dll
c:\program files\Blender\Python-license.txt
c:\program files\Blender\python26.dll
c:\program files\Blender\release_249.txt
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\SysWow64\msvcsv60.dll
c:\windows\SysWow64\NSREG.DLL
c:\windows\XSxS

----- BITS: Eventuell infizierte Webseiten -----

hxxp://officelabs.vo.msecnd.net
.
(((((((((((((((((((((((   Dateien erstellt von 2010-11-12 bis 2010-12-12  ))))))))))))))))))))))))))))))
.

2010-12-12 14:27 . 2010-12-12 14:27	--------	d-----w-	c:\users\Mit Gästen\AppData\Local\temp
2010-12-12 14:27 . 2010-12-12 14:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-12 13:54 . 2010-12-12 14:00	--------	d-----w-	C:\_OTL
2010-12-12 12:19 . 2010-12-12 12:19	388096	----a-r-	c:\users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-10 12:06 . 2010-11-10 05:35	8199504	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F3DCEEC-0D43-4464-899A-74354B19A15A}\mpengine.dll
2010-11-27 14:35 . 2010-12-04 11:55	--------	d-----w-	c:\users\Christoph\AppData\Roaming\Tropico 3
2010-11-26 22:31 . 2010-11-26 22:31	--------	d-----w-	c:\program files (x86)\MockFlow
2010-11-26 21:14 . 2010-11-26 21:14	--------	d-----w-	c:\programdata\WorldWindData
2010-11-24 13:06 . 2010-10-19 08:47	7680	----a-w-	c:\program files\Internet Explorer\iecompat.dll
2010-11-24 13:06 . 2010-10-19 08:10	7680	----a-w-	c:\program files (x86)\Internet Explorer\iecompat.dll
2010-11-16 17:45 . 2009-04-28 02:56	24064	----a-w-	c:\windows\SysWow64\lxebsmr.dll
2010-11-16 17:45 . 2009-04-28 02:56	24064	----a-w-	c:\windows\system32\lxebsmr.dll
2010-11-16 17:45 . 2010-04-13 14:41	836608	----a-w-	c:\windows\system32\lxebcoin.dll
2010-11-16 17:45 . 2009-11-09 03:36	245248	----a-w-	c:\windows\system32\lxebinsb.dll
2010-11-16 17:45 . 2009-11-09 03:35	378368	----a-w-	c:\windows\system32\lxebcu.dll
2010-11-16 17:45 . 2009-11-09 03:35	450048	----a-w-	c:\windows\system32\lxebins.dll
2010-11-16 17:45 . 2009-11-09 03:06	65536	----a-w-	c:\windows\system32\lxebgcfg.dll
2010-11-16 17:45 . 2009-10-21 05:06	399360	----a-w-	c:\windows\system32\lxebcui.dll
2010-11-16 17:45 . 2009-06-07 19:21	148480	----a-w-	c:\windows\system32\lxebcuir.dll
2010-11-15 13:39 . 2010-11-15 13:39	17459253	----a-w-	c:\programdata\SPLF9BA.tmp
2010-11-15 13:39 . 2010-11-15 13:39	17459253	----a-w-	c:\programdata\SPL673C.tmp
2010-11-15 13:34 . 2010-11-15 13:34	17459253	----a-w-	c:\programdata\SPL5580.tmp
2010-11-15 13:34 . 2010-11-15 13:34	17459253	----a-w-	c:\programdata\SPLFAA4.tmp
2010-11-15 12:59 . 2010-11-15 12:59	17459253	----a-w-	c:\programdata\SPLDFE2.tmp
2010-11-14 19:19 . 2007-02-23 18:09	905728	----a-w-	c:\windows\system32\synsoacc.dll
2010-11-14 19:19 . 2006-11-16 15:58	31248	----a-w-	c:\windows\system32\drivers\synUSB64.sys
2010-11-14 19:19 . 2006-01-29 11:48	45056	----a-w-	c:\windows\SysWow64\Synsopos.exe
2010-11-14 19:19 . 2006-01-29 11:48	401462	----a-w-	c:\windows\SysWow64\temp.000
2010-11-14 19:19 . 2007-02-23 12:57	757760	----a-w-	c:\windows\SysWow64\SYNSOACC.dll
2010-11-14 19:19 . 2006-01-29 11:48	147456	----a-w-	c:\windows\SysWow64\SynsoLChk.dll
2010-11-14 19:19 . 2010-11-14 19:19	--------	d-----w-	c:\program files (x86)\Syncrosoft
2010-11-14 19:16 . 2010-11-14 19:16	--------	d-----w-	C:\Install
2010-11-14 12:14 . 2010-11-14 12:14	17459253	----a-w-	c:\programdata\SPLA213.tmp
2010-11-13 12:40 . 2010-11-13 12:40	17459253	----a-w-	c:\programdata\SPLD58.tmp

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-22 13:17 . 2010-01-02 17:43	83120	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-11-16 20:07 . 2010-01-08 19:39	215016	----a-w-	c:\windows\SysWow64\PnkBstrB.xtr
2010-11-16 20:07 . 2010-01-06 12:46	215016	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2010-11-12 12:43 . 2010-11-12 12:43	17659656	----a-w-	c:\programdata\SPL916.tmp
2010-11-12 12:42 . 2010-11-12 12:42	17659656	----a-w-	c:\programdata\SPLF873.tmp
2010-11-12 12:40 . 2010-11-12 12:40	17659656	----a-w-	c:\programdata\SPLC323.tmp
2010-11-04 16:20 . 2010-01-04 12:21	9624	----a-w-	c:\users\Christoph\AppData\Roaming\Microsoft\IdentityCRL\production\WLIDClientConfig.dll
2010-10-19 09:41 . 2010-01-02 19:15	270720	------w-	c:\windows\system32\MpSigStub.exe
2010-10-08 15:09 . 2006-09-28 19:53	499712	----a-w-	c:\windows\SysWow64\msvcp71.dll
2010-10-08 15:09 . 2006-09-28 19:53	348160	----a-w-	c:\windows\SysWow64\msvcr71.dll
2010-10-05 03:32 . 2010-01-03 09:43	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-05 03:32 . 2010-07-24 11:59	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-10-05 03:32 . 2010-01-13 13:01	1113408	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-10-01 14:55 . 2010-02-04 08:16	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-10-01 14:44 . 2010-10-01 14:44	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-10-01 14:44 . 2010-01-03 09:42	1113408	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-09-26 14:45 . 2010-01-13 14:23	24064	----a-w-	c:\windows\SysWow64\FsExService64.Exe
2010-09-26 14:45 . 2010-01-13 14:23	16392	----a-w-	c:\windows\SysWow64\drivers\TFsExDisk.Sys
2010-09-26 14:44 . 2007-10-25 16:26	5632	----a-w-	c:\windows\SysWow64\drivers\StarOpen.sys
2010-09-15 03:50 . 2010-08-23 11:05	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2010-09-14 17:50 . 2010-09-14 17:50	21832	----a-w-	c:\windows\system32\drivers\hamachi.sys
2010-06-22 16:36 . 2010-06-24 14:58	1508283	----a-w-	c:\program files (x86)\Euthymia Electronic Organ V2.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeedDemon"="c:\program files (x86)\FeedDemon\FeedDemon.exe" [2010-12-08 7501824]
"Pidgin"="c:\program files (x86)\Pidgin\pidgin.exe" [2010-11-01 48618]

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2010-07-28 609424]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"BambooCore"=c:\program files (x86)\Bamboo Dock\BambooCore.exe
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

R2 athsgt;athsgt;c:\windows\system32\DRIVERS\athsgt.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-19 136176]
R2 limsgt;limsgt;c:\windows\system32\DRIVERS\limsgt.sys [x]
R2 lxebCATSCustConnectService;lxebCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [2010-04-14 45736]
R3 ahcix64s;ahcix64s;c:\windows\system32\DRIVERS\ahcix64s.sys [2008-09-10 224272]
R3 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys [2007-10-12 10632]
R3 ISASerial;PCIe-ISA Communication Port;c:\windows\system32\DRIVERS\ISASerial.sys [2008-02-20 72192]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\DRIVERS\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\DRIVERS\nmserial.sys [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2009-09-25 73728]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2009-09-25 178688]
R3 nvamacpi;nvamacpi;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-16 28192]
R3 PciIsaSerial;PCI-ISA Communication Port;c:\windows\system32\DRIVERS\PciIsaSerial.sys [2008-05-22 72192]
R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\DRIVERS\PciPPorts.sys [2008-05-22 95744]
R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\DRIVERS\PciSPorts.sys [2008-05-22 126464]
R3 PPorts;PCIe ECP Parallel Port;c:\windows\system32\DRIVERS\PPorts.sys [2008-02-20 95744]
R3 SPorts;High-Speed PCIe Serial Port;c:\windows\system32\DRIVERS\SPorts.sys [2008-02-20 124416]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynUSB64.sys [2006-11-16 31248]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 18216]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-02-12 193232]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-02-12 53264]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S2 lxeb_device;lxeb_device;c:\windows\system32\lxebcoms.exe [2010-04-14 1052328]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-07-15 5414184]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-07-15 127272]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-02-12 145360]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-02-12 165200]

.
Inhalt des "geplante Tasks" Ordners

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]

2010-12-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]

2010-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]
.

--------- x86-64 -----------


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"lxebmon.exe"="c:\program files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe" [2010-05-05 770728]
"EzPrint"="c:\program files (x86)\Lexmark Pro200-S500 Series\ezprint.exe" [2009-04-28 139944]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to &Evernote - c:\program files (x86)\Evernote\Evernote3.5\enbar.dll/2000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?q=
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - hxxp://pinterest.com/|http://www.trojaner-board.de/93690-i...6da82a681c0a0e
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?q=
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enbar.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll
FF - plugin: c:\program files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npContribute.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: c:\program files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\Christoph\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Battlefield Heroes Updater: battlefieldheroespatcher@ea.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com
FF - Ext: Fast Dial: fastdial@telega.phpnet.us - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us
FF - Ext: Firebug: firebug@software.joehewitt.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Strata40: Strata40@SpewBoy.au - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au
FF - Ext: StrataBuddy: StrataBuddy@ReduxTeam - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam
FF - Ext: App Tabs: apptabs@frankyan.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com
FF - Ext: Tab Progress Bar: tabprogressbar@studio17.wordpress.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com
FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
FF - Ext: Chromifox Basic: chromifox@altmusictv.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com
FF - Ext: SkipScreen: SkipScreen@SkipScreen - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen
FF - Ext: Yet Another Window Resizer: yawr@sdx.hu - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu
FF - Ext: Evernote Web Clipper: {E0B8C461-F8FB-49b4-8373-FE32E9252800} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
FF - Ext: Pastebin: pastebin.com@gmail.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com
FF - Ext: ColorZilla: {6AC85730-7D0F-4de0-B3FA-21142DD85326} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
FF - Ext: FireGestures: firegestures@xuldev.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org
FF - Ext: HTTPS-Everywhere: https-everywhere@eff.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ6.5\ICQ.exe
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_heroes.exe


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63B72BBE-76EE-60B7-A042-F9F60C7F4C38}*]
"haehchfmfjapdmee"=hex:6a,61,64,6b,66,68,64,70,65,65,6e,6e,67,61,6a,66,6f,6a,
   6a,6d,00,2e
"iakkmpddddbcopflgc"=hex:6a,61,64,6b,65,68,63,61,64,61,64,68,64,6f,65,68,65,69,
   6e,61,00,f5

[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\SecuROM\License information*]
"datasecu"=hex:e8,fc,94,29,84,d0,db,10,48,2d,c9,cd,42,9a,33,b3,25,7d,4e,80,de,
   eb,83,ce,75,8f,93,d2,3a,f8,32,d5,3f,75,14,84,94,89,d8,6d,5e,27,ea,29,2f,58,\
"rkeysecu"=hex:51,0a,e3,c2,95,b8,a6,4a,ca,f7,96,b2,22,7b,a3,01

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-12-12  15:29:10
ComboFix-quarantined-files.txt  2010-12-12 14:29

Vor Suchlauf: 14 Verzeichnis(se), 258.599.911.424 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 258.472.767.488 Bytes frei

- - End Of File - - 4DA2C0CF2AA70E45944D44F212C2354A
         
Ich versteh zwar nicht ganz, wieso es mir Blender gelöscht hat, aber dass ist nicht weiter schlimm...

Alt 12.12.2010, 15:39   #8
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



download malwarebytes:
Malwarebytes
instalieren, öffnen, registerkarte aktualisierung, programm updaten.
schalte alle laufenden programme ab, trenne die internetverbindung.
registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.12.2010, 15:41   #9
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Kann es sein, dass die Malware schon weg ist? Alle Anzeichen von vorhin sind verschwunden...
ODer soll ich den Scan trotzdem machen?

Alt 12.12.2010, 15:53   #10
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



den scan trotzdem machen, sieht aber schon gut aus.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.12.2010, 17:08   #11
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Som, hat ganz schön lange gedauert. Wahrscheinlich bin ich jetzt sauber!

Code:
ATTFilter
Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5299

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

12.12.2010 17:01:54
mbam-log-2010-12-12 (17-01-54).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 626947
Laufzeit: 1 Stunde(n), 0 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\program files (x86)\euthymia electronic organ v2.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\12122010_145442\C_Users\christoph\AppData\Local\Temp\Rnv.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
         

Alt 12.12.2010, 17:09   #12
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



lade den CCleaner slim:
Piriform - Builds
falls der CCleaner bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.12.2010, 17:40   #13
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Code:
ATTFilter
7-Zip 4.65	notwendig			
ABBYY FineReader 6.0 Sprint	unbekannt			
Adobe AIR	notwendig			
Adobe Community Help	notwendig			
Adobe Flash Player 10 ActiveX	notwendig			
Adobe Flash Player 10 Plugin	notwendig			
Adobe Media Player	notwendig			
Adobe Photoshop CS3	notwendig			
Adobe Reader 9.4.1 - Deutsch	notwendig			
Adobe Shockwave Player 11.5	notwendig			
AirPlus XtremeG DWL-G122	notwendig			
Alien Swarm	notwendig			
Alien Swarm - SDK	notwendig			
ANNO 1404	notwendig			
ANNO 1404 - Venedig	notwendig			
ANNO 1404 Entwickler-Tools	notwendig			
Apple Application Support	notwendig			
Apple Software Update	notwendig			
ArtRage 2	notwendig			
ASIO4ALL	notwendig			
Assassin's Creed	notwendig			
Assassin's Creed II	notwendig			
Audacity 1.2.6	notwendig			
Avira AntiVir Personal - Free Antivirus	notwendig			
Bamboo	notwendig			
Bamboo Dock 3.3	notwendig			
Bamboo Explore	notwendig			
Bamboo Scribe	notwendig			
Bamboo Scribe Shared Files	notwendig			
Battlefield Heroes	notwendig			
Bonjour	unnötig			
Bullzip PDF Printer 7.1.0.1159	notwendig			
CCleaner	notwendig			
Dexpot	notwendig			
DivX-Setup	unnötig			
DVD Shrink 3.2	notwendig			
Edirol HQ Orchestral VSTi v1.03	notwendig			
Empire Earth II	notwendig			
Evernote	notwendig			
Exteel (US)	unnötig			
FeedDemon	notwendig			
FL Studio 9	notwendig			
foobar2000 v1.0.1	unnötig			
Free M4a to MP3 Converter 6.1	unnötig			
GameSpy Arcade	notwendig			
GEAR driver installer for AMD64 and Intel EM64T	unnötig			
GIMP 2.6.10	notwendig			
GNU Privacy Guard	unbekannt			
Google Chrome	notwendig			
Google Earth Plug-in	notwendig			
Google SketchUp 7	notwendig			
GPL Ghostscript 8.64	unbekannt			
Grand Theft Auto	unnötig			
GTA2	unnötig			
Hamachi 1.0.1.5	notwendig			
Hardcore	notwendig			
HiJackThis	notwendig			
IETester v0.4.4 (remove only)	notwendig			
IL Download Manager	notwendig			
ImgBurn	notwendig			
Inkscape 0.47	notwendig			
Internet Explorer Collection 1.6.0.4	notwendig			
Java(TM) 6 Update 22	notwendig			
LeechFTP	notwendig			
Lexmark	notwendig			
Lexmark Pro200-S500 Series	notwendig			
Lexmark Symbolleiste	notwendig			
Lexmark Tools for Office	notwendig			
Linux MultiMedia Studio (LMMS)	notwendig			
Livebrush Mini	notwendig			
Malwarebytes' Anti-Malware	notwendig			
Microsoft .NET Framework 4 Client Profile	notwendig			
Microsoft .NET Framework 4 Client Profile DEU Language Pack	notwendig			
Microsoft Chart Controls for Microsoft .NET Framework 3.5	notwendig			
Microsoft IntelliPoint 8.0	notwendig			
Microsoft Office Enterprise 2007	notwendig			
Microsoft Silverlight	notwendig			
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)	notwendig			
Microsoft Text-to-Speech Engine 4.0 (English)	notwendig			
Microsoft Visual C++ 2005 Redistributable	notwendig			
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148	notwendig			
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148	notwendig			
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022	notwendig			
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17	notwendig			
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218	notwendig			
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17	notwendig			
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148	notwendig			
Microsoft® Office-Add-In for Moodle	notwendig			
MockFlow Desktop	notwendig			
Monkey Island 2: Special Edition	notwendig			
Mozilla Firefox (3.6.13)	notwendig			
Mozilla Thunderbird (3.1.4)	notwendig			
Mp3tag v2.45a	notwendig			
MSI Afterburner 1.0.0	notwendig			
MSXML 4.0 SP2 (KB954430)	notwendig			
MSXML 4.0 SP2 (KB973688)	notwendig			
Native Instruments Absynth 4	notwendig			
Native Instruments Battery 3	notwendig			
Native Instruments Battery 3	notwendig			
Native Instruments FM8	notwendig			
Native Instruments Massive	notwendig			
Native Instruments Pro-53	notwendig			
Native Instruments Service Center	notwendig			
Native Instruments Service Center	notwendig			
NCsoft Launcher	unnötig			
Need For Speed™ World	unnötig			
Nero 9 Essentials	notwendig			
Notepad++	notwendig			
NVIDIA Display Control Panel	notwendig			
NVIDIA Drivers	notwendig			
NVIDIA PhysX	notwendig			
NVIDIA Stereoscopic 3D Driver	notwendig			
OpenAL	notwendig			
OpenOffice.org 3.2	notwendig			
Opera 10.10	notwendig			
Pando Media Booster	unbekannt			
PC Connectivity Solution	unnötig			
Phase 5 HTML-Editor	notwendig			
Pidgin	notwendig			
PoiZone	notwendig			
Portal: The First Slice	notwendig			
PunkBuster Services	notwendig			
Python 2.6.5	notwendig			
QuickTime	notwendig			
Realtek High Definition Audio Driver	notwendig			
RippMe	notwendig			
RocketDock 1.3.5	unnötig			
Safari	notwendig			
Sakura	notwendig			
SampleTank FREE	unnötig			
SAMSUNG Mobile Composite Device Software	notwendig			
Samsung Mobile Modem Device Software	notwendig			
SAMSUNG Mobile Modem Driver Set	notwendig			
Samsung Mobile phone USB driver Drive Software	notwendig			
SAMSUNG Mobile USB Modem 1.0 Software	notwendig			
SAMSUNG Mobile USB Modem Software	notwendig			
SAMSUNG USB Mobile Device Software	notwendig			
SamsungConnectivityCableDriver	notwendig			
Sawer	notwendig			
Scribus 1.3.3.13	notwendig			
ScummVM 1.0.0	notwendig			
Sigel Professional Label Software SE	unnötig			
Skype™ 4.2	notwendig			
Sonik Synth 2 Free	notwendig			
Sony DVD Architect 4.0	notwendig			
Sony Media Manager 2.2	notwendig			
Sony Vegas 7.0	notwendig			
Steam	notwendig			
Sun VirtualBox	notwendig			
Syncrosoft Lizenz Kontrolle	unbekannt			
The Secret of Monkey Island: Special Edition	notwendig			
Tomb Raider: Underworld 1.1	notwendig			
Toxic Biohazard	notwendig			
Tropico 3 - Steam Special Edition	notwendig			
Tropico 3: Absolute Power	notwendig			
TrueCrypt	notwendig			
TuxGuitar	unnötig			
Tycoon City - New York	notwendig			
Ubisoft Game Launcher	notwendig			
Unreal Development Kit: 2010-01	notwendig			
Visual C++ 8.0 Runtime Setup Package (x64)	notwendig			
Visual Studio 2005 Tools for Office Second Edition Runtime	notwendig			
VLC media player 1.0.5	notwendig			
WavePad Sound Editor	unnötig			
Winamp	notwendig			
Winamp Anwendungserkennung	notwendig			
Windosill	notwendig			
Windows-Treiberpaket - Nokia pccsmcfd  (10/12/2007 6.85.4.0)	unnötig			
Wings 3D 1.0.1	notwendig			
WinRAR	notwendig			
XMedia Recode 2.2.7.7	notwendig			
Xvid 1.2.2 final uninstall	unbekannt			
µTorrent	notwendig
         
ICh hab versucht es ordentlicher hinzukriegen, hat aber nich geklappt. Hätte es auch noch als Excel/Calc Tabelle...

Alt 12.12.2010, 17:47   #14
markusg
/// Malware-holic
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



deinstaliere:
ABBYY FineReader

Adobe Reader 9
ersetzen:
Adobe - Adobe Reader herunterladen - Alle Versionen

bitte den mcafee security scan nicht mit instalieren.
öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus.
so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden.
unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken.
unter update, auf instalieren stellen.
klicke übernehmen /ok

deinstaliere:
Bonjour
DivX
Exteel
foobar2000
Free M4a to MP3 Converter
GEAR driver installer
GNU
Grand Theft
GTA2
NCsoft Launcher
Need For Speed™
PC Connectivity
RocketDock
SampleTank
Sigel Professional Label Software
Skype™ öffnen, update klicken und version 5 drauf.
TuxGuitar
WavePad
bereinige dann dateien + registry
war genauso wie ichs wollte :-)
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 12.12.2010, 18:13   #15
craep
 
Internet Explorer öffnet automatisch Werbung - Standard

Internet Explorer öffnet automatisch Werbung



Alles klar, vielen Dank für deine intensive Hilfe.
Wäre es möglich diesen Thread zu löschen, er hilft ja eh keinem (man braucht ja eine individuelle Anleitung) und mir wäre es lieber wenn die ganzen Logs und Listen mit Infos über meinen Computer nicht öffentlich wären...

Antwort

Themen zu Internet Explorer öffnet automatisch Werbung
adobe, antivir, antivir guard, avg, avira, bho, bonjour, browser, desktop, firefox, hijack, hijackthis, internet, internet explorer, logfile, mozilla, object, plug-in, problem, programm, senden, software, syswow64, temp, updates, werbung, windows, windows 7 64bit



Ähnliche Themen: Internet Explorer öffnet automatisch Werbung


  1. Windows 7: Internet Explorer startet automatisch Werbung/ Webseiten werden auf Werbung umgeleitet
    Log-Analyse und Auswertung - 27.07.2014 (7)
  2. IE Explorer öffnet sich automatisch mit Werbung, verdacht auf Swizzor
    Log-Analyse und Auswertung - 30.08.2010 (5)
  3. Internet Explorer öffnet sich automatisch und öffnet Werbeseiten
    Log-Analyse und Auswertung - 18.06.2010 (1)
  4. Internet Explorer/Firefox öffnet automatisch und ständig Werbung
    Log-Analyse und Auswertung - 11.06.2010 (6)
  5. Internet Explorer/Firefox öffnet automatisch Werbung
    Log-Analyse und Auswertung - 09.06.2010 (31)
  6. Internet Explorer startet automatisch mit Werbung
    Log-Analyse und Auswertung - 07.04.2010 (16)
  7. internet explorer öffnet automatisch werbung
    Log-Analyse und Auswertung - 26.01.2010 (3)
  8. Internet Explorer öffnet automatisch mit Werbung! Trojaner Meldung..
    Log-Analyse und Auswertung - 21.11.2009 (18)
  9. Internet Explorer öffnet automatisch und öffnet Werbung
    Log-Analyse und Auswertung - 28.08.2009 (18)
  10. i-net explorer öffnet automatisch werbung
    Log-Analyse und Auswertung - 26.05.2009 (23)
  11. Internet Explorer öffnet sich automatisch mit Werbung
    Log-Analyse und Auswertung - 24.04.2009 (0)
  12. Internet Explorer öffnet Automatisch Werbung
    Plagegeister aller Art und deren Bekämpfung - 19.02.2009 (5)
  13. Internet Explorer Öffnet automatisch mit werbung.
    Log-Analyse und Auswertung - 10.11.2008 (1)
  14. Internet Explorer - öffnet automatisch Werbung!
    Log-Analyse und Auswertung - 10.10.2008 (2)
  15. Internet Expl. öffnet ständig Werbung(automatisch)
    Log-Analyse und Auswertung - 16.07.2008 (2)
  16. Internet Explorer öffnet automatisch Werbeseiten
    Log-Analyse und Auswertung - 27.12.2007 (4)
  17. Explorer öffnet automatisch und stellt Werbung bereit
    Mülltonne - 22.07.2007 (0)

Zum Thema Internet Explorer öffnet automatisch Werbung - Hallo. Seit einigen Tagen öffnet sich alle paar Minuten ein Internet Explorer mit Werbung (ich benutze aber Firefox als Standartbrowser). Ich habe hier schon verschiedenes über das selbe Problem gelesen, - Internet Explorer öffnet automatisch Werbung...
Archiv
Du betrachtest: Internet Explorer öffnet automatisch Werbung auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.