| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Internet Explorer öffnet automatisch WerbungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
12.12.2010, 13:32
| #1 |
 |  Internet Explorer öffnet automatisch Werbung Hallo. Seit einigen Tagen öffnet sich alle paar Minuten ein Internet Explorer mit Werbung (ich benutze aber Firefox als Standartbrowser). Ich habe hier schon verschiedenes über das selbe Problem gelesen, aber man soll ja immer einen neuen Thread aufmachen... Mein Virenprogramm (Avira AntiVir Free 10) hat nichts gefunden, es kann allerdings sein, dass ich mir das Ding ausversehen "absichtlich" installiert habe. Ich benutze Windows 7 64Bit, und das hat HijackThis ausgspuckt: Code:
ATTFilter Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:23:39, on 12.12.2010 Platform: Windows 7 (WinNT 6.00.3504) MSIE: Internet Explorer v8.00 (8.00.7600.16671) Boot mode: Normal Running processes: C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe C:\Program Files (x86)\FeedDemon\FeedDemon.exe C:\Program Files (x86)\Pidgin\pidgin.exe C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe C:\Program Files (x86)\Bamboo Dock\BambooCore.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Internet Explorer\IELowutil.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Users\Christoph\AppData\Local\Temp\Rnv.exe C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von ARLT Computer R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll O2 - BHO: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file) O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: Lexmark - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Program Files\Lexmark Printable Web\bho.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: Lexmark Symbolleiste - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKCU\..\Run: [FeedDemon] "C:\Program Files (x86)\FeedDemon\FeedDemon.exe" /startminimized O4 - HKCU\..\Run: [ICQ] "C:\Program Files (x86)\ICQ6.5\ICQ.exe" silent O4 - HKCU\..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe O4 - HKCU\..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST') O8 - Extra context menu item: Add to &Evernote - res://C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll/2000 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll O9 - Extra 'Tools' menuitem: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: lxebCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe O23 - Service: lxeb_device - - C:\Windows\system32\lxebcoms.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: Druckwarteschlange (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: TabletServicePen - Unknown owner - C:\Windows\system32\Pen_Tablet.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) O23 - Service: WTouch Service (WTouchService) - Wacom Technology, Corp. - C:\Program Files\WTouch\WTouchService.exe -- End of file - 10904 bytes Craep P.S.: In meiner Hosts Datei steht unter anderem folgendes: 127.0.0.1 im.adtech.de 127.0.0.1 adserver.adtech.de 127.0.0.1 adtech.de 127.0.0.1 atwola.com Vielleicht hat das etwas damit zu tun... Ach ja, außerdem werd ich, wenn ich ein Video im Vollbild Modus angucke (egal ob mit VLC oder auf YouTube) ca. alle 20 Sekunden "rausgeworfen" und wenn ich auch Websites in ein Textfeld schreibe (wie jetz) wird der Fokus vom Textfeld genommen... Geändert von craep (12.12.2010 um 13:40 Uhr) |
|
12.12.2010, 13:39
| #2 |
| /// Malware-holic   | Internet Explorer öffnet automatisch Werbung 1. nimm keinerlei reinigung selbstständig vor, sonst ist das nur störend.
__________________2. reiche alle evtl vorhandenen scan logs nach. ootl: 3. Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt
__________________ |
|
12.12.2010, 14:07
| #3 |
| | Internet Explorer öffnet automatisch Werbung ICh hab den Scan ausversehen nur von einm Adminkonto aus gemacht, nicht ausdrücklich als Admin gestartet, ich hoffe das macht nichts aus, falls doch mach ich natürlich noch einen!
__________________OTL: Code:
ATTFilter OTL logfile created on: 12.12.2010 13:51:25 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Christoph\Desktop 64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free 8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe () PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe () PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe () PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community) PRC - C:\Program Files (x86)\Bamboo Dock\BambooCore.exe () PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe () PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) PRC - C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe () PRC - C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Christoph\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found SRV:64bit: - (lxeb_device) -- C:\Windows\SysNative\lxebcoms.exe ( ) SRV:64bit: - (lxebCATSCustConnectService) -- C:\Windows\SysNative\spool\DRIVERS\x64\3\\lxebserv.exe () SRV:64bit: - (TabletServicePen) -- C:\Windows\SysNative\Pen_Tablet.exe (Wacom Technology, Corp.) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (lxeb_device) -- C:\Windows\SysWow64\lxebcoms.exe ( ) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (WTouchService) -- C:\Programme\WTouch\WTouchService.exe (Wacom Technology, Corp.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia.) SRV - (MSSQL$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (Microsoft Corporation) SRV - (SQLAgent$SONY_MEDIAMGR) -- C:\Program Files (x86)\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (VMnetAdapter) -- C:\Windows\SysNative\DRIVERS\vmnetadapter.sys File not found DRV:64bit: - (TFsExDisk) -- C:\Windows\SysNative\Drivers\TFsExDisk.sys File not found DRV:64bit: - (nmserial) -- C:\Windows\SysNative\DRIVERS\nmserial.sys File not found DRV:64bit: - (NmPar) -- C:\Windows\SysNative\DRIVERS\NmPar.sys File not found DRV:64bit: - (limsgt) -- C:\Windows\SysNative\DRIVERS\limsgt.sys File not found DRV:64bit: - (athsgt) -- C:\Windows\SysNative\DRIVERS\athsgt.sys File not found DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation) DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Sun Microsystems, Inc.) DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (NEC Electronics Corporation) DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (NEC Electronics Corporation) DRV:64bit: - (RT73) -- C:\Windows\SysNative\drivers\rt73.sys (Ralink Technology, Corp.) DRV:64bit: - (nvamacpi) -- C:\Windows\SysNative\drivers\nvamacpi.sys (NVIDIA Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (WSDPrintDevice) -- C:\Windows\SysNative\drivers\WSDPrint.sys (Microsoft Corporation) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (wacomvhid) -- C:\Windows\SysNative\drivers\wacomvhid.sys (Wacom Technology) DRV:64bit: - (MTsensor) -- C:\Windows\SysNative\drivers\ASACPI.sys () DRV:64bit: - (wacmoumonitor) -- C:\Windows\SysNative\drivers\wacmoumonitor.sys (Wacom Technology) DRV:64bit: - (ahcix64s) -- C:\Windows\SysNative\drivers\ahcix64s.sys (AMD Technologies Inc.) DRV:64bit: - (PciIsaSerial) -- C:\Windows\SysNative\drivers\PciIsaSerial.sys (Windows (R) Codename Longhorn DDK provider) DRV:64bit: - (PciPPorts) -- C:\Windows\SysNative\drivers\PciPPorts.sys () DRV:64bit: - (PciSPorts) -- C:\Windows\SysNative\drivers\PciSPorts.sys () DRV:64bit: - (SPorts) -- C:\Windows\SysNative\drivers\SPorts.sys () DRV:64bit: - (PPorts) -- C:\Windows\SysNative\drivers\PPorts.sys () DRV:64bit: - (ISASerial) -- C:\Windows\SysNative\drivers\ISASerial.sys (Windows (R) Codename Longhorn DDK provider) DRV:64bit: - (amdide64) -- C:\Windows\SysNative\drivers\amdide64.sys (Advanced Micro Devices) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (wacommousefilter) -- C:\Windows\SysNative\drivers\wacommousefilter.sys (Wacom Technology) DRV:64bit: - (WacomVKHid) -- C:\Windows\SysNative\drivers\WacomVKHid.sys (Wacom Technology) DRV:64bit: - (SynasUSB) -- C:\Windows\SysNative\drivers\synUSB64.sys (SIA Syncrosoft) DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.) DRV - (TFsExDisk) -- C:\Windows\SysWOW64\drivers\TFsExDisk.Sys (Teruten Inc) DRV - (athsgt) -- C:\Windows\SysWOW64\drivers\athsgt.sys () DRV - (limsgt) -- C:\Windows\SysWOW64\drivers\limsgt.sys () ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 40 25 5A 5A 33 96 CA 01 [binary data] IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.de/search?q=" FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.wisedock.de/m.php?id=3864ae9136fc9f501194544ec2372e288d51" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.2 FF - prefs.js..extensions.enabledItems: apptabs@frankyan.com:0.6.2 FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0 FF - prefs.js..extensions.enabledItems: fastdial@telega.phpnet.us:2.23b2 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.0 FF - prefs.js..extensions.enabledItems: {1280606b-2510-4fe0-97ef-9b5a22eafe41}:1.0.9 FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.11 FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: StrataBuddy@ReduxTeam:0.6.2 FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.11 FF - prefs.js..extensions.enabledItems: tabprogressbar@studio17.wordpress.com:0.6 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.8 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.48.3 FF - prefs.js..extensions.enabledItems: SkipScreen@SkipScreen:0.5.17s FF - prefs.js..extensions.enabledItems: yawr@sdx.hu:1.21 FF - prefs.js..extensions.enabledItems: {E0B8C461-F8FB-49b4-8373-FE32E9252800}:4.0.0.106602 FF - prefs.js..extensions.enabledItems: pastebin.com@gmail.com:2.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {6AC85730-7D0F-4de0-B3FA-21142DD85326}:2.2.2 FF - prefs.js..extensions.enabledItems: firegestures@xuldev.org:1.6 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: https-everywhere@eff.org:0.9.2 FF - prefs.js..extensions.enabledItems: Strata40@SpewBoy.au:0.6.2 FF - prefs.js..extensions.enabledItems: chromifox@altmusictv.com:3.6.5 FF - prefs.js..keyword.URL: "hxxp://www.google.de/search?q=" FF - prefs.js..network.proxy.backup.ftp: "193.174.155.26" FF - prefs.js..network.proxy.backup.ftp_port: 3124 FF - prefs.js..network.proxy.backup.gopher: "193.174.155.26" FF - prefs.js..network.proxy.backup.gopher_port: 3124 FF - prefs.js..network.proxy.backup.socks: "193.174.155.26" FF - prefs.js..network.proxy.backup.socks_port: 3124 FF - prefs.js..network.proxy.backup.ssl: "193.174.155.26" FF - prefs.js..network.proxy.backup.ssl_port: 3124 FF - prefs.js..network.proxy.ftp: "193.174.155.26" FF - prefs.js..network.proxy.ftp_port: 3124 FF - prefs.js..network.proxy.gopher: "193.174.155.26" FF - prefs.js..network.proxy.gopher_port: 3124 FF - prefs.js..network.proxy.http: "193.174.155.26" FF - prefs.js..network.proxy.http_port: 3124 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "193.174.155.26" FF - prefs.js..network.proxy.socks_port: 3124 FF - prefs.js..network.proxy.ssl: "193.174.155.26" FF - prefs.js..network.proxy.ssl_port: 3124 FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2010.08.01 14:13:28 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.12 13:24:05 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.11 10:13:57 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.10.28 14:40:30 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.4\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions [2010.02.14 11:38:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2010.09.27 15:54:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Extensions\xulapp@opencube.com [2010.12.12 13:26:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions [2010.12.11 11:42:05 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\3bk2ttqa.Entwicklung\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.12.12 13:08:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions [2010.03.26 12:42:16 | 000,000,000 | ---D | M] (Screengrab) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2010.11.09 19:05:27 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2010.01.21 19:35:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe41} [2010.01.02 21:00:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{24d1fe20-76df-11de-8a39-0800200c9a66} [2010.08.20 21:17:15 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2010.09.11 15:27:12 | 000,000,000 | ---D | M] (ColorZilla) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326} [2010.11.12 23:47:50 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2010.01.02 19:01:10 | 000,000,000 | ---D | M] (Web Developer) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2010.12.10 22:34:59 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.07.30 11:30:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3} [2010.10.26 19:39:34 | 000,000,000 | ---D | M] (Evernote Web Clipper) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800} [2010.04.10 10:54:59 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2010.01.21 19:08:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com [2010.09.21 20:48:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com [2010.03.11 20:35:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com [2010.07.20 17:16:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us [2010.11.30 17:43:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com [2010.12.02 16:12:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org [2010.11.26 22:59:33 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org [2010.08.22 22:15:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com [2010.12.04 11:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen [2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au [2010.04.15 19:26:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam [2010.01.21 19:35:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com [2010.04.04 22:26:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu [2010.04.21 11:14:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au\chrome\mozapps\extensions [2010.10.13 19:28:25 | 000,001,998 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\grooveshark.xml [2010.10.13 19:29:01 | 000,001,330 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wikipedia-en.xml [2010.11.21 21:20:25 | 000,001,334 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\wiktionary-de.xml [2010.10.13 19:24:01 | 000,004,140 | ---- | M] () -- C:\Users\Christoph\AppData\Roaming\Mozilla\FireFox\Profiles\n7p6erg3.default\searchplugins\youtube.xml [2010.11.15 14:15:49 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010.08.23 12:05:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.15 14:15:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.03.27 17:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npContribute.dll [2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.07.12 17:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2009.10.26 15:53:52 | 000,102,400 | ---- | M] (Zylom) -- C:\Program Files (x86)\mozilla firefox\plugins\npzylomgamesplayer.dll [2010.10.24 12:35:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.10.24 12:35:08 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.10.24 12:35:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.10.24 12:35:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.10.24 12:35:08 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.08.02 11:47:25 | 000,001,028 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 im.adtech.de O1 - Hosts: 127.0.0.1 adserver.adtech.de O1 - Hosts: 127.0.0.1 adtech.de O1 - Hosts: 127.0.0.1 atwola.com O1 - Hosts: 127.0.0.1 adserver.71i.de O1 - Hosts: 127.0.0.1 adicqserver.71i.de O1 - Hosts: 127.0.0.1 71i.de O1 - Hosts: 127.0.0.1 activate.adobe.com O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll () O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (Lexmark ) - {D2C5E510-BE6D-42CC-9F61-E4F939078474} - C:\Programme\Lexmark Printable Web\bho.dll () O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll () O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000\..\Toolbar\WebBrowser: (Lexmark Symbolleiste) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Programme\Lexmark Toolbar\toolband.dll () O4:64bit: - HKLM..\Run: [EzPrint] C:\Program Files (x86)\Lexmark Pro200-S500 Series\ezprint.exe () O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) O4:64bit: - HKLM..\Run: [lxebmon.exe] C:\Program Files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe () O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe () O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [FeedDemon] C:\Program Files (x86)\FeedDemon\FeedDemon.exe (NewsGator Technologies, Inc.) O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [ICQ] C:\Program Files (x86)\ICQ6.5\ICQ.exe File not found O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe () O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [Pidgin] C:\Program Files (x86)\Pidgin\pidgin.exe (The Pidgin developer community) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\SysWow64\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: verbosestatus = 1 O8:64bit: - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation) O8 - Extra context menu item: Add to &Evernote - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~1\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation) O9 - Extra 'Tools' menuitem : Add to Evernote - {E0B8C461-F8FB-49b4-8373-FE32E92528A6} - C:\Program Files (x86)\Evernote\Evernote3.5\enbar.dll (Evernote Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\WB: DllName - Reg Error: Key error. - C:\PROGRA~2\Stardock\OBJECT~1\WINDOW~1\fast64.dll File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* MsConfig:64bit - StartUpReg: AdobeCS5ServiceManager - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: Bamboo Dock - hkey= - key= - C:\Program Files (x86)\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe () MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) MsConfig:64bit - StartUpReg: Steam - hkey= - key= - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) MsConfig:64bit - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) MsConfig:64bit - State: "bootini" - Reg Error: Key error. MsConfig:64bit - State: "services" - Reg Error: Key error. MsConfig:64bit - State: "startup" - Reg Error: Key error. SafeBootMin:64bit: AppMgmt - Service SafeBootMin:64bit: Base - Driver Group SafeBootMin:64bit: Boot Bus Extender - Driver Group SafeBootMin:64bit: Boot file system - Driver Group SafeBootMin:64bit: File system - Driver Group SafeBootMin:64bit: Filter - Driver Group SafeBootMin:64bit: HelpSvc - Service SafeBootMin:64bit: PCI Configuration - Driver Group SafeBootMin:64bit: PNP Filter - Driver Group SafeBootMin:64bit: Primary disk - Driver Group SafeBootMin:64bit: sacsvr - Service SafeBootMin:64bit: SCSI Class - Driver Group SafeBootMin:64bit: System Bus Extender - Driver Group SafeBootMin:64bit: vmms - Service SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet:64bit: AppMgmt - Service SafeBootNet:64bit: Base - Driver Group SafeBootNet:64bit: Boot Bus Extender - Driver Group SafeBootNet:64bit: Boot file system - Driver Group SafeBootNet:64bit: File system - Driver Group SafeBootNet:64bit: Filter - Driver Group SafeBootNet:64bit: HelpSvc - Service SafeBootNet:64bit: Messenger - Service SafeBootNet:64bit: NDIS Wrapper - Driver Group SafeBootNet:64bit: NetBIOSGroup - Driver Group SafeBootNet:64bit: NetDDEGroup - Driver Group SafeBootNet:64bit: Network - Driver Group SafeBootNet:64bit: NetworkProvider - Driver Group SafeBootNet:64bit: PCI Configuration - Driver Group SafeBootNet:64bit: PNP Filter - Driver Group SafeBootNet:64bit: PNP_TDI - Driver Group SafeBootNet:64bit: Primary disk - Driver Group SafeBootNet:64bit: rdsessmgr - Service SafeBootNet:64bit: sacsvr - Service SafeBootNet:64bit: SCSI Class - Driver Group SafeBootNet:64bit: Streams Drivers - Driver Group SafeBootNet:64bit: System Bus Extender - Driver Group SafeBootNet:64bit: TDI - Driver Group SafeBootNet:64bit: vmms - Service SafeBootNet:64bit: WudfUsbccidDriver - Driver SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32:64bit: VIDC.FPS1 - frapsv64.dll (Beepa P/L) Drivers32:64bit: VIDC.XFR1 - xfcodec64.dll () Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.vorbis - C:\Windows\SysWow64\vorbis.acm (HMS hxxp://hp.vector.co.jp/authors/VA012897/) Drivers32: VIDC.CFHD - C:\Windows\SysWow64\cfhd.dll (CineForm Inc.) Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) Drivers32: VIDC.FPS1 - C:\Windows\SysWow64\frapsvid.dll (Beepa P/L) Drivers32: vidc.XVID - C:\Windows\SysWow64\xvidvfw.dll () Drivers32: vidc.yv12 - C:\Windows\SysWow64\DivX.dll (DivX, Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2010.12.12 13:50:12 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe [2010.12.12 13:19:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\HiJackThis [2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.11.27 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\Tropico 3 [2010.11.26 23:31:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MockFlow [2010.11.26 22:14:14 | 000,000,000 | ---D | C] -- C:\ProgramData\WorldWindData [2010.11.23 15:12:43 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\sun [2010.11.16 18:45:38 | 000,836,608 | ---- | C] ( ) -- C:\Windows\SysNative\lxebcoin.dll [2010.11.15 14:15:48 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.11.15 14:15:48 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.11.14 20:19:23 | 000,905,728 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\synsoacc.dll [2010.11.14 20:19:16 | 000,031,248 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysNative\drivers\synUSB64.sys [2010.11.14 20:19:15 | 000,045,056 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\Synsopos.exe [2010.11.14 20:19:13 | 000,401,462 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\temp.000 [2010.11.14 20:19:08 | 000,757,760 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SYNSOACC.dll [2010.11.14 20:19:08 | 000,147,456 | ---- | C] (SIA Syncrosoft) -- C:\Windows\SysWow64\SynsoLChk.dll [2010.11.14 20:19:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Syncrosoft [2010.11.14 20:16:27 | 000,000,000 | ---D | C] -- C:\Install [2010.11.13 18:17:27 | 000,000,000 | ---D | C] -- C:\Programme\Blender [2010.06.01 17:23:13 | 000,364,544 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebinpa.dll [2010.06.01 17:23:12 | 000,344,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebiesc.dll [2010.06.01 17:23:11 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebpmui.dll [2010.06.01 17:23:10 | 001,048,576 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebserv.dll [2010.06.01 17:23:10 | 000,847,872 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebusb1.dll [2010.06.01 17:23:10 | 000,577,536 | ---- | C] ( ) -- C:\Windows\SysWow64\lxeblmpm.dll [2010.06.01 17:23:09 | 000,688,128 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebhbn3.dll [2010.06.01 17:23:08 | 000,802,816 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomc.dll [2010.06.01 17:23:08 | 000,372,736 | ---- | C] ( ) -- C:\Windows\SysWow64\lxebcomm.dll [4 C:\Windows\Fonts\*.tmp files -> C:\Windows\Fonts\*.tmp -> ] [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job [2010.12.12 13:50:15 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Users\Christoph\Desktop\OTL.exe [2010.12.12 13:48:00 | 000,001,134 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job [2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.12 13:19:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.12.12 13:05:13 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.12.12 12:56:07 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010.12.12 12:55:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.12.12 12:55:21 | 3214,237,696 | -HS- | M] () -- C:\hiberfil.sys [2010.12.11 19:00:38 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job [2010.12.09 22:03:24 | 000,001,239 | ---- | M] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk [2010.12.09 20:07:19 | 001,550,914 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.12.09 20:07:19 | 000,671,758 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.12.09 20:07:19 | 000,633,640 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.12.09 20:07:19 | 000,137,484 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.12.09 20:07:19 | 000,113,874 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.12.08 14:51:41 | 007,413,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.12.03 23:53:29 | 000,005,990 | ---- | M] () -- C:\Users\Christoph\.recently-used.xbel [2010.11.26 23:31:04 | 000,000,871 | ---- | M] () -- C:\Users\Public\Desktop\MockFlow.lnk [2010.11.22 14:17:01 | 000,083,120 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2010.11.16 21:07:36 | 000,215,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2010.11.16 18:46:50 | 000,226,478 | ---- | M] () -- C:\Windows\SysNative\LexFiles.ulf [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [10 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.12.10 22:40:53 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job [2010.12.10 22:40:49 | 000,000,302 | -H-- | C] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.10 22:40:46 | 000,000,300 | -H-- | C] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.12.09 22:03:24 | 000,001,239 | ---- | C] () -- C:\Users\Christoph\Desktop\Zwischenlagerung.lnk [2010.12.03 23:53:29 | 000,005,990 | ---- | C] () -- C:\Users\Christoph\.recently-used.xbel [2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\lxebsmr.dll [2010.11.16 18:45:41 | 000,024,064 | ---- | C] () -- C:\Windows\SysNative\lxebsmr.dll [2010.11.16 18:45:37 | 000,450,048 | ---- | C] () -- C:\Windows\SysNative\lxebins.dll [2010.11.16 18:45:37 | 000,399,360 | ---- | C] () -- C:\Windows\SysNative\lxebcui.dll [2010.11.16 18:45:37 | 000,378,368 | ---- | C] () -- C:\Windows\SysNative\lxebcu.dll [2010.11.16 18:45:37 | 000,245,248 | ---- | C] () -- C:\Windows\SysNative\lxebinsb.dll [2010.11.16 18:45:37 | 000,148,480 | ---- | C] () -- C:\Windows\SysNative\lxebcuir.dll [2010.11.16 18:45:37 | 000,065,536 | ---- | C] () -- C:\Windows\SysNative\lxebgcfg.dll [2010.11.14 20:19:23 | 000,147,425 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Aide.chm [2010.11.14 20:19:23 | 000,120,468 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Hilfe.chm [2010.11.14 20:19:23 | 000,114,279 | ---- | C] () -- C:\Windows\SysNative\SYNSOACC-Help.chm [2010.11.14 20:19:22 | 000,147,425 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Aide.chm [2010.11.14 20:19:22 | 000,120,468 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Hilfe.chm [2010.11.14 20:19:22 | 000,114,279 | ---- | C] () -- C:\Windows\SysWow64\SYNSOACC-Help.chm [2010.10.31 18:42:32 | 000,000,016 | ---- | C] () -- C:\Windows\SysWow64\msvcsv60.dll [2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\LxWbGwLog.log [2010.07.19 19:23:11 | 000,000,000 | ---- | C] () -- C:\ProgramData\cmn_upld.log [2010.07.18 19:09:49 | 000,819,200 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2010.07.18 19:09:48 | 000,180,224 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2010.06.24 15:58:17 | 001,508,283 | ---- | C] () -- C:\Program Files (x86)\Euthymia Electronic Organ V2.dll [2010.06.19 14:20:18 | 000,013,256 | ---- | C] () -- C:\ProgramData\lxebJSW.log [2010.06.01 22:48:18 | 000,000,000 | ---- | C] () -- C:\Users\Christoph\AppData\Local\eab2d51e-4aba-4bfa-b171-72e2c2a32088 [2010.06.01 17:47:11 | 000,000,675 | ---- | C] () -- C:\ProgramData\lxebDiagnostics.log [2010.06.01 17:28:38 | 000,000,252 | ---- | C] () -- C:\ProgramData\FastPics.log [2010.06.01 17:27:23 | 000,000,394 | ---- | C] () -- C:\ProgramData\lxeb.log [2010.06.01 17:25:02 | 000,026,813 | ---- | C] () -- C:\ProgramData\lxebscan.log [2010.06.01 17:23:13 | 000,344,064 | ---- | C] () -- C:\Windows\SysWow64\lxebcomx.dll [2010.06.01 17:23:13 | 000,331,776 | ---- | C] () -- C:\Windows\SysWow64\LXEBinst.dll [2010.06.01 17:23:12 | 000,114,688 | ---- | C] () -- C:\Windows\SysWow64\lxebinsr.dll [2010.06.01 17:23:12 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\lxebjswr.dll [2010.06.01 17:23:11 | 000,323,584 | ---- | C] () -- C:\Windows\SysWow64\lxebins.dll [2010.06.01 17:23:11 | 000,262,144 | ---- | C] () -- C:\Windows\SysWow64\lxebinsb.dll [2010.06.01 17:23:11 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\lxebcur.dll [2010.06.01 17:23:10 | 000,253,952 | ---- | C] () -- C:\Windows\SysWow64\lxebcu.dll [2010.06.01 17:23:10 | 000,090,112 | ---- | C] () -- C:\Windows\SysWow64\lxebcub.dll [2010.06.01 17:22:32 | 000,000,000 | ---- | C] () -- C:\ProgramData\UpdaterLog.txt [2010.06.01 17:22:21 | 000,299,008 | ---- | C] () -- C:\Windows\SysWow64\LXEBsm.dll [2010.05.05 14:04:09 | 000,000,031 | ---- | C] () -- C:\Windows\SysWow64\m12vt4osini.dll [2010.04.27 20:49:19 | 000,007,597 | ---- | C] () -- C:\Users\Christoph\AppData\Local\resmon.resmoncfg [2010.04.18 21:47:31 | 000,028,672 | ---- | C] () -- C:\Windows\SysWow64\NSREG.DLL [2010.04.09 18:48:18 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI [2010.03.15 11:53:09 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini [2010.02.04 21:30:19 | 000,110,080 | ---- | C] () -- C:\Windows\SysWow64\advd.dll [2010.02.04 21:30:19 | 000,023,040 | ---- | C] () -- C:\Windows\SysWow64\auth.dll [2010.02.04 21:30:18 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\lame_enc.dll [2010.02.03 19:10:53 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.01.03 11:08:43 | 000,000,031 | ---- | C] () -- C:\Windows\iexplore.ini [2009.12.30 19:32:27 | 000,164,992 | ---- | C] () -- C:\Windows\SysWow64\drivers\athsgt.sys [2009.12.30 19:32:27 | 000,012,544 | ---- | C] () -- C:\Windows\SysWow64\drivers\limsgt.sys [2009.12.29 18:12:31 | 001,551,964 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\StarOpen.sys [2006.12.08 13:58:14 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\FxShared.dll [2006.12.08 02:52:50 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\com.fxpansion.fxshared.dll [1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\D81EDBF9-D167-4011-B77D-211DF920EB80 [1999.07.07 01:00:00 | 000,000,006 | RHS- | C] () -- C:\ProgramData\4C3B2B99-ECAA-4D9D-B9D5-9F7442A71C71 ========== LOP Check ========== [2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft [2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple [2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design [2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft [2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems [2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org [2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore [2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe [2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation [2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc [2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge [2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH [2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage [2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer [2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1 [2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design [2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot [2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org [2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org [2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000 [2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo [2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg [2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0 [2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore [2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn [2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape [2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host [2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy [2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts [2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX [2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad [2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow [2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag [2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound [2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World [2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++ [2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc [2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org [2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera [2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy [2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite [2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer [2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst [2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers [2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1 [2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung [2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM [2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra [2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel [2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony [2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds [2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird [2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian [2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3 [2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt [2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software [2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1 [2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft [2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent [2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft [2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom [2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1 [2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5 [2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D [2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch [2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode [2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems [2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom [2010.02.10 21:04:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\TuneUp Software [2010.02.10 21:02:44 | 000,000,000 | ---D | M] -- C:\Users\Mit Gästen\AppData\Roaming\WTouch [2010.09.15 12:36:12 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job [2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2010.09.05 11:40:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.minecraft [2010.12.12 13:46:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\.purple [2010.11.26 23:24:47 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Adobe [2009.12.29 18:54:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ambient Design [2009.12.29 18:55:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\AMPSoft [2010.01.15 23:34:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Apple Computer [2010.01.22 15:15:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Applied Acoustics Systems [2010.05.12 11:08:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Aurora.org [2010.03.25 18:22:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Avira [2010.10.19 20:59:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Explore [2010.01.28 15:16:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bamboo Scribe [2009.12.29 18:57:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Blender Foundation [2010.05.03 13:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Bump Technologies, Inc [2010.02.19 14:00:09 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\CasualForge [2010.02.25 18:13:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Celemony Software GmbH [2010.12.09 22:21:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.02.16 19:52:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Clonk Rage [2010.08.20 21:45:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ColorSchemer [2010.03.31 14:30:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1 [2010.02.04 21:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\concept design [2010.07.11 12:09:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Dexpot [2010.07.11 14:42:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\DivX [2010.12.04 20:43:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\dvdcss [2010.01.07 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\flightgear.org [2010.01.07 13:38:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\fltk.org [2010.03.15 12:29:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\foobar2000 [2010.05.30 16:38:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\GetRightToGo [2010.12.04 18:35:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gnupg [2010.03.21 14:30:54 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Google [2010.12.04 20:48:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\gtk-2.0 [2010.09.14 19:55:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hamachi [2010.01.17 15:20:35 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Hardcore [2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Identities [2010.05.25 11:17:15 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ImgBurn [2010.01.03 17:37:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\inkscape [2010.01.02 18:29:30 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\InstallShield [2010.01.22 15:41:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Juce VST Host [2010.05.24 21:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Lindy [2010.09.20 13:35:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\LucasArts [2010.02.10 14:07:25 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Macromedia [2010.07.13 17:07:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MAGIX [2010.05.16 12:39:40 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\McLoad [2009.07.14 19:18:18 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Media Center Programs [2010.10.17 18:54:29 | 000,000,000 | --SD | M] -- C:\Users\Christoph\AppData\Roaming\Microsoft [2010.11.01 23:09:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\MockFlow [2010.01.02 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mozilla [2010.01.04 22:39:03 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Mp3tag [2010.06.25 22:41:44 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NCH Swift Sound [2010.09.23 15:50:10 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Need for Speed World [2010.01.06 22:01:13 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Nero [2009.12.30 16:40:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Notepad++ [2010.08.26 21:37:14 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\NVIDIA [2010.09.27 15:54:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenCube Inc [2010.01.03 16:05:39 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\OpenOffice.org [2010.01.15 23:33:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Opera [2010.08.01 15:59:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PACE Anti-Piracy [2010.01.13 15:54:56 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PC Suite [2010.06.09 21:28:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PDF Writer [2010.02.19 23:17:05 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\PlayFirst [2009.12.29 18:17:08 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Publish Providers [2010.08.02 13:14:22 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ResourceCentral.E6E1B28A311BC518DB6C6883EA3757FDE0E90ADC.1 [2010.09.26 15:09:51 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Samsung [2010.01.10 21:49:29 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ScummVM [2010.06.25 16:07:48 | 000,000,000 | RH-D | M] -- C:\Users\Christoph\AppData\Roaming\SecuROM [2010.03.04 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sierra [2010.07.29 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sigel [2010.12.02 19:21:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Skype [2010.06.17 17:23:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\skypePM [2010.07.11 21:15:11 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Sony [2010.08.01 15:59:59 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.01.01 16:17:46 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Teeworlds [2010.02.14 11:38:32 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Thunderbird [2010.10.28 16:50:48 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Trillian [2010.12.04 12:55:12 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Tropico 3 [2010.10.29 14:24:53 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TrueCrypt [2010.01.17 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TuneUp Software [2010.07.08 17:05:07 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1 [2010.03.21 13:18:26 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Ubisoft [2010.11.15 18:33:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\uTorrent [2010.02.18 14:29:24 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\ValuSoft [2010.12.11 19:09:57 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\vlc [2010.03.02 19:24:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\VMware [2010.10.19 21:09:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wacom [2010.10.19 21:09:45 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1 [2010.11.10 19:28:58 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Warsow 0.5 [2010.12.02 21:32:04 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Winamp [2009.12.30 19:30:31 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Wings3D [2010.02.13 14:35:43 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WinRAR [2010.12.12 12:56:34 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTablet [2010.01.28 14:11:52 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\WTouch [2010.11.02 13:49:00 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\XMedia Recode [2010.05.19 13:52:55 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Z-Systems [2010.02.19 23:17:02 | 000,000,000 | ---D | M] -- C:\Users\Christoph\AppData\Roaming\Zylom < %APPDATA%\*.exe /s > [2010.11.02 12:38:36 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Christoph\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2010.08.01 14:09:12 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe [2010.01.03 15:55:40 | 000,010,134 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\Foren.exe [2010.01.03 15:55:40 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{20B1B020-DEAE-48D1-9960-D4C3185D758B}\htmledit.exe [2010.12.12 13:19:48 | 000,388,096 | R--- | M] (Trend Micro Inc.) -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe [2010.01.04 14:12:35 | 000,000,766 | R--- | M] () -- C:\Users\Christoph\AppData\Roaming\Microsoft\Installer\{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}\ARPPRODUCTICON.exe [2010.08.19 22:46:28 | 001,312,120 | ---- | M] (EA Digital Illusions CE AB) -- C:\Users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\BFHUpdater.exe [2010.09.26 15:44:24 | 089,280,248 | ---- | M] (Samsung Electronics Co., Ltd. ) -- C:\Users\Christoph\AppData\Roaming\Samsung\New PC Studio\LiveUpdate\Setup_For_Full_Update_IH2_7.exe < %SYSTEMDRIVE%\*.exe > [2007.11.07 08:44:20 | 000,855,040 | ---- | M] (Microsoft Corporation) -- C:\install.exe < MD5 for: AGP440.SYS > [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys [2009.07.14 02:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys [2009.07.14 02:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll [2009.07.14 02:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2009.12.19 23:00:00 | 000,037,520 | ---- | M] (perl.org) MD5=2852D57385C4709EAAE2F9DB01AD3672 -- C:\Users\Christoph\Christoph\Produktionen\Webdesign\In Bearbeitung\xampp\perl\site\lib\auto\Win32\EventLog\EventLog.dll < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.11.27 09:49:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2009.11.27 09:49:23 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: IASTOR.SYS > [2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iaahci.inf_amd64_neutral_7fb62b08f6b7117a\iaStor.sys [2009.06.04 17:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastor.inf_amd64_neutral_c065a1006c648409\iaStor.sys < MD5 for: IASTORV.SYS > [2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 02:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 02:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll [2009.07.14 02:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll [2009.07.14 02:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.07.14 02:15:13 | 000,346,112 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtmsft.dll [2009.07.14 02:15:13 | 000,215,552 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\SysWOW64\dxtrans.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:DD4DD9B9 < End of report > Extras: Code:
ATTFilter OTL Extras logfile created on: 12.12.2010 13:51:25 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Christoph\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 54,00% Memory free
8,00 Gb Paging File | 6,00 Gb Available in Paging File | 72,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465,75 Gb Total Space | 240,58 Gb Free Space | 51,65% Space Free | Partition Type: NTFS
Drive D: | 232,83 Gb Total Space | 27,28 Gb Free Space | 11,72% Space Free | Partition Type: NTFS
Drive F: | 180,37 Gb Total Space | 136,02 Gb Free Space | 75,41% Space Free | Partition Type: NTFS
Computer Name: CHRISTOPH-PC | User Name: Christoph | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- F:\Computer\Handy\dirhtml\dirhtml\ad\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~2\MICROS~1\Office12\ONENOTE.EXE "%L" File not found
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B8565BA-BAD5-4732-B122-5FD78EFC50A9}" = Native Instruments Service Center
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{41BF0DE4-5BAE-4B88-AFD3-86A30B222186}" = Bonjour
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{50CBBEC7-1010-41C5-8718-A1A6FEDD9C3A}" = GEAR driver installer for AMD64 and Intel EM64T
"{563F041C-DFDB-437B-A1E8-E141E0906076}" = Microsoft IntelliPoint 8.0
"{6BED4DFE-C527-463E-B93A-6F6848B74DD0}" = Native Instruments Battery 3
"{70AC9B8B-5DC4-4E5E-964B-2A695D157FCB}" = Sun VirtualBox
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"BC15EA930074932BB2C4B4493C9FD4EA95087D1A" = Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.1.0.1159
"CCleaner" = CCleaner
"Lexmark Pro200-S500 Series" = Lexmark Pro200-S500 Series
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver Drive" = Samsung Mobile phone USB driver Drive Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"UDK-253020cb-36fa-46d8-b003-ff05a0f0d427" = Unreal Development Kit: 2010-01
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}" = Visual C++ 8.0 Runtime Setup Package (x64)
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0341796A-9224-48FB-AAE1-4079C7AE375E}" = DDXRenderer
"{03534DA5-2F88-4B8E-A978-849B979E1B8F}" = TuxGuitar
"{03DEAAE3-8668-70F6-8E11-2FE466B63806}" = MockFlow Desktop
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{08581E23-EC5B-4AEC-8DB9-F186D751129F}" = Bamboo Scribe Shared Files
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F4B91C5-4524-02A6-1D9B-5AE52CE2E0F4}" = Bamboo Dock
"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Symbolleiste
"{10812DE7-2E57-4740-B226-6B3BE34AF9D7}" = Lexmark Tools for Office
"{15A60757-91A9-8875-17C4-7E5C4A7E17AF}" = Livebrush Mini
"{171E6C1E-B5FC-11DF-B115-005056C00008}" = Google Earth Plug-in
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1AC38EA5-454C-4443-834F-6B34106581E1}" = Sony DVD Architect 4.0
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{2348B586-C9AE-46CE-936C-A68E9426E214}" = Nero StartSmart Help
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 22
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}" = GTA2
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{29F05234-DCBB-4FE0-88DC-5160C9250312}" = Adobe Photoshop CS3
"{2B7E4354-0492-460A-BDB1-1F59EE141025}" = AirPlus XtremeG DWL-G122
"{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed
"{3763A2B4-B07A-4E4D-994D-7D2C6AF0CF9E}" = Safari
"{388E4B09-3E71-4649-8921-F44A3A2954A7}" = Microsoft Visual Studio 2005 Tools for Office Runtime
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{41785C66-90F2-40CE-8CB5-1C94BFC97280}" = Microsoft Chart Controls for Microsoft .NET Framework 3.5
"{45873324-094C-4516-A84A-134A175A1CD6}" = PDFExport
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4723f199-fa64-4233-8e6e-9fccc95a18ee}" = Python 2.6.5
"{47CC1AED-3A94-47FC-AE9D-902C55B1AE7D}" = Microsoft® Office-Add-In for Moodle
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{548CDAD3-9144-4B04-977C-30CAB4838976}" = Grip points
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57E7F262-3B6A-403E-81C2-E9D2B196D00C}" = DDXSheetSets
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6559654F-2F38-491F-8411-211517C3E635}" = SampleTank FREE
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart
"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7BD0D8F8-A13C-48D2-B201-4AD29A48AF34}" = Google SketchUp 7
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II
"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed
"{88871882-f889-4732-b8dc-87f31cdcde40}" = Nero 9 Essentials
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8CFA9151-6404-409A-AF22-4632D04582FD}" = Assassin's Creed
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISER_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISER_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISER_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISER_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISER_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISER_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISER_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0030-0000-0000-0000000FF1CE}_ENTERPRISER_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92377672-DF6E-4D7C-AFFC-50B01254C488}" = DDXViewX
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{96965E6C-41DB-4E0A-BC65-D92381D51D2A}" = Sony Vegas 7.0
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A5101403-2C42-40E0-8D9E-5E49E7C3B89E}" = Tycoon City - New York
"{A7385936-7917-4210-9471-ECDF300D1D02}" = DWGdirectX Core
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A837BCE6-BCB1-4A44-8807-A678EAF06933}" = ANNO 1404 Entwickler-Tools
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{B9BD670E-E9BF-494A-9843-F20C13EE8C4C}" = ArtRage 2
"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C51496B3-E15E-41D8-B812-9492E4EC86E0}" = DDX DWF Support
"{C81A2FE0-3574-00A9-CED4-BDAA334CBE8E}" = Nero Online Upgrade
"{C9E129BC-27D3-436E-BAAC-4CE81E0962F1}" = Sony Media Manager 2.2
"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help
"{CD7DB485-A1D7-4FA5-B66B-587CFF6CA361}" = DDX Field Evaluator
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D2C5E510-BE6D-42CC-9F61-E4F939078474}" = Lexmark
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E09B48B5-E141-427A-AB0C-D3605127224A}" = Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E5C7D048-F9B4-4219-B323-8BDB01A2563D}" = Nero DriveSpeed Help
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EC9A0711-9823-4DD2-83C4-039886A3ECF6}" = Melodyne 3.2 Demo
"{EC9F368A-79DC-4AAE-907A-FC02D512034E}" = RippMe
"{F01F79AD-1F47-4685-AE4E-CCFA4EA9FF7C}" = Adobe Setup
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter
"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help
"{F761359C-9CED-45AE-9A51-9D6605CD55C4}" = Evernote
"{FB8148DD-C575-4B0A-9F6C-0CFC46937930}" = Opera 10.10
"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe_5f143314a5d434c8511097393d17397" = Adobe Photoshop CS3
"Afterburner" = MSI Afterburner 1.0.0
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Bamboo Dock" = Bamboo Dock 3.3
"Bamboo Explore" = Bamboo Explore
"Bamboo Scribe_is1" = Bamboo Scribe
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"com.livebrush.2205ABAA7E8202CDC1251B1FA1E879364B7BAB52.1" = Livebrush Mini
"DivX Setup.divx.com" = DivX-Setup
"DVD Shrink_is1" = DVD Shrink 3.2
"Edirol HQ Orchestral VSTi v1.03" = Edirol HQ Orchestral VSTi v1.03
"ENTERPRISER" = Microsoft Office Enterprise 2007
"FeedDemon_is1" = FeedDemon
"FL Studio 9" = FL Studio 9
"foobar2000" = foobar2000 v1.0.1
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"GameSpy Arcade" = GameSpy Arcade
"GnuPG" = GNU Privacy Guard
"GPL Ghostscript 8.64" = GPL Ghostscript 8.64
"Grand Theft Auto" = Grand Theft Auto
"Hamachi" = Hamachi 1.0.1.5
"Hardcore" = Hardcore
"iecollection_is1" = Internet Explorer Collection 1.6.0.4
"IETester" = IETester v0.4.4 (remove only)
"IL Download Manager" = IL Download Manager
"ImgBurn" = ImgBurn
"Inkscape" = Inkscape 0.47
"LeechFTP" = LeechFTP
"LMMS 0.4.6" = Linux MultiMedia Studio (LMMS)
"Microsoft Visual Studio 2005 Tools for Office Runtime" = Visual Studio 2005 Tools for Office Second Edition Runtime
"MockFlow" = MockFlow Desktop
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"Mozilla Thunderbird (3.1.4)" = Mozilla Thunderbird (3.1.4)
"Mp3tag" = Mp3tag v2.45a
"MSTTS" = Microsoft Text-to-Speech Engine 4.0 (English)
"Native Instruments Absynth 4" = Native Instruments Absynth 4
"Native Instruments Battery 3" = Native Instruments Battery 3
"Native Instruments FM8" = Native Instruments FM8
"Native Instruments Massive" = Native Instruments Massive
"Native Instruments Pro-53" = Native Instruments Pro-53
"Native Instruments Service Center" = Native Instruments Service Center
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Pen Tablet Driver" = Bamboo
"Pidgin" = Pidgin
"PoiZone" = PoiZone
"PunkBusterSvc" = PunkBuster Services
"RocketDock_is1" = RocketDock 1.3.5
"Sakura" = Sakura
"Sawer" = Sawer
"Scribus 1.3.3.13" = Scribus 1.3.3.13
"ScummVM_is1" = ScummVM 1.0.0
"Sigel Professional Label Software SE" = Sigel Professional Label Software SE
"Sonik Synth 2 Free" = Sonik Synth 2 Free
"Steam App 23490" = Tropico 3 - Steam Special Edition
"Steam App 32360" = The Secret of Monkey Island: Special Edition
"Steam App 32460" = Monkey Island 2: Special Edition
"Steam App 37600" = Windosill
"Steam App 410" = Portal: The First Slice
"Steam App 57600" = Tropico 3: Absolute Power
"Steam App 630" = Alien Swarm
"Steam App 640" = Alien Swarm - SDK
"Syncrosoft License Control" = Syncrosoft Lizenz Kontrolle
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.1
"Toxic Biohazard" = Toxic Biohazard
"TrueCrypt" = TrueCrypt
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.5
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
"WavePad" = WavePad Sound Editor
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.10
"Wings 3D 1.0.1" = Wings 3D 1.0.1
"XMedia Recode" = XMedia Recode 2.2.7.7
"Xvid_is1" = Xvid 1.2.2 final uninstall
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dexpot" = Dexpot
"Google Chrome" = Google Chrome
"NCsoft-Exteel" = Exteel (US)
"Winamp Detect" = Winamp Anwendungserkennung
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 11.12.2010 10:40:45 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 9001
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 10015
Error - 11.12.2010 10:40:46 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10015
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 11014
Error - 11.12.2010 10:40:47 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 11014
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 12012
Error - 11.12.2010 10:40:48 | Computer Name = Christoph-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 12012
[ Media Center Events ]
Error - 03.02.2010 06:07:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:17 - Fehler beim Herstellen der Internetverbindung. 11:07:17
- Serververbindung konnte nicht hergestellt werden..
Error - 03.02.2010 06:07:26 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 11:07:22 - Fehler beim Herstellen der Internetverbindung. 11:07:22
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 07:35:09 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:08 - Fehler beim Herstellen der Internetverbindung. 13:35:09
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 07:35:31 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 13:35:15 - Fehler beim Herstellen der Internetverbindung. 13:35:15
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 08:35:37 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:37 - Fehler beim Herstellen der Internetverbindung. 14:35:37
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 08:35:43 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 14:35:42 - Fehler beim Herstellen der Internetverbindung. 14:35:42
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 09:43:58 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:43:57 - Fehler beim Herstellen der Internetverbindung. 15:43:57
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 09:44:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 15:44:03 - Fehler beim Herstellen der Internetverbindung. 15:44:03
- Serververbindung konnte nicht hergestellt werden..
Error - 04.10.2010 22:31:45 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:31:45 - Fehler beim Herstellen der Internetverbindung. 04:31:45
- Serververbindung konnte nicht hergestellt werden..
Error - 04.10.2010 22:32:17 | Computer Name = Christoph-PC | Source = MCUpdate | ID = 0
Description = 04:32:14 - Fehler beim Herstellen der Internetverbindung. 04:32:14
- Serververbindung konnte nicht hergestellt werden..
[ OSession Events ]
Error - 25.05.2010 06:14:44 | Computer Name = Christoph-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 55
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 11.12.2010 07:21:00 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
Error - 11.12.2010 07:28:57 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
Error - 11.12.2010 07:52:58 | Computer Name = Christoph-PC | Source = bowser | ID = 8003
Description =
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\athsgt.sys
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 12.12.2010 07:55:43 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "athsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\DRIVERS\limsgt.sys
nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
des Treibers zu erhalten.
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "limsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
lxebCATSCustConnectService erreicht.
Error - 12.12.2010 07:55:45 | Computer Name = Christoph-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lxebCATSCustConnectService" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 12.12.2010 07:56:47 | Computer Name = Christoph-PC | Source = DCOM | ID = 10016
Description =
< End of report >
|
|
12.12.2010, 14:44
| #4 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnx.exe () PRC - C:\Users\Christoph\AppData\Local\Temp\Rnv.exe () PRC - C:\Users\CHRIST~1\AppData\Local\Temp\Rnw.exe () O4 - HKU\S-1-5-21-3813913343-2729911108-1179361101-1000..\Run: [JP595IR86O] C:\Users\Christoph\AppData\Local\Temp\Rnv.exe () [2010.12.09 22:21:34 | 000,000,000 | ---D | C] -- C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 [2010.12.12 13:52:05 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job [2010.12.12 13:43:30 | 000,000,302 | -H-- | M] () -- C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2010.12.12 13:06:27 | 000,000,300 | -H-- | M] () -- C:\Windows\tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job :Files :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten. öffne mein computer, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.12.2010, 15:02
| #5 |
| | Internet Explorer öffnet automatisch WerbungCode:
ATTFilter All processes killed
========== OTL ==========
No active process named Rnx.exe was found!
No active process named Rnv.exe was found!
No active process named Rnw.exe was found!
Registry value HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Run\\JP595IR86O deleted successfully.
C:\Users\Christoph\AppData\Local\Temp\Rnv.exe moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg\de_DE folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\HelpCfg folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#SharedObjects folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store\#ApplicationUpdater folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1\Local Store folder moved successfully.
C:\Users\Christoph\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 folder moved successfully.
C:\Windows\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job moved successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job moved successfully.
C:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.job moved successfully.
========== FILES ==========
========== COMMANDS ==========
[EMPTYFLASH]
User: All Users
User: Christoph
->Flash cache emptied: 60817 bytes
User: Default
->Flash cache emptied: 56502 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Mit Gästen
User: Public
Total Flash Files Cleaned = 0,00 mb
[EMPTYTEMP]
User: All Users
User: Christoph
->Temp folder emptied: 178073082 bytes
->Temporary Internet Files folder emptied: 86746521 bytes
->Java cache emptied: 38798320 bytes
->FireFox cache emptied: 105115126 bytes
->Google Chrome cache emptied: 12916663 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 1787727 bytes
->Flash cache emptied: 0 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Mit Gästen
->Temp folder emptied: 32799 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 155648 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 36168 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 701976 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 1844458 bytes
Total Files Cleaned = 407,00 mb
OTL by OldTimer - Version 3.2.17.3 log created on 12122010_145442
Files\Folders moved on Reboot...
C:\Users\Christoph\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Windows\temp\TMP00000554C0B6FC6017459710 moved successfully.
Registry entries deleted on Reboot...
Die Moved Files Datei ist hochgeladen als movedfiles.rar_1 oder so ähnlich. |
|
12.12.2010, 15:06
| #6 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung wunderbar. pc neustarten. bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ --> Internet Explorer öffnet automatisch Werbung |
|
12.12.2010, 15:31
| #7 |
| | Internet Explorer öffnet automatisch WerbungCode:
ATTFilter ComboFix 10-12-11.06 - Christoph 12.12.2010 15:21:23.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.4087.2776 [GMT 1:00]
ausgeführt von:: c:\users\Christoph\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Install.exe
c:\program files\Blender
c:\program files\Blender\.blender\.bfont.ttf
c:\program files\Blender\.blender\.Blanguages
c:\program files\Blender\.blender\Bpymenus
c:\program files\Blender\.blender\locale\ar\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\bg\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ca\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\cs\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\de\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\el\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\es\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fi\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\fr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\hr_HR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\it\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ja\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ko\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\nl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pl\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\pt_BR\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ro\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\ru\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr@Latn\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sr\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\sv\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\uk\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\locale\zh_CN\LC_MESSAGES\blender.mo
c:\program files\Blender\.blender\scripts\3ds_export.py
c:\program files\Blender\.blender\scripts\3ds_import.py
c:\program files\Blender\.blender\scripts\ac3d_export.py
c:\program files\Blender\.blender\scripts\ac3d_import.py
c:\program files\Blender\.blender\scripts\add_mesh_empty.py
c:\program files\Blender\.blender\scripts\add_mesh_torus.py
c:\program files\Blender\.blender\scripts\animation_bake_constraints.py
c:\program files\Blender\.blender\scripts\animation_clean.py
c:\program files\Blender\.blender\scripts\animation_trajectory.py
c:\program files\Blender\.blender\scripts\armature_symmetry.py
c:\program files\Blender\.blender\scripts\Axiscopy.py
c:\program files\Blender\.blender\scripts\bevel_center.py
c:\program files\Blender\.blender\scripts\blenderLipSynchro.py
c:\program files\Blender\.blender\scripts\bpydata\config\readme.txt
c:\program files\Blender\.blender\scripts\bpydata\KUlang.txt
c:\program files\Blender\.blender\scripts\bpydata\readme.txt
c:\program files\Blender\.blender\scripts\bpymodules\blend2renderinfo.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyAddMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyArmature.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyBlender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyCurve.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyImage.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMathutils.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMesh_redux.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyMessages.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyNMesh.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyObject.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRegistry.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyRender.py
c:\program files\Blender\.blender\scripts\bpymodules\BPySys.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyTextPlugin.py
c:\program files\Blender\.blender\scripts\bpymodules\BPyWindow.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\__init__.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\collada.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cstartup.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\cutils.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\helperObjects.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\logo.png
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\translator.py
c:\program files\Blender\.blender\scripts\bpymodules\colladaImEx\xmlUtils.py
c:\program files\Blender\.blender\scripts\bpymodules\defaultdoodads.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfColorMap.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfLibrary.py
c:\program files\Blender\.blender\scripts\bpymodules\dxfReader.py
c:\program files\Blender\.blender\scripts\bpymodules\mesh_gradient.py
c:\program files\Blender\.blender\scripts\bpymodules\meshtools.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_ai2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_eps2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_gimp2obj.py
c:\program files\Blender\.blender\scripts\bpymodules\paths_svg2obj.py
c:\program files\Blender\.blender\scripts\bvh_import.py
c:\program files\Blender\.blender\scripts\c3d_import.py
c:\program files\Blender\.blender\scripts\camera_changer.py
c:\program files\Blender\.blender\scripts\collada_export.py
c:\program files\Blender\.blender\scripts\collada_import.py
c:\program files\Blender\.blender\scripts\colladaExport14.py
c:\program files\Blender\.blender\scripts\colladaImport14.py
c:\program files\Blender\.blender\scripts\config.py
c:\program files\Blender\.blender\scripts\console.py
c:\program files\Blender\.blender\scripts\DirectX8Exporter.py
c:\program files\Blender\.blender\scripts\DirectX8Importer.py
c:\program files\Blender\.blender\scripts\discombobulator.py
c:\program files\Blender\.blender\scripts\envelope_symmetry.py
c:\program files\Blender\.blender\scripts\export-iv-0.1.py
c:\program files\Blender\.blender\scripts\export_dxf.py
c:\program files\Blender\.blender\scripts\export_fbx.py
c:\program files\Blender\.blender\scripts\export_lightwave_motion.py
c:\program files\Blender\.blender\scripts\export_m3g.py
c:\program files\Blender\.blender\scripts\export_map.py
c:\program files\Blender\.blender\scripts\export_mdd.py
c:\program files\Blender\.blender\scripts\export_obj.py
c:\program files\Blender\.blender\scripts\faceselect_same_weights.py
c:\program files\Blender\.blender\scripts\flt_defaultp.py
c:\program files\Blender\.blender\scripts\flt_dofedit.py
c:\program files\Blender\.blender\scripts\flt_export.py
c:\program files\Blender\.blender\scripts\flt_filewalker.py
c:\program files\Blender\.blender\scripts\flt_import.py
c:\program files\Blender\.blender\scripts\flt_lodedit.py
c:\program files\Blender\.blender\scripts\flt_palettemanager.py
c:\program files\Blender\.blender\scripts\flt_properties.py
c:\program files\Blender\.blender\scripts\flt_toolbar.py
c:\program files\Blender\.blender\scripts\help_bpy_api.py
c:\program files\Blender\.blender\scripts\help_browser.py
c:\program files\Blender\.blender\scripts\help_getting_started.py
c:\program files\Blender\.blender\scripts\help_manual.py
c:\program files\Blender\.blender\scripts\help_release_notes.py
c:\program files\Blender\.blender\scripts\help_tutorials.py
c:\program files\Blender\.blender\scripts\help_web_blender.py
c:\program files\Blender\.blender\scripts\help_web_devcomm.py
c:\program files\Blender\.blender\scripts\help_web_eshop.py
c:\program files\Blender\.blender\scripts\help_web_usercomm.py
c:\program files\Blender\.blender\scripts\hotkeys.py
c:\program files\Blender\.blender\scripts\IDPropBrowser.py
c:\program files\Blender\.blender\scripts\image_2d_cutout.py
c:\program files\Blender\.blender\scripts\image_auto_layout.py
c:\program files\Blender\.blender\scripts\image_billboard.py
c:\program files\Blender\.blender\scripts\image_edit.py
c:\program files\Blender\.blender\scripts\import_dxf.py
c:\program files\Blender\.blender\scripts\import_edl.py
c:\program files\Blender\.blender\scripts\import_lightwave_motion.py
c:\program files\Blender\.blender\scripts\import_mdd.py
c:\program files\Blender\.blender\scripts\import_obj.py
c:\program files\Blender\.blender\scripts\import_web3d.py
c:\program files\Blender\.blender\scripts\lightwave_export.py
c:\program files\Blender\.blender\scripts\lightwave_import.py
c:\program files\Blender\.blender\scripts\md2_export.py
c:\program files\Blender\.blender\scripts\md2_import.py
c:\program files\Blender\.blender\scripts\mesh_boneweight_copy.py
c:\program files\Blender\.blender\scripts\mesh_cleanup.py
c:\program files\Blender\.blender\scripts\mesh_edges2curves.py
c:\program files\Blender\.blender\scripts\mesh_mirror_tool.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce.py
c:\program files\Blender\.blender\scripts\mesh_poly_reduce_grid.py
c:\program files\Blender\.blender\scripts\mesh_skin.py
c:\program files\Blender\.blender\scripts\mesh_solidify.py
c:\program files\Blender\.blender\scripts\mesh_unfolder.py
c:\program files\Blender\.blender\scripts\mesh_wire.py
c:\program files\Blender\.blender\scripts\ms3d_import.py
c:\program files\Blender\.blender\scripts\ms3d_import_ascii.py
c:\program files\Blender\.blender\scripts\obdatacopier.py
c:\program files\Blender\.blender\scripts\object_active_to_other.py
c:\program files\Blender\.blender\scripts\object_apply_def.py
c:\program files\Blender\.blender\scripts\object_batch_name_edit.py
c:\program files\Blender\.blender\scripts\object_cookie_cutter.py
c:\program files\Blender\.blender\scripts\object_drop.py
c:\program files\Blender\.blender\scripts\object_find.py
c:\program files\Blender\.blender\scripts\object_random_loc_sz_rot.py
c:\program files\Blender\.blender\scripts\object_sel2dupgroup.py
c:\program files\Blender\.blender\scripts\object_timeofs_follow_act.py
c:\program files\Blender\.blender\scripts\off_export.py
c:\program files\Blender\.blender\scripts\off_import.py
c:\program files\Blender\.blender\scripts\paths_import.py
c:\program files\Blender\.blender\scripts\ply_export.py
c:\program files\Blender\.blender\scripts\ply_import.py
c:\program files\Blender\.blender\scripts\raw_export.py
c:\program files\Blender\.blender\scripts\raw_import.py
c:\program files\Blender\.blender\scripts\renameobjectbyblock.py
c:\program files\Blender\.blender\scripts\render_save_layers.py
c:\program files\Blender\.blender\scripts\rvk1_torvk2.py
c:\program files\Blender\.blender\scripts\save_theme.py
c:\program files\Blender\.blender\scripts\scripttemplate_background_job.py
c:\program files\Blender\.blender\scripts\scripttemplate_camera_object.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_basic.py
c:\program files\Blender\.blender\scripts\scripttemplate_gamelogic_module.py
c:\program files\Blender\.blender\scripts\scripttemplate_ipo_gen.py
c:\program files\Blender\.blender\scripts\scripttemplate_mesh_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_metaball_create.py
c:\program files\Blender\.blender\scripts\scripttemplate_object_edit.py
c:\program files\Blender\.blender\scripts\scripttemplate_pyconstraint.py
c:\program files\Blender\.blender\scripts\scripttemplate_text_plugin.py
c:\program files\Blender\.blender\scripts\slp_import.py
c:\program files\Blender\.blender\scripts\sysinfo.py
c:\program files\Blender\.blender\scripts\textplugin_convert_ge.py
c:\program files\Blender\.blender\scripts\textplugin_functiondocs.py
c:\program files\Blender\.blender\scripts\textplugin_imports.py
c:\program files\Blender\.blender\scripts\textplugin_membersuggest.py
c:\program files\Blender\.blender\scripts\textplugin_outliner.py
c:\program files\Blender\.blender\scripts\textplugin_suggest.py
c:\program files\Blender\.blender\scripts\textplugin_templates.py
c:\program files\Blender\.blender\scripts\unweld.py
c:\program files\Blender\.blender\scripts\uv_export.py
c:\program files\Blender\.blender\scripts\uv_seams_from_islands.py
c:\program files\Blender\.blender\scripts\uvcalc_follow_active_coords.py
c:\program files\Blender\.blender\scripts\uvcalc_lightmap.py
c:\program files\Blender\.blender\scripts\uvcalc_quad_clickproj.py
c:\program files\Blender\.blender\scripts\uvcalc_smart_project.py
c:\program files\Blender\.blender\scripts\uvcopy.py
c:\program files\Blender\.blender\scripts\vertexpaint_from_material.py
c:\program files\Blender\.blender\scripts\vertexpaint_gradient.py
c:\program files\Blender\.blender\scripts\vertexpaint_selfshadow_ao.py
c:\program files\Blender\.blender\scripts\vrml97_export.py
c:\program files\Blender\.blender\scripts\weightpaint_average.py
c:\program files\Blender\.blender\scripts\weightpaint_clean.py
c:\program files\Blender\.blender\scripts\weightpaint_copy.py
c:\program files\Blender\.blender\scripts\weightpaint_envelope_assign.py
c:\program files\Blender\.blender\scripts\weightpaint_gradient.py
c:\program files\Blender\.blender\scripts\weightpaint_grow_shrink.py
c:\program files\Blender\.blender\scripts\weightpaint_invert.py
c:\program files\Blender\.blender\scripts\weightpaint_normalize.py
c:\program files\Blender\.blender\scripts\widgetwizard.py
c:\program files\Blender\.blender\scripts\wizard_bolt_factory.py
c:\program files\Blender\.blender\scripts\wizard_curve2tree.py
c:\program files\Blender\.blender\scripts\wizard_landscape_ant.py
c:\program files\Blender\.blender\scripts\x3d_export.py
c:\program files\Blender\.blender\scripts\xsi_export.py
c:\program files\Blender\blender-2.49b-win64-python26.zip
c:\program files\Blender\blender.exe
c:\program files\Blender\blender.exe.manifest
c:\program files\Blender\blender.html
c:\program files\Blender\blenderplayer.exe
c:\program files\Blender\BlenderQuickStart.pdf
c:\program files\Blender\copyright.txt
c:\program files\Blender\GPL-license.txt
c:\program files\Blender\libtiff.dll
c:\program files\Blender\makesdna.exe
c:\program files\Blender\makesdna.idb
c:\program files\Blender\plugins\bmake
c:\program files\Blender\plugins\Makefile
c:\program files\Blender\plugins\sequence\blur.c
c:\program files\Blender\plugins\sequence\color-correction-hsv.c
c:\program files\Blender\plugins\sequence\color-correction-yuv.c
c:\program files\Blender\plugins\sequence\dnr.c
c:\program files\Blender\plugins\sequence\gamma.c
c:\program files\Blender\plugins\sequence\Makefile
c:\program files\Blender\plugins\sequence\scatter.c
c:\program files\Blender\plugins\texture\clouds2.c
c:\program files\Blender\plugins\texture\Makefile
c:\program files\Blender\plugins\texture\tiles.c
c:\program files\Blender\pthreadVC2.dll
c:\program files\Blender\Python-license.txt
c:\program files\Blender\python26.dll
c:\program files\Blender\release_249.txt
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\SysWow64\msvcsv60.dll
c:\windows\SysWow64\NSREG.DLL
c:\windows\XSxS
----- BITS: Eventuell infizierte Webseiten -----
hxxp://officelabs.vo.msecnd.net
.
((((((((((((((((((((((( Dateien erstellt von 2010-11-12 bis 2010-12-12 ))))))))))))))))))))))))))))))
.
2010-12-12 14:27 . 2010-12-12 14:27 -------- d-----w- c:\users\Mit Gästen\AppData\Local\temp
2010-12-12 14:27 . 2010-12-12 14:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-12-12 13:54 . 2010-12-12 14:00 -------- d-----w- C:\_OTL
2010-12-12 12:19 . 2010-12-12 12:19 388096 ----a-r- c:\users\Christoph\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-12-10 12:06 . 2010-11-10 05:35 8199504 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F3DCEEC-0D43-4464-899A-74354B19A15A}\mpengine.dll
2010-11-27 14:35 . 2010-12-04 11:55 -------- d-----w- c:\users\Christoph\AppData\Roaming\Tropico 3
2010-11-26 22:31 . 2010-11-26 22:31 -------- d-----w- c:\program files (x86)\MockFlow
2010-11-26 21:14 . 2010-11-26 21:14 -------- d-----w- c:\programdata\WorldWindData
2010-11-24 13:06 . 2010-10-19 08:47 7680 ----a-w- c:\program files\Internet Explorer\iecompat.dll
2010-11-24 13:06 . 2010-10-19 08:10 7680 ----a-w- c:\program files (x86)\Internet Explorer\iecompat.dll
2010-11-16 17:45 . 2009-04-28 02:56 24064 ----a-w- c:\windows\SysWow64\lxebsmr.dll
2010-11-16 17:45 . 2009-04-28 02:56 24064 ----a-w- c:\windows\system32\lxebsmr.dll
2010-11-16 17:45 . 2010-04-13 14:41 836608 ----a-w- c:\windows\system32\lxebcoin.dll
2010-11-16 17:45 . 2009-11-09 03:36 245248 ----a-w- c:\windows\system32\lxebinsb.dll
2010-11-16 17:45 . 2009-11-09 03:35 378368 ----a-w- c:\windows\system32\lxebcu.dll
2010-11-16 17:45 . 2009-11-09 03:35 450048 ----a-w- c:\windows\system32\lxebins.dll
2010-11-16 17:45 . 2009-11-09 03:06 65536 ----a-w- c:\windows\system32\lxebgcfg.dll
2010-11-16 17:45 . 2009-10-21 05:06 399360 ----a-w- c:\windows\system32\lxebcui.dll
2010-11-16 17:45 . 2009-06-07 19:21 148480 ----a-w- c:\windows\system32\lxebcuir.dll
2010-11-15 13:39 . 2010-11-15 13:39 17459253 ----a-w- c:\programdata\SPLF9BA.tmp
2010-11-15 13:39 . 2010-11-15 13:39 17459253 ----a-w- c:\programdata\SPL673C.tmp
2010-11-15 13:34 . 2010-11-15 13:34 17459253 ----a-w- c:\programdata\SPL5580.tmp
2010-11-15 13:34 . 2010-11-15 13:34 17459253 ----a-w- c:\programdata\SPLFAA4.tmp
2010-11-15 12:59 . 2010-11-15 12:59 17459253 ----a-w- c:\programdata\SPLDFE2.tmp
2010-11-14 19:19 . 2007-02-23 18:09 905728 ----a-w- c:\windows\system32\synsoacc.dll
2010-11-14 19:19 . 2006-11-16 15:58 31248 ----a-w- c:\windows\system32\drivers\synUSB64.sys
2010-11-14 19:19 . 2006-01-29 11:48 45056 ----a-w- c:\windows\SysWow64\Synsopos.exe
2010-11-14 19:19 . 2006-01-29 11:48 401462 ----a-w- c:\windows\SysWow64\temp.000
2010-11-14 19:19 . 2007-02-23 12:57 757760 ----a-w- c:\windows\SysWow64\SYNSOACC.dll
2010-11-14 19:19 . 2006-01-29 11:48 147456 ----a-w- c:\windows\SysWow64\SynsoLChk.dll
2010-11-14 19:19 . 2010-11-14 19:19 -------- d-----w- c:\program files (x86)\Syncrosoft
2010-11-14 19:16 . 2010-11-14 19:16 -------- d-----w- C:\Install
2010-11-14 12:14 . 2010-11-14 12:14 17459253 ----a-w- c:\programdata\SPLA213.tmp
2010-11-13 12:40 . 2010-11-13 12:40 17459253 ----a-w- c:\programdata\SPLD58.tmp
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-22 13:17 . 2010-01-02 17:43 83120 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-16 20:07 . 2010-01-08 19:39 215016 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2010-11-16 20:07 . 2010-01-06 12:46 215016 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2010-11-12 12:43 . 2010-11-12 12:43 17659656 ----a-w- c:\programdata\SPL916.tmp
2010-11-12 12:42 . 2010-11-12 12:42 17659656 ----a-w- c:\programdata\SPLF873.tmp
2010-11-12 12:40 . 2010-11-12 12:40 17659656 ----a-w- c:\programdata\SPLC323.tmp
2010-11-04 16:20 . 2010-01-04 12:21 9624 ----a-w- c:\users\Christoph\AppData\Roaming\Microsoft\IdentityCRL\production\WLIDClientConfig.dll
2010-10-19 09:41 . 2010-01-02 19:15 270720 ------w- c:\windows\system32\MpSigStub.exe
2010-10-08 15:09 . 2006-09-28 19:53 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
2010-10-08 15:09 . 2006-09-28 19:53 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
2010-10-05 03:32 . 2010-01-03 09:43 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll
2010-10-05 03:32 . 2010-07-24 11:59 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2010-10-05 03:32 . 2010-01-13 13:01 1113408 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-10-01 14:55 . 2010-02-04 08:16 2300696 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll
2010-10-01 14:44 . 2010-10-01 14:44 42776 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2010-10-01 14:44 . 2010-01-03 09:42 1113408 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-09-26 14:45 . 2010-01-13 14:23 24064 ----a-w- c:\windows\SysWow64\FsExService64.Exe
2010-09-26 14:45 . 2010-01-13 14:23 16392 ----a-w- c:\windows\SysWow64\drivers\TFsExDisk.Sys
2010-09-26 14:44 . 2007-10-25 16:26 5632 ----a-w- c:\windows\SysWow64\drivers\StarOpen.sys
2010-09-15 03:50 . 2010-08-23 11:05 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2010-09-14 17:50 . 2010-09-14 17:50 21832 ----a-w- c:\windows\system32\drivers\hamachi.sys
2010-06-22 16:36 . 2010-06-24 14:58 1508283 ----a-w- c:\program files (x86)\Euthymia Electronic Organ V2.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FeedDemon"="c:\program files (x86)\FeedDemon\FeedDemon.exe" [2010-12-08 7501824]
"Pidgin"="c:\program files (x86)\Pidgin\pidgin.exe" [2010-11-01 48618]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2010-07-28 609424]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe"
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" -atboottime
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
"BambooCore"=c:\program files (x86)\Bamboo Dock\BambooCore.exe
"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SwitchBoard"=c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
R2 athsgt;athsgt;c:\windows\system32\DRIVERS\athsgt.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-19 136176]
R2 limsgt;limsgt;c:\windows\system32\DRIVERS\limsgt.sys [x]
R2 lxebCATSCustConnectService;lxebCATSCustConnectService;c:\windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [2010-04-14 45736]
R3 ahcix64s;ahcix64s;c:\windows\system32\DRIVERS\ahcix64s.sys [2008-09-10 224272]
R3 amdide64;amdide64;c:\windows\system32\DRIVERS\amdide64.sys [2007-10-12 10632]
R3 ISASerial;PCIe-ISA Communication Port;c:\windows\system32\DRIVERS\ISASerial.sys [2008-02-20 72192]
R3 NmPar;MosChip PCI Parallel Port;c:\windows\system32\DRIVERS\NmPar.sys [x]
R3 nmserial;MosChip PCI Serial Port;c:\windows\system32\DRIVERS\nmserial.sys [x]
R3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2009-09-25 73728]
R3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2009-09-25 178688]
R3 nvamacpi;nvamacpi;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-07-16 28192]
R3 PciIsaSerial;PCI-ISA Communication Port;c:\windows\system32\DRIVERS\PciIsaSerial.sys [2008-05-22 72192]
R3 PciPPorts;PCI ECP Parallel Port;c:\windows\system32\DRIVERS\PciPPorts.sys [2008-05-22 95744]
R3 PciSPorts;High-Speed PCI Serial Port;c:\windows\system32\DRIVERS\PciSPorts.sys [2008-05-22 126464]
R3 PPorts;PCIe ECP Parallel Port;c:\windows\system32\DRIVERS\PPorts.sys [2008-02-20 95744]
R3 SPorts;High-Speed PCIe Serial Port;c:\windows\system32\DRIVERS\SPorts.sys [2008-02-20 124416]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynUSB64.sys [2006-11-16 31248]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 18216]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2009-07-14 23040]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2010-02-12 193232]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2010-02-12 53264]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]
S2 lxeb_device;lxeb_device;c:\windows\system32\lxebcoms.exe [2010-04-14 1052328]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-07-09 248936]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2009-07-15 5414184]
S2 WTouchService;WTouch Service;c:\program files\WTouch\WTouchService.exe [2009-07-15 127272]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2010-07-21 45456]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2010-06-23 344680]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [2010-02-12 145360]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2010-02-12 165200]
.
Inhalt des "geplante Tasks" Ordners
2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]
2010-12-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-05-17 09:36]
2010-12-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000Core.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]
2010-12-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3813913343-2729911108-1179361101-1000UA.job
- c:\users\Christoph\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-15 22:31]
.
--------- x86-64 -----------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-11-17 9608224]
"lxebmon.exe"="c:\program files (x86)\Lexmark Pro200-S500 Series\lxebmon.exe" [2010-05-05 770728]
"EzPrint"="c:\program files (x86)\Lexmark Pro200-S500 Series\ezprint.exe" [2009-04-28 139944]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 2327952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Add to &Evernote - c:\program files (x86)\Evernote\Evernote3.5\enbar.dll/2000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.de/search?q=
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - hxxp://pinterest.com/|http://www.trojaner-board.de/93690-i...6da82a681c0a0e
FF - prefs.js: keyword.URL - hxxp://www.google.de/search?q=
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}\platform\WINNT\components\ColorZilla.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}\platform\WINNT_x86-msvc\components\enbar.dll
FF - component: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam\components\dwmxpcom.dll
FF - plugin: c:\program files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npContribute.dll
FF - plugin: c:\program files (x86)\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: c:\program files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: c:\program files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\programdata\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
FF - plugin: c:\users\Christoph\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: c:\windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Battlefield Heroes Updater: battlefieldheroespatcher@ea.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\battlefieldheroespatcher@ea.com
FF - Ext: Fast Dial: fastdial@telega.phpnet.us - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\fastdial@telega.phpnet.us
FF - Ext: Firebug: firebug@software.joehewitt.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firebug@software.joehewitt.com
FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: Web Developer: {c45c406e-ab73-11d8-be73-000a95be3b12} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12}
FF - Ext: Greasemonkey: {e4a8a97b-f2ed-450b-b12d-ee082ba24781} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Strata40: Strata40@SpewBoy.au - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\Strata40@SpewBoy.au
FF - Ext: StrataBuddy: StrataBuddy@ReduxTeam - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\StrataBuddy@ReduxTeam
FF - Ext: App Tabs: apptabs@frankyan.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\apptabs@frankyan.com
FF - Ext: Tab Progress Bar: tabprogressbar@studio17.wordpress.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\tabprogressbar@studio17.wordpress.com
FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}
FF - Ext: Chromifox Basic: chromifox@altmusictv.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\chromifox@altmusictv.com
FF - Ext: SkipScreen: SkipScreen@SkipScreen - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\SkipScreen@SkipScreen
FF - Ext: Yet Another Window Resizer: yawr@sdx.hu - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\yawr@sdx.hu
FF - Ext: Evernote Web Clipper: {E0B8C461-F8FB-49b4-8373-FE32E9252800} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{E0B8C461-F8FB-49b4-8373-FE32E9252800}
FF - Ext: Pastebin: pastebin.com@gmail.com - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\pastebin.com@gmail.com
FF - Ext: ColorZilla: {6AC85730-7D0F-4de0-B3FA-21142DD85326} - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
FF - Ext: FireGestures: firegestures@xuldev.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\firegestures@xuldev.org
FF - Ext: HTTPS-Everywhere: https-everywhere@eff.org - c:\users\Christoph\AppData\Roaming\Mozilla\Firefox\Profiles\n7p6erg3.default\extensions\https-everywhere@eff.org
---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-ICQ - c:\program files (x86)\ICQ6.5\ICQ.exe
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_heroes.exe
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{63B72BBE-76EE-60B7-A042-F9F60C7F4C38}*]
"haehchfmfjapdmee"=hex:6a,61,64,6b,66,68,64,70,65,65,6e,6e,67,61,6a,66,6f,6a,
6a,6d,00,2e
"iakkmpddddbcopflgc"=hex:6a,61,64,6b,65,68,63,61,64,61,64,68,64,6f,65,68,65,69,
6e,61,00,f5
[HKEY_USERS\S-1-5-21-3813913343-2729911108-1179361101-1000\Software\SecuROM\License information*]
"datasecu"=hex:e8,fc,94,29,84,d0,db,10,48,2d,c9,cd,42,9a,33,b3,25,7d,4e,80,de,
eb,83,ce,75,8f,93,d2,3a,f8,32,d5,3f,75,14,84,94,89,d8,6d,5e,27,ea,29,2f,58,\
"rkeysecu"=hex:51,0a,e3,c2,95,b8,a6,4a,ca,f7,96,b2,22,7b,a3,01
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10g_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx"
"ThreadingModel"="Apartment"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10g.ocx, 1"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-12-12 15:29:10
ComboFix-quarantined-files.txt 2010-12-12 14:29
Vor Suchlauf: 14 Verzeichnis(se), 258.599.911.424 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 258.472.767.488 Bytes frei
- - End Of File - - 4DA2C0CF2AA70E45944D44F212C2354A
|
|
12.12.2010, 15:39
| #8 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung download malwarebytes: Malwarebytes instalieren, öffnen, registerkarte aktualisierung, programm updaten. schalte alle laufenden programme ab, trenne die internetverbindung. registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.12.2010, 15:41
| #9 |
| | Internet Explorer öffnet automatisch Werbung Kann es sein, dass die Malware schon weg ist? Alle Anzeichen von vorhin sind verschwunden... ODer soll ich den Scan trotzdem machen? |
|
12.12.2010, 15:53
| #10 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung den scan trotzdem machen, sieht aber schon gut aus.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.12.2010, 17:08
| #11 |
| | Internet Explorer öffnet automatisch Werbung Som, hat ganz schön lange gedauert. Wahrscheinlich bin ich jetzt sauber! Code:
ATTFilter Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org
Datenbank Version: 5299
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
12.12.2010 17:01:54
mbam-log-2010-12-12 (17-01-54).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|F:\|)
Durchsuchte Objekte: 626947
Laufzeit: 1 Stunde(n), 0 Minute(n), 49 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\NtWqIVLZEWZU (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\JP595IR86O (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\program files (x86)\euthymia electronic organ v2.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\_OTL\movedfiles\12122010_145442\C_Users\christoph\AppData\Local\Temp\Rnv.exe (Trojan.FraudPack) -> Quarantined and deleted successfully.
|
|
12.12.2010, 17:09
| #12 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung lade den CCleaner slim: Piriform - Builds falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.12.2010, 17:40
| #13 |
| | Internet Explorer öffnet automatisch WerbungCode:
ATTFilter 7-Zip 4.65 notwendig
ABBYY FineReader 6.0 Sprint unbekannt
Adobe AIR notwendig
Adobe Community Help notwendig
Adobe Flash Player 10 ActiveX notwendig
Adobe Flash Player 10 Plugin notwendig
Adobe Media Player notwendig
Adobe Photoshop CS3 notwendig
Adobe Reader 9.4.1 - Deutsch notwendig
Adobe Shockwave Player 11.5 notwendig
AirPlus XtremeG DWL-G122 notwendig
Alien Swarm notwendig
Alien Swarm - SDK notwendig
ANNO 1404 notwendig
ANNO 1404 - Venedig notwendig
ANNO 1404 Entwickler-Tools notwendig
Apple Application Support notwendig
Apple Software Update notwendig
ArtRage 2 notwendig
ASIO4ALL notwendig
Assassin's Creed notwendig
Assassin's Creed II notwendig
Audacity 1.2.6 notwendig
Avira AntiVir Personal - Free Antivirus notwendig
Bamboo notwendig
Bamboo Dock 3.3 notwendig
Bamboo Explore notwendig
Bamboo Scribe notwendig
Bamboo Scribe Shared Files notwendig
Battlefield Heroes notwendig
Bonjour unnötig
Bullzip PDF Printer 7.1.0.1159 notwendig
CCleaner notwendig
Dexpot notwendig
DivX-Setup unnötig
DVD Shrink 3.2 notwendig
Edirol HQ Orchestral VSTi v1.03 notwendig
Empire Earth II notwendig
Evernote notwendig
Exteel (US) unnötig
FeedDemon notwendig
FL Studio 9 notwendig
foobar2000 v1.0.1 unnötig
Free M4a to MP3 Converter 6.1 unnötig
GameSpy Arcade notwendig
GEAR driver installer for AMD64 and Intel EM64T unnötig
GIMP 2.6.10 notwendig
GNU Privacy Guard unbekannt
Google Chrome notwendig
Google Earth Plug-in notwendig
Google SketchUp 7 notwendig
GPL Ghostscript 8.64 unbekannt
Grand Theft Auto unnötig
GTA2 unnötig
Hamachi 1.0.1.5 notwendig
Hardcore notwendig
HiJackThis notwendig
IETester v0.4.4 (remove only) notwendig
IL Download Manager notwendig
ImgBurn notwendig
Inkscape 0.47 notwendig
Internet Explorer Collection 1.6.0.4 notwendig
Java(TM) 6 Update 22 notwendig
LeechFTP notwendig
Lexmark notwendig
Lexmark Pro200-S500 Series notwendig
Lexmark Symbolleiste notwendig
Lexmark Tools for Office notwendig
Linux MultiMedia Studio (LMMS) notwendig
Livebrush Mini notwendig
Malwarebytes' Anti-Malware notwendig
Microsoft .NET Framework 4 Client Profile notwendig
Microsoft .NET Framework 4 Client Profile DEU Language Pack notwendig
Microsoft Chart Controls for Microsoft .NET Framework 3.5 notwendig
Microsoft IntelliPoint 8.0 notwendig
Microsoft Office Enterprise 2007 notwendig
Microsoft Silverlight notwendig
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR) notwendig
Microsoft Text-to-Speech Engine 4.0 (English) notwendig
Microsoft Visual C++ 2005 Redistributable notwendig
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 notwendig
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 notwendig
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 notwendig
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 notwendig
Microsoft® Office-Add-In for Moodle notwendig
MockFlow Desktop notwendig
Monkey Island 2: Special Edition notwendig
Mozilla Firefox (3.6.13) notwendig
Mozilla Thunderbird (3.1.4) notwendig
Mp3tag v2.45a notwendig
MSI Afterburner 1.0.0 notwendig
MSXML 4.0 SP2 (KB954430) notwendig
MSXML 4.0 SP2 (KB973688) notwendig
Native Instruments Absynth 4 notwendig
Native Instruments Battery 3 notwendig
Native Instruments Battery 3 notwendig
Native Instruments FM8 notwendig
Native Instruments Massive notwendig
Native Instruments Pro-53 notwendig
Native Instruments Service Center notwendig
Native Instruments Service Center notwendig
NCsoft Launcher unnötig
Need For Speed™ World unnötig
Nero 9 Essentials notwendig
Notepad++ notwendig
NVIDIA Display Control Panel notwendig
NVIDIA Drivers notwendig
NVIDIA PhysX notwendig
NVIDIA Stereoscopic 3D Driver notwendig
OpenAL notwendig
OpenOffice.org 3.2 notwendig
Opera 10.10 notwendig
Pando Media Booster unbekannt
PC Connectivity Solution unnötig
Phase 5 HTML-Editor notwendig
Pidgin notwendig
PoiZone notwendig
Portal: The First Slice notwendig
PunkBuster Services notwendig
Python 2.6.5 notwendig
QuickTime notwendig
Realtek High Definition Audio Driver notwendig
RippMe notwendig
RocketDock 1.3.5 unnötig
Safari notwendig
Sakura notwendig
SampleTank FREE unnötig
SAMSUNG Mobile Composite Device Software notwendig
Samsung Mobile Modem Device Software notwendig
SAMSUNG Mobile Modem Driver Set notwendig
Samsung Mobile phone USB driver Drive Software notwendig
SAMSUNG Mobile USB Modem 1.0 Software notwendig
SAMSUNG Mobile USB Modem Software notwendig
SAMSUNG USB Mobile Device Software notwendig
SamsungConnectivityCableDriver notwendig
Sawer notwendig
Scribus 1.3.3.13 notwendig
ScummVM 1.0.0 notwendig
Sigel Professional Label Software SE unnötig
Skype™ 4.2 notwendig
Sonik Synth 2 Free notwendig
Sony DVD Architect 4.0 notwendig
Sony Media Manager 2.2 notwendig
Sony Vegas 7.0 notwendig
Steam notwendig
Sun VirtualBox notwendig
Syncrosoft Lizenz Kontrolle unbekannt
The Secret of Monkey Island: Special Edition notwendig
Tomb Raider: Underworld 1.1 notwendig
Toxic Biohazard notwendig
Tropico 3 - Steam Special Edition notwendig
Tropico 3: Absolute Power notwendig
TrueCrypt notwendig
TuxGuitar unnötig
Tycoon City - New York notwendig
Ubisoft Game Launcher notwendig
Unreal Development Kit: 2010-01 notwendig
Visual C++ 8.0 Runtime Setup Package (x64) notwendig
Visual Studio 2005 Tools for Office Second Edition Runtime notwendig
VLC media player 1.0.5 notwendig
WavePad Sound Editor unnötig
Winamp notwendig
Winamp Anwendungserkennung notwendig
Windosill notwendig
Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0) unnötig
Wings 3D 1.0.1 notwendig
WinRAR notwendig
XMedia Recode 2.2.7.7 notwendig
Xvid 1.2.2 final uninstall unbekannt
µTorrent notwendig
|
|
12.12.2010, 17:47
| #14 |
| /// Malware-holic | Internet Explorer öffnet automatisch Werbung deinstaliere: ABBYY FineReader Adobe Reader 9 ersetzen: Adobe - Adobe Reader herunterladen - Alle Versionen bitte den mcafee security scan nicht mit instalieren. öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus. so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden. unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken. unter update, auf instalieren stellen. klicke übernehmen /ok deinstaliere: Bonjour DivX Exteel foobar2000 Free M4a to MP3 Converter GEAR driver installer GNU Grand Theft GTA2 NCsoft Launcher Need For Speed™ PC Connectivity RocketDock SampleTank Sigel Professional Label Software Skype™ öffnen, update klicken und version 5 drauf. TuxGuitar WavePad bereinige dann dateien + registry war genauso wie ichs wollte :-)
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.12.2010, 18:13
| #15 |
| | Internet Explorer öffnet automatisch Werbung Alles klar, vielen Dank für deine intensive Hilfe. Wäre es möglich diesen Thread zu löschen, er hilft ja eh keinem (man braucht ja eine individuelle Anleitung) und mir wäre es lieber wenn die ganzen Logs und Listen mit Infos über meinen Computer nicht öffentlich wären... |
|
| Themen zu Internet Explorer öffnet automatisch Werbung |
| adobe, antivir, antivir guard, avg, avira, bho, bonjour, browser, desktop, firefox, hijack, hijackthis, internet, internet explorer, logfile, mozilla, object, plug-in, problem, programm, senden, software, syswow64, temp, updates, werbung, windows, windows 7 64bit |
Linear-Darstellung
