| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojaner! Malware bereits ausgeführt, Virus aber noch da?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
22.05.2011, 18:43
| #1 |
 |  Trojaner! Malware bereits ausgeführt, Virus aber noch da? Hallo, jetzt hat es wohl auch mich erwischt... Vorhin hat mich mein Freund gant verängstigt angerufen, und mir gesagt, dass mit meinem Laptop (der bei ihm stand) was nicht stimmt, obwohl er gar nichts gemacht hat... die Symptome sind die gleichen, wie sie die Leute mit dem Tr/Kazy.mekml.1 gepostet haben, nur dass Avira mir nicht den Virus angezeigt hat.. Hab nun nach langem Lesen hier im Forum Malwarebytes und OTL ausgeführt, Malware hat auch 6 infizierte Objekte gefunden und entfernt. Der Desktop war danach aber immer noch schwarz, nur kam eben keine Fehlermeldung mehr.. Hab dann Unhide.exe ausgeführt, nun sind alle dateien, außer die in der Startleiste wieder da, aber das muss ich denk ich selbst einrichten. Ich frag mich nun nur, ob der Virus jetzt wirklich weg ist, oder nur die Symptome verschwunden sind? Hier die Log-Dateien: Malwarebytes: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6639 Windows 6.0.6002 Service Pack 2 Internet Explorer 8.0.6001.19048 22.05.2011 18:27:13 mbam-log-2011-05-22 (18-27-13).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 547770 Laufzeit: 4 Stunde(n), 12 Minute(n), 20 Sekunde(n) Infizierte Speicherprozesse: 1 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: c:\programdata\wvlmhxgdqr.exe (Trojan.FakeMS.Gen) -> 4748 -> Unloaded process successfully. Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wvLmHXgdqR (Trojan.FakeMS.Gen) -> Value: wvLmHXgdqR -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\programdata\wvlmhxgdqr.exe (Trojan.FakeMS.Gen) -> Delete on reboot. c:\programdata\45080312.exe (Rogue.WindowsRecoveryConsole) -> Quarantined and deleted successfully. c:\Users\Maya\AppData\Local\Temp\tmp41D1.tmp (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. d:\PROG\Unipatch.exe (RiskWare.Tool.CK) -> Quarantined and deleted successfully. OTL:OTL Logfile: Code:
ATTFilter OTL logfile created on: 22.05.2011 18:48:59 - Run 1 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Users\Maya\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.19048) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,93 Gb Total Physical Memory | 1,49 Gb Available Physical Memory | 50,75% Memory free 6,09 Gb Paging File | 4,34 Gb Available in Paging File | 71,27% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 144,17 Gb Total Space | 25,20 Gb Free Space | 17,48% Space Free | Partition Type: NTFS Drive D: | 144,15 Gb Total Space | 83,45 Gb Free Space | 57,89% Space Free | Partition Type: NTFS Computer Name: MAYA-PC | User Name: Maya | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.05.22 18:47:16 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Maya\Desktop\OTL.exe PRC - [2011.05.12 09:52:33 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.24 09:43:06 | 000,304,304 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2011.03.16 15:42:06 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2011.01.06 12:36:56 | 003,046,808 | ---- | M] () -- C:\Program Files\Pando Networks\Media Booster\PMB.exe PRC - [2010.12.20 18:15:28 | 000,111,928 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Program Files\SweetIM\Messenger\SweetIM.exe PRC - [2010.12.13 09:39:19 | 000,281,768 | -H-- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.11.20 09:48:34 | 003,365,176 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Kies\KiesTrayAgent.exe PRC - [2010.10.25 11:07:48 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\System32\dgdersvc.exe PRC - [2010.10.25 11:03:52 | 000,217,088 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe PRC - [2010.04.05 14:50:00 | 000,494,920 | R--- | M] (WinZip Computing, S.L.) -- C:\Program Files\WinZip\WZQKPICK.EXE PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2010.01.03 18:07:48 | 000,246,520 | -H-- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe PRC - [2009.11.24 11:32:22 | 000,234,792 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe PRC - [2009.09.28 22:42:57 | 000,204,800 | -H-- | M] (Realtek Semiconductor Corp.) -- C:\Users\Maya\AppData\Local\Temp\RtkBtMnt.exe PRC - [2009.08.18 17:01:16 | 000,671,796 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe PRC - [2009.08.18 16:31:22 | 000,483,393 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) -- C:\Program Files\Common Files\Marmiko Shared\MWLaMaS.exe PRC - [2009.07.01 18:37:06 | 000,037,888 | -H-- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2009.06.02 08:59:46 | 005,451,536 | -H-- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Logitech Vid\Vid.exe PRC - [2009.05.08 10:35:50 | 002,780,432 | -H-- | M] () -- C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe PRC - [2009.05.08 10:34:08 | 000,559,888 | -H-- | M] () -- C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe PRC - [2009.04.30 16:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () -- D:\Eigene Dateien\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2008.09.11 00:02:24 | 000,809,480 | ---- | M] (Dritek System Inc.) -- C:\Program Files\Launch Manager\LManager.exe PRC - [2008.06.11 11:22:16 | 000,409,600 | -H-- | M] (Acer Inc.) -- C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe PRC - [2008.05.14 18:05:30 | 000,500,784 | -H-- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe PRC - [2008.05.14 18:05:22 | 000,526,896 | -H-- | M] (Egis Incorporated) -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe PRC - [2008.04.18 15:18:02 | 000,167,936 | -H-- | M] (Acer Corp.) -- C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe PRC - [2008.04.10 16:30:20 | 000,167,936 | -H-- | M] (CyberLink) -- C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe PRC - [2008.04.10 16:30:14 | 000,147,456 | -H-- | M] (CyberLink Corp.) -- C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe PRC - [2008.03.21 13:22:52 | 000,024,576 | -H-- | M] () -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe PRC - [2008.03.18 21:27:12 | 000,013,312 | -H-- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2008.01.21 04:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe PRC - [2008.01.16 18:35:02 | 000,081,504 | -H-- | M] () -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe PRC - [2007.12.06 17:15:28 | 000,110,592 | -H-- | M] () -- C:\Acer\Mobility Center\MobilityService.exe ========== Modules (SafeList) ========== MOD - [2011.05.22 18:47:16 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Maya\Desktop\OTL.exe MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - File not found [Auto | Stopped] -- -- (SearchAnonymizer) SRV - [2011.05.12 09:52:33 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.16 15:42:06 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.10.25 11:07:48 | 000,095,568 | ---- | M] (Devguru Co., Ltd.) [Auto | Running] -- C:\Windows\System32\dgdersvc.exe -- (dgdersvc) SRV - [2010.10.25 11:03:52 | 000,217,088 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2010.01.03 18:07:48 | 000,246,520 | -H-- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2009.08.13 15:52:03 | 000,069,120 | ---- | M] (BOONTY) [On_Demand | Stopped] -- C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe -- (Boonty Games) SRV - [2009.04.30 16:01:10 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv) SRV - [2008.10.20 22:18:26 | 000,071,096 | ---- | M] () [Auto | Running] -- D:\Eigene Dateien\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU) SRV - [2008.05.14 18:05:30 | 000,500,784 | -H-- | M] (Egis Incorporated) [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service) SRV - [2008.03.21 13:22:52 | 000,024,576 | -H-- | M] () [Auto | Running] -- C:\Program Files\Acer\Empowering Technology\Service\ETService.exe -- (ETService) SRV - [2008.03.18 21:27:12 | 000,013,312 | -H-- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.16 18:35:02 | 000,081,504 | -H-- | M] () [Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe -- (CLHNService) SRV - [2007.12.06 17:15:28 | 000,110,592 | -H-- | M] () [Auto | Running] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService) SRV - [2005.11.17 14:18:52 | 001,527,900 | -H-- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) ========== Driver Services (SafeList) ========== DRV - [2011.03.16 15:42:06 | 000,137,656 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.12.13 09:39:38 | 000,061,960 | -H-- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.10.25 11:07:48 | 000,018,120 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv) DRV - [2010.10.25 11:03:52 | 000,036,640 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2010.08.27 15:23:08 | 000,019,200 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Program Files\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX) DRV - [2010.08.27 06:32:08 | 000,121,576 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm) DRV - [2010.08.27 06:32:08 | 000,096,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) DRV - [2010.08.27 06:32:08 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter) DRV - [2010.06.17 15:27:02 | 000,028,520 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV - [2009.04.30 16:00:12 | 000,025,624 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon) DRV - [2009.04.05 15:56:08 | 000,271,360 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2009.04.05 15:55:58 | 000,018,048 | -H-- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009.02.13 11:35:01 | 000,011,608 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2008.11.11 13:42:00 | 000,024,832 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2008.11.11 13:41:00 | 000,019,968 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2008.11.11 13:41:00 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) DRV - [2008.04.27 21:07:44 | 000,909,824 | -H-- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008.04.18 15:01:24 | 000,061,424 | -H-- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) DRV - [2008.03.21 10:48:24 | 000,015,392 | -H-- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2008.03.01 01:13:38 | 001,202,560 | -H-- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008.01.16 18:35:08 | 000,122,368 | -H-- | M] (Cyberlink Corp.) [Kernel | Auto | Stopped] -- C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\NTIPPKernel.sys -- (NTIPPKernel) DRV - [2006.07.24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files\wellgames\tbwell.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "ICQ Search" FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://home.sweetim.com" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5 FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0 FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.8.20100408.6 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.6 FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.11.9 FF - prefs.js..extensions.enabledItems: {EEE6C361-6118-11DC-9C72-001320C79847}:1.1.0.2 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.12.1 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313 FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}:2.1.0 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.20 17:43:48 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.20 17:43:48 | 000,000,000 | ---D | M] [2010.10.04 23:36:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Extensions [2010.10.04 23:36:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Extensions\mozswing@mozswing.org [2011.05.22 11:35:47 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions [2010.11.10 22:21:33 | 000,000,000 | -H-D | M] (Winamp Toolbar) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010.05.12 20:37:32 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.05.06 18:39:33 | 000,000,000 | -H-D | M] (Yahoo! Toolbar) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2010.06.16 21:54:30 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.11.10 22:21:22 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2011.04.03 23:00:51 | 000,000,000 | -H-D | M] (kikin plugin) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED} [2010.06.30 23:26:17 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.02.17 22:26:52 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2010.05.06 18:39:28 | 000,000,000 | -H-D | M] (Greasemonkey) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2009.07.20 15:23:14 | 000,000,000 | -H-D | M] ("Ask Toolbar for Firefox") -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2011.02.07 00:31:52 | 000,000,000 | -H-D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847} [2010.11.10 22:21:33 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\staged-xpis [2009.03.16 17:42:14 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Maya\AppData\Roaming\mozilla\Firefox\Profiles\e1pomfab.default\extensions\toolbar_extras@de.yahoo.com [2009.10.11 00:10:00 | 000,002,299 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\bing.xml [2010.10.09 22:00:47 | 000,000,873 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\conduit.xml [2011.05.20 17:23:34 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-1.xml [2009.11.04 00:19:07 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-2.xml [2010.06.14 18:57:22 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-3.xml [2010.06.19 21:44:49 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-4.xml [2010.07.07 16:28:43 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-5.xml [2010.07.08 16:05:14 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-6.xml [2010.07.09 19:53:11 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-7.xml [2010.07.15 23:06:34 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-8.xml [2011.05.20 17:44:10 | 000,000,950 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin-9.xml [2010.06.16 21:54:30 | 000,000,168 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin.gif [2010.06.16 21:54:30 | 000,000,618 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin.src [2010.05.12 18:40:06 | 000,001,042 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\icqplugin.xml [2011.01.02 11:39:36 | 000,001,218 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\kikin-search.xml [2011.02.07 00:31:40 | 000,003,915 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\sweetim.xml [2009.10.11 00:10:01 | 000,001,651 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\winamp-search.xml [2009.10.11 00:10:01 | 000,002,041 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\{307CBA51-B200-478D-9B7A-F4776E73E981}.xml [2009.10.11 00:10:01 | 000,002,152 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\{66AE9E10-D1D0-49F2-B0CF-25FBD0F3162A}.xml [2009.10.11 00:10:01 | 000,001,834 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\Mozilla\Firefox\Profiles\e1pomfab.default\searchplugins\{D262DACB-64AD-40D1-BD79-9BEC349ABA21}.xml [2010.08.31 17:16:52 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010.03.11 01:15:22 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.07.27 13:35:57 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.08.31 17:16:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2009.03.16 17:39:16 | 000,000,000 | ---D | M] (Yahoo! Deutschland Toolbar und Extras) -- C:\Program Files\Mozilla Firefox\extensions\toolbar_extras@de.yahoo.com [2009.08.16 23:08:10 | 000,000,000 | ---D | M] (DVDVideoSoft YouTube Download Firefox Integration) -- C:\PROGRAM FILES\COMMON FILES\DVDVIDEOSOFT\DLL\FFCONTEXTMENUY [2011.02.07 00:52:31 | 000,000,000 | ---D | M] (PriceGong) -- C:\PROGRAM FILES\PRICEGONG\2.1.0\FF [2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011.05.20 17:43:41 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.05.20 17:43:41 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml [2011.05.20 17:43:41 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.05.20 17:43:41 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.05.20 17:43:41 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (PriceGongBHO Class) - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll (PriceGong) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files\wellgames\tbwell.dll (Conduit Ltd.) O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll (kikin) O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (wellgames Toolbar) - {8e41e543-e069-4197-8608-e8b4c2f75747} - C:\Program Files\wellgames\tbwell.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKCU\..\Toolbar\WebBrowser: (wellgames Toolbar) - {8E41E543-E069-4197-8608-E8B4C2F75747} - C:\Program Files\wellgames\tbwell.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) O4 - HKLM..\Run: [ePower_DMC] C:\Program Files\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.) O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\Windows\System32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) O4 - HKLM..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Incorporated) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [DW6] File not found O4 - HKCU..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [Logitech Vid] C:\Program Files\Logitech\Logitech Vid\vid.exe (Logitech Inc.) O4 - HKCU..\Run: [msnmsgr] File not found O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe () O4 - HKCU..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\Program Files\T-Online\WLAN-Access Finder\ToWLaAcF.exe (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) O4 - Startup: C:\Users\Maya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube Download - C:\Users\Maya\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Maya\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll (Google Inc.) O8 - Extra context menu item: Save YouTube Video - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam) O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam) O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (kikin) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {A21769F8-CEC5-4AFA-A6A4-CC921A15DF40} hxxp://www.n2030.com/coreXplayer.dll (ActiveXControl Object) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - File not found O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - AppInit_DLLs: (halqueue.dll) - File not found O20 - AppInit_DLLs: (dbgcpl.dll) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Maya\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Maya\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{1ae05757-6dc3-11df-9a5a-001d72d3e6c5}\Shell - "" = AutoRun O33 - MountPoints2\{1ae05757-6dc3-11df-9a5a-001d72d3e6c5}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.05.22 18:47:09 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Maya\Desktop\OTL.exe [2011.05.22 13:54:48 | 000,000,000 | -H-D | C] -- C:\Users\Maya\AppData\Roaming\Malwarebytes [2011.05.22 13:54:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.05.22 13:54:03 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.22 13:53:51 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes [2011.05.22 13:53:42 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.05.22 12:10:31 | 000,000,000 | -H-D | C] -- C:\Users\Maya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Recovery [2011.05.16 22:05:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth [2011.05.16 14:37:22 | 000,000,000 | -H-D | C] -- C:\Users\Maya\Desktop\gomhb [2011.05.16 14:37:01 | 000,000,000 | -H-D | C] -- C:\Users\Maya\AppData\Local\WinZip [2011.05.12 10:01:56 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll [2011.05.12 10:01:56 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll [2011.05.12 10:01:52 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.05.12 09:58:58 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2011.05.12 09:58:57 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2011.05.12 09:53:55 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2011.05.12 09:53:55 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.05.12 09:53:54 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2011.05.12 09:53:54 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.05.12 09:53:53 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2011.05.12 09:53:53 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2011.05.12 09:53:52 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.05.12 09:53:52 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2011.05.12 09:53:51 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2011.05.12 09:53:51 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2011.05.12 09:53:51 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2011.05.12 09:53:51 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2011.05.12 09:53:51 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2011.05.12 09:53:51 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2011.05.12 09:53:50 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.05.12 09:53:50 | 000,173,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2011.05.12 09:53:50 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2011.05.12 09:53:24 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll [2011.05.12 09:53:23 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll [2011.05.12 09:53:05 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe [2011.05.12 09:52:59 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2011.05.12 09:52:33 | 000,726,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2011.05.12 09:52:33 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2011.04.28 23:14:46 | 000,000,000 | -H-D | C] -- C:\Users\Maya\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Submarine Titans [2011.04.28 23:10:53 | 000,000,000 | ---D | C] -- C:\Program Files\Submarine Titans [2011.04.28 23:05:56 | 000,000,000 | -H-D | C] -- C:\CHAOS [2011.04.28 22:52:16 | 000,000,000 | ---D | C] -- C:\Program Files\DS9TheFallen [2011.04.28 22:52:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deep Space Nine-The Fallen [2011.04.24 13:04:22 | 000,000,000 | -H-D | C] -- C:\Users\Maya\Desktop\by AstiNews de - Nintendo Super NES Emulator inkl [2010.08.25 19:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll [2009.03.17 01:35:54 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Maya\AppData\Local\*.tmp files -> C:\Users\Maya\AppData\Local\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.05.22 18:47:16 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Maya\Desktop\OTL.exe [2011.05.22 18:40:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.05.22 18:30:54 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.05.22 18:30:34 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2011.05.22 18:30:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.05.22 18:30:27 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.05.22 18:30:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.05.22 18:30:00 | 3146,633,216 | -HS- | M] () -- C:\hiberfil.sys [2011.05.22 13:34:23 | 000,000,184 | -H-- | M] () -- C:\Users\Maya\Desktop\NPE.ctl [2011.05.22 13:33:52 | 006,161,848 | -H-- | M] (Symantec Corporation) -- C:\Users\Maya\Desktop\NPE.exe [2011.05.22 13:10:46 | 000,000,000 | -H-- | M] () -- C:\Users\Maya\AppData\Roaming\SMRBackup162.dat [2011.05.22 12:10:34 | 000,000,144 | -H-- | M] () -- C:\ProgramData\~45080312r [2011.05.22 12:10:34 | 000,000,120 | -H-- | M] () -- C:\ProgramData\~45080312 [2011.05.22 12:10:31 | 000,000,599 | -H-- | M] () -- C:\Users\Maya\Desktop\Windows Vista Recovery.lnk [2011.05.22 12:10:25 | 000,000,336 | -H-- | M] () -- C:\ProgramData\45080312 [2011.05.22 11:10:22 | 000,077,824 | -H-- | M] () -- C:\Users\Maya\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.05.22 02:09:17 | 000,002,475 | -H-- | M] () -- C:\Users\Maya\Desktop\TubeBox! starten.lnk [2011.05.21 04:28:21 | 000,001,981 | -H-- | M] () -- C:\Users\Maya\Desktop\Der Herr der Ringe Online.lnk [2011.05.17 20:44:04 | 000,052,169 | -H-- | M] () -- C:\Users\Maya\Desktop\Darwinfinken.jpg [2011.05.16 23:25:47 | 000,080,165 | -H-- | M] () -- C:\Users\Maya\Desktop\Zwillingsspechte.jpg [2011.05.16 23:03:00 | 000,087,006 | -H-- | M] () -- C:\Users\Maya\Desktop\Erdhörnchen.jpg [2011.05.16 22:06:31 | 000,007,052 | -H-- | M] () -- C:\Users\Maya\AppData\Local\d3d9caps.dat [2011.05.16 14:36:31 | 001,194,521 | -H-- | M] () -- C:\Users\Maya\Desktop\gomhb.zip [2011.05.14 15:31:39 | 000,428,312 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\Maya\AppData\Local\*.tmp files -> C:\Users\Maya\AppData\Local\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.22 13:34:23 | 000,000,184 | -H-- | C] () -- C:\Users\Maya\Desktop\NPE.ctl [2011.05.22 13:10:46 | 000,000,000 | -H-- | C] () -- C:\Users\Maya\AppData\Roaming\SMRBackup162.dat [2011.05.22 12:10:34 | 000,000,144 | -H-- | C] () -- C:\ProgramData\~45080312r [2011.05.22 12:10:34 | 000,000,120 | -H-- | C] () -- C:\ProgramData\~45080312 [2011.05.22 12:10:31 | 000,000,599 | -H-- | C] () -- C:\Users\Maya\Desktop\Windows Vista Recovery.lnk [2011.05.22 12:10:25 | 000,000,336 | -H-- | C] () -- C:\ProgramData\45080312 [2011.05.21 04:28:21 | 000,001,981 | -H-- | C] () -- C:\Users\Maya\Desktop\Der Herr der Ringe Online.lnk [2011.05.17 20:44:03 | 000,052,169 | -H-- | C] () -- C:\Users\Maya\Desktop\Darwinfinken.jpg [2011.05.16 23:25:47 | 000,080,165 | -H-- | C] () -- C:\Users\Maya\Desktop\Zwillingsspechte.jpg [2011.05.16 23:02:59 | 000,087,006 | -H-- | C] () -- C:\Users\Maya\Desktop\Erdhörnchen.jpg [2011.05.16 14:36:30 | 001,194,521 | -H-- | C] () -- C:\Users\Maya\Desktop\gomhb.zip [2011.03.23 22:04:21 | 000,007,052 | -H-- | C] () -- C:\Users\Maya\AppData\Local\d3d9caps.dat [2011.01.06 18:30:35 | 000,000,092 | -H-- | C] () -- C:\Users\Maya\AppData\Local\fusioncache.dat [2010.12.06 01:28:48 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll [2010.12.06 01:28:48 | 000,036,640 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys [2010.10.25 11:09:56 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2010.10.25 11:09:56 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2010.10.25 11:09:56 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2010.10.25 11:09:56 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2010.08.25 20:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2010.08.25 20:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2010.08.25 20:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin [2010.08.25 19:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config [2010.08.25 19:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll [2010.08.25 19:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll [2010.08.11 16:06:52 | 000,000,833 | ---- | C] () -- C:\Windows\WININIT.INI [2010.08.11 16:06:30 | 000,001,284 | ---- | C] () -- C:\Windows\ODBC.INI [2010.08.11 16:06:30 | 000,000,892 | ---- | C] () -- C:\Windows\ODBCINST.INI [2010.08.11 16:06:02 | 000,247,296 | ---- | C] () -- C:\Windows\UN160407.EXE [2010.07.27 13:41:36 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.02.21 21:18:19 | 000,000,032 | RH-- | C] () -- C:\ProgramData\hash.dat [2009.09.24 20:06:27 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat [2009.09.05 22:26:57 | 000,013,786 | ---- | C] () -- C:\Windows\DIIUnin.dat [2009.09.01 20:53:32 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2009.09.01 20:53:32 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2009.09.01 20:53:32 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2009.08.25 16:25:44 | 000,000,077 | ---- | C] () -- C:\Windows\NARBACULARDROP.INI [2009.08.23 16:15:34 | 000,000,000 | -H-- | C] () -- C:\Users\Maya\AppData\Roaming\wklnhst.dat [2009.08.08 18:55:51 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.08.08 18:55:51 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.07.24 15:13:28 | 000,000,038 | ---- | C] () -- C:\Windows\MahJongg Mega-Pack.dat [2009.06.26 13:12:52 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll [2009.06.26 13:10:50 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll [2009.06.26 13:10:28 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini [2009.06.15 00:00:30 | 000,101,263 | ---- | C] () -- C:\Windows\System32\8e5b993f-dec8-addd-530b-73b476200d78.exe [2009.05.31 14:34:19 | 000,183,040 | ---- | C] () -- C:\Windows\PI.EXE [2009.05.08 10:13:04 | 000,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll [2009.04.30 22:39:36 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini [2009.04.30 16:00:12 | 000,025,624 | -H-- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys [2009.04.19 21:07:49 | 000,000,000 | -H-- | C] () -- C:\ProgramData\LauncherAccess.dt [2009.04.19 21:01:04 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys [2009.04.05 15:56:08 | 000,271,360 | -H-- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2009.04.05 15:55:58 | 000,018,048 | -H-- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2009.03.23 20:31:35 | 000,077,824 | -H-- | C] () -- C:\Users\Maya\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.03.17 01:25:23 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1527.dll [2009.03.17 01:25:23 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin [2009.03.16 18:07:59 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2009.03.16 16:08:18 | 000,204,800 | -H-- | C] () -- C:\Windows\System32\SysHook.dll [2009.03.16 16:02:48 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2009.03.16 16:02:48 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2009.03.16 16:02:48 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2008.05.08 05:32:19 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.05.08 05:32:19 | 000,121,520 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.05.08 05:32:19 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2008.05.08 05:32:19 | 000,000,000 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.05.07 20:06:49 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll [2008.05.07 20:03:50 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll [2008.05.07 20:03:50 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll [2008.04.30 10:09:06 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.04.30 10:09:01 | 000,872,448 | ---- | C] () -- C:\Windows\iconv.dll [2008.04.30 10:09:01 | 000,743,424 | ---- | C] () -- C:\Windows\libxml2.dll [2008.04.30 10:09:01 | 000,000,041 | ---- | C] () -- C:\Windows\Prelaunch.ini [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,428,312 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,099,568 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:33:01 | 000,000,000 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll [2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll [2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll [2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll [2000.10.05 02:43:40 | 000,069,632 | R--- | C] () -- C:\Windows\ST1_Un0.exe ========== LOP Check ========== [2009.07.19 18:57:00 | 000,000,000 | -HSD | M] -- C:\Users\Maya\AppData\Roaming\.# [2008.05.07 20:02:23 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Acer GameZone Console [2010.03.24 23:20:53 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Ancient Quest of Saqqarah__intenium [2009.10.02 22:29:10 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Azureus [2009.07.11 22:52:22 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Big Fish Games [2009.07.20 16:25:30 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\BitTorrent [2009.08.13 15:52:24 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Boonty [2009.06.14 23:39:44 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Canneverbe_Limited [2009.10.21 20:35:20 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Clickteam [2010.06.30 23:26:16 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\DVDVideoSoftIEHelpers [2009.08.25 16:41:20 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\EleFun Games [2010.06.28 21:43:17 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\FarmingSimulator2008 [2009.04.18 20:35:09 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\FloodLightGames [2010.02.25 01:13:56 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\FOG Downloader [2009.04.01 18:48:36 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Gaijin Ent [2011.05.22 17:42:09 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\ICQ [2009.03.29 23:58:34 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\iWin [2010.04.04 12:45:37 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\kikin [2010.09.19 18:09:44 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\LG Electronics [2010.12.16 18:44:32 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\LimeWire [2009.06.26 13:14:24 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\MAGIX [2011.03.02 23:37:23 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\OCS [2009.08.11 21:14:41 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\OpenOffice.org [2009.10.11 00:10:01 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Opera [2010.06.15 22:13:51 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Peace Craft [2009.05.23 17:31:22 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\PlayFirst [2010.09.15 22:00:08 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Pogo Games [2011.01.06 13:26:22 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Samsung [2009.09.24 20:06:56 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Skunk Studios [2011.01.27 22:30:51 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\T-Online [2009.09.20 12:56:53 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Template [2010.02.21 21:13:54 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Three Rings Design [2010.07.29 11:49:09 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\TubeBox [2009.12.11 16:02:45 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\ViquaSoft [2010.03.09 23:51:32 | 000,000,000 | -H-D | M] -- C:\Users\Maya\AppData\Roaming\Zylom [2011.05.22 18:29:02 | 000,032,612 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010.12.17 04:31:25 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{9E1969E7-8A4A-496F-8B42-09C11E4AE0D2}.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 98 bytes -> C:\ProgramData\TEMP:9E22BBE8 @Alternate Data Stream - 141 bytes -> C:\ProgramData\TEMP:FB914833 @Alternate Data Stream - 140 bytes -> C:\ProgramData\TEMP:95B8F7F6 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:861A898F @Alternate Data Stream - 132 bytes -> C:\ProgramData\TEMP:E36F5B57 @Alternate Data Stream - 128 bytes -> C:\ProgramData\TEMP:A3B8F70C @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:9F683177 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:580E04D8 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:8AB6C1D7 @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:8173A019 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:D61F920D @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:B623B5B8 @Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:2B99FE60 @Alternate Data Stream - 121 bytes -> C:\ProgramData\TEMP:193426B4 @Alternate Data Stream - 117 bytes -> C:\ProgramData\TEMP:57B4E612 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:FC420CE6 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:588B60C7 @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:225C4FFC @Alternate Data Stream - 113 bytes -> C:\ProgramData\TEMP:8140CB50 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:4F636E25 @Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:4CF61E54 @Alternate Data Stream - 107 bytes -> C:\ProgramData\TEMP:793F316E @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:CF61CE5A @Alternate Data Stream - 101 bytes -> C:\ProgramData\TEMP:131C0EE9 < End of report > Geändert von Benya08 (22.05.2011 um 18:45 Uhr) Grund: Sorry, die Malwarelog datei ist unauffindbar um sie als datei hochzuladen und die OTL datei ist zu groß, Winzip geht nicht |
| Themen zu Trojaner! Malware bereits ausgeführt, Virus aber noch da? |
| alternate, antivir, askbar, autorun, avira, bho, cdburnerxp, conduit, converter, desktop, device driver, error, firefox, format, google, home, intranet, launch, logfile, malware, mozilla, mp3, object, oldtimer, pando media booster, plug-in, popup, realtek, registry, riskware.tool.ck, scan, searchplugins, software, start menu, super, sweetim, symantec, trojaner, tubebox, virus, vista |
Baum-Darstellung