Trojaner-Board
Seite 1 von 3 1 23
100 Beitrge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   "Achtung! Aus Sicherheitsgrnden wurde Ihr Windowssystem blockiert" (https://www.trojaner-board.de/109264-achtung-sicherheitsgruenden-wurde-windowssystem-blockiert.html)

Plastikrudi 06.02.2012 21:28
"Achtung! Aus Sicherheitsgrnden wurde Ihr Windowssystem blockiert"
 
Hallo,
bin neu im Forum hier, brauche dringend hilfe.

Habe folgendes problem, undzwar war ich auf einer Stream seite wo man Filme gucken kann, und bekam pltzlich eine Meldung ("Achtung! Aus Sicherheitsgrnden wurde Ihr Windowssystem blockiert"
"Besuchen von Seiten mit infiziertem und pornographischen Inhalt",

Wie werde ich ihn wieder los??
Um eine schnelle hilfe wr ich dankbar;)

Mein System ist Windows Vista und 32bit

markusg 06.02.2012 21:42
hi,
neustarten, f8 drcken, abgesicherter modus mit netzwerk whlen.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Plastikrudi 07.02.2012 22:00
OTL.TxtOTL Logfile:
Code:
OTL logfile created on: 07.02.2012 21:45:11 - Run 2
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Richard\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,40 Gb Available Physical Memory | 70,01% Memory free
4,23 Gb Paging File | 3,81 Gb Available in Paging File | 89,99% Paging File free
Paging file location(s): ?:\pagefile.sys
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 458,64 Gb Total Space | 104,08 Gb Free Space | 22,69% Space Free | Partition Type: NTFS
Drive D: | 7,12 Gb Total Space | 0,95 Gb Free Space | 13,34% Space Free | Partition Type: NTFS
 
Computer Name: RICHARD-PC | User Name: Richard | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Richard\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\WinRAR\RarExt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (NVCScheduler) --  File not found
SRV - (nvcoas) --  File not found
SRV - (Norman NJeeves) --  File not found
SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (WinHttpAutoProxySvc) -- winhttp.dll (Microsoft Corporation)
SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (VMCService) -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe (Vodafone)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (LiveUpdate) -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE (Symantec Corporation)
SRV - (Automatisches LiveUpdate - Scheduler) -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (Symantec Corporation)
SRV - (PnkBstrA) -- C:\Program Files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe ()
SRV - (HPBtnSrv) -- c:\hp\HPEZBTN\HPBtnSrv.exe ()
SRV - (Remote UI Service) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe (Intel(R) Corporation)
SRV - (MCLServiceATL) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe (Intel(R) Corporation)
SRV - (ISSM) Intel(R) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe (Intel(R) Corporation)
SRV - (AlertService) Intel(R) -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe (Intel(R) Corporation)
SRV - (DQLWinService) -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe ()
SRV - (M1 Server) Intel(R) Viiv(TM) -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe ()
SRV - (IntelDHSvcConf) -- C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe (Intel(R) Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (aswSnx) -- C:\Windows\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMonFlt) -- C:\Windows\System32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (npf) -- C:\Windows\System32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - ({22D78859-9CE9-4B77-BF18-AC83E81A9263}) -- C:\Programme\HP\DVDPlay\000.fcl (CyberLink Corp.)
DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.)
DRV - (hwusbfake) -- C:\Windows\System32\drivers\ewusbfake.sys (Huawei Technologies Co., Ltd.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation)
DRV - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation)
DRV - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation)
DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation)
DRV - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation)
DRV - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation)
DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (tcpipBM) -- C:\Windows\System32\drivers\tcpipBM.sys (Bytemobile, Inc.)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (HCW85BDA) -- C:\Windows\System32\drivers\HCW85BDA.sys (Hauppauge Computer Works)
DRV - (NvcMFlt) -- C:\Windows\System32\drivers\nvcv32mf.sys (Norman ASA)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Corp.)
DRV - (prodrv06) -- C:\Windows\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (prohlp02) -- C:\Windows\System32\drivers\prohlp02.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (prosync1) -- C:\Windows\System32\drivers\prosync1.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\Windows\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp01) -- C:\Windows\System32\drivers\sfhlp01.sys (Protection Technology)
DRV - (sfsync01) -- C:\Windows\System32\drivers\sfsync01.sys (StarForce Technologies, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 AF 90 EF 1F 88 CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {83821C2B-32A8-4DD7-B6D4-44309A78E668} - C:\Programme\Mail.Ru\Agent\Mra\dll\newmrasearch.dll ()
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://de.ask.com/?l=dis&o=14672"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.8
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.4.3
FF - prefs.js..extensions.enabledItems: {37964A3C-4EE8-47b1-8321-34DE2C39BA4D}:2.5.2.20
FF - prefs.js..extensions.enabledItems: downloader@finalvideotools.com:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: DefaultManager@Microsoft:2.1
FF - prefs.js..extensions.enabledItems: support@predictad.com:1.11
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.9.0.3
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: mail@gutscheinrausch.de:2.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: wrc@avast.com:6.0.1367
FF - prefs.js..keyword.URL: "hxxp://go.mail.ru/search?utf8in=1&fr=fftbUFix&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ƒ’‚ƒ€‚¸ƒ’‚ƒ€š‚¾ƒ’‚ƒ€š‚¸ƒ’â‚œƒ€š‚ƒ’‚ƒ€š‚º@mail.ru"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "ƒ’‚ƒ€‚¸ƒ’‚ƒ€š‚¾ƒ’‚ƒ€š‚¸ƒ’â‚œƒ€š‚ƒ’‚ƒ€š‚º@mail.ru"
FF - prefs.js..browser.startup.homepage: "hxxp://www.mail.ru"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{0329E7D6-6F54-462D-93F6-F5C3118BADF2}: C:\Program Files\SpeedBit Video Downloader\SPFireFox
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\downloader@finalvideotools.com: C:\Program Files\FinalVideoDownloader\Firefox [2010.04.27 14:10:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ff-bmboc@bytemobile.com: C:\Program Files\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2010.09.08 20:15:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.01.25 19:26:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.23 14:45:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.23 14:45:21 | 000,000,000 | ---D | M]
 
[2009.04.10 15:31:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Richard\AppData\Roaming\mozilla\Extensions
[2012.01.30 13:24:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions
[2010.04.27 14:17:25 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.01.26 22:05:47 | 000,000,000 | ---D | M] (Спƒ‚ник @Mail.Ru) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{37964A3C-4EE8-47b1-8321-34DE2C39BA4D}
[2012.01.11 23:20:40 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.01.11 23:20:33 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.12.19 17:12:25 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.01.11 23:20:31 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.07.20 21:24:54 | 000,000,000 | ---D | M] (Microsoft Default Manager) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\DefaultManager@Microsoft
[2011.04.06 22:49:05 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\engine@conduit.com
[2010.12.22 20:38:19 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\mail@gutscheinrausch.de
[2010.07.31 23:39:05 | 000,000,000 | ---D | M] ("AutocompletePro - Your handy search suggestions tool") -- C:\Users\Richard\AppData\Roaming\mozilla\Firefox\Profiles\i7z0g9l0.default\extensions\support@predictad.com
[2012.01.30 13:21:26 | 000,002,401 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\askcom.xml
[2009.12.29 01:31:41 | 000,002,163 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\bing.xml
[2010.12.19 18:13:27 | 000,000,873 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\conduit.xml
[2012.02.01 20:11:54 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-1.xml
[2010.03.24 15:32:50 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-10.xml
[2010.04.02 12:24:44 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-11.xml
[2010.04.27 14:10:31 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-12.xml
[2010.06.28 00:20:32 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-13.xml
[2010.07.09 23:39:47 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-14.xml
[2010.07.24 02:07:12 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-15.xml
[2010.07.30 00:58:57 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-16.xml
[2010.09.10 14:49:03 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-17.xml
[2010.09.17 14:06:33 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-18.xml
[2010.10.27 13:49:54 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-19.xml
[2009.07.26 16:55:11 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-2.xml
[2010.10.31 19:22:02 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-20.xml
[2010.12.16 23:09:24 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-21.xml
[2011.04.01 14:38:33 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-22.xml
[2011.05.17 15:02:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-23.xml
[2011.06.27 12:12:37 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-24.xml
[2011.08.17 00:02:31 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-25.xml
[2011.08.19 17:36:59 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-26.xml
[2011.09.18 17:53:00 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-27.xml
[2011.09.30 00:15:00 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-28.xml
[2011.10.24 21:26:41 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-29.xml
[2009.09.11 15:48:39 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-3.xml
[2012.01.11 12:56:28 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-30.xml
[2012.01.23 14:45:55 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-31.xml
[2012.01.30 13:21:24 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-32.xml
[2009.10.06 21:42:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-4.xml
[2009.11.08 15:34:41 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-5.xml
[2010.01.10 13:52:56 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-6.xml
[2010.01.24 19:10:29 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-7.xml
[2010.02.15 16:18:34 | 000,000,961 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-8.xml
[2010.03.12 16:32:39 | 000,000,950 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin-9.xml
[2010.06.21 16:35:24 | 000,001,042 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\icqplugin.xml
[2012.01.26 22:05:51 | 000,001,533 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\mailru---.xml
[2009.12.07 14:12:08 | 000,003,915 | ---- | M] () -- C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\searchplugins\sweetim.xml
[2012.01.23 14:45:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.07.14 17:07:09 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.01.25 19:26:43 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
() (No name found) -- C:\USERS\RICHARD\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\I7Z0G9L0.DEFAULT\EXTENSIONS\{D249FD00-4DF9-11D9-9FDC-0080481ADA61}.XPI
[2012.01.23 14:45:19 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.02.02 21:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2012.01.23 14:45:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.24 20:22:50 | 000,002,227 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.01.23 14:45:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.23 14:45:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.09.28 17:14:06 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrchstonicde.xml
[2012.01.23 14:45:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.02 20:48:25 | 000,001,431 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\mailru.xml
[2012.01.23 14:45:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.23 14:45:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2008.12.28 02:23:23 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Programme\AutocompletePro\AutocompletePro.dll (SimplyGen)
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {09900DE8-1DCA-443F-9243-26FF581438AF} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [MAgent] C:\Program Files\Mail.Ru\Agent\MAgent.exe (Mail.Ru)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [OsdMaestro] C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe (OsdMaestro)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Firefox helper] C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe ()
O4 - HKCU..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RMTray.exe (PC Tools)
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\Run: [Userinit] C:\Users\Richard\AppData\Roaming\appconf32.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Download Video - {3B54DEAB-C6D4-48a8-8C32-A70558643400} - C:\Programme\FinalVideoDownloader\fvdRunner.html ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Mail.Ru Agent - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Programme\Mail.Ru\Agent\magent.exe (Mail.Ru)
O9 - Extra 'Tools' menuitem : Mail.Ru Agent - {7558B7E5-7B26-4201-BEDB-00D5FF534523} - C:\Programme\Mail.Ru\Agent\magent.exe (Mail.Ru)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\System32\winrnr.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\System32\winrnr.dll File not found
O13 - gopher Prefix: missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3B5CDD45-01AC-4ECC-8809-5C90E63E326C}: DhcpNameServer = 139.7.30.126 139.7.30.125
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{743D1FE6-E8C7-48E8-9E89-33E50509FED2}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{89D04780-B12E-4143-A6E2-732BCDF0B68D}: DhcpNameServer = 139.7.30.126 139.7.30.125
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{96807F5F-54E5-406D-927A-829EEB2055A6}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O22 - SharedTaskScheduler: {1984DD45-52CF-49cd-AB77-18F378FEA264} - FencesShellExt - C:\Programme\Stardock\Fences\FencesMenu.dll (Stardock)
O24 - Desktop WallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Richard\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) -credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.10.11 19:46:48 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL L:\SYsteM.Exe
O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\explOre\CoMmand - "" = L:\SYSTEM.EXE
O33 - MountPoints2\{5af80d21-4de9-11df-b972-001d60e0644a}\Shell\opEN\commAnD - "" = L:\SYSTEM.EXE
O33 - MountPoints2\{60632e55-ab50-11dd-b0f7-001d60e0644a}\Shell - "" = AutoRun
O33 - MountPoints2\{60632e55-ab50-11dd-b0f7-001d60e0644a}\Shell\AutoRun\command - "" = M:\LaunchU3.exe -a
O33 - MountPoints2\{80ae6f41-d2d8-11df-802f-001e101f21c1}\Shell - "" = AutoRun
O33 - MountPoints2\{80ae6f41-d2d8-11df-802f-001e101f21c1}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{974696a8-bb71-11df-baf1-001d60e0644a}\Shell - "" = AutoRun
O33 - MountPoints2\{974696a8-bb71-11df-baf1-001d60e0644a}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{974696af-bb71-11df-baf1-001e101f21c1}\Shell - "" = AutoRun
O33 - MountPoints2\{974696af-bb71-11df-baf1-001e101f21c1}\Shell\AutoRun\command - "" = L:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{a50ecd36-9b75-11dd-922b-001d60e0644a}\Shell\AutoRun\command - "" = L:\setupSNK.exe
O33 - MountPoints2\{f24c8bb2-3e45-11df-a4ca-001d60e0644a}\Shell - "" = AutoRun
O33 - MountPoints2\{f24c8bb2-3e45-11df-a4ca-001d60e0644a}\Shell\AutoRun\command - "" = L:\Startme.exe
O33 - MountPoints2\{f75dac93-bcdf-11df-a7a1-001e101f36d9}\Shell - "" = AutoRun
O33 - MountPoints2\{f75dac93-bcdf-11df-a7a1-001e101f36d9}\Shell\AutoRun\command - "" = N:\setup_vmc_lite.exe /checkApplicationPresence
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\System32\Microsoft
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - C:\Windows\System32\Microsoft
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.06 20:57:13 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Richard\Desktop\OTL.exe
[2012.02.06 20:48:43 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\UAs
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\xmldm
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\kock
[2012.02.02 23:16:20 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Bad To The Bonehead
[2012.02.02 19:12:27 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\NS Music Sampler I (2010)
[2012.02.01 22:45:39 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Soldatenlieder Der Wehrmacht
[2012.02.01 22:10:54 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Tribute To R.O.A
[2012.02.01 20:13:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows
[2012.01.30 12:43:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aTube Catcher
[2012.01.30 12:42:30 | 000,000,000 | ---D | C] -- C:\Program Files\DsNET Corp
[2012.01.30 12:40:48 | 013,758,448 | ---- | C] (DsNET Corp) -- C:\Users\Richard\Desktop\aTube_Catcher_Setup2.6.769.exe
[2012.01.25 19:03:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.01.25 19:03:27 | 000,020,568 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.01.25 19:03:26 | 000,314,456 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.01.25 19:03:18 | 000,034,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2012.01.25 19:03:13 | 000,052,952 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.01.25 19:03:11 | 000,435,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.01.25 19:03:10 | 000,055,128 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.01.25 19:02:39 | 000,199,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.01.25 19:02:39 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.01.22 14:28:45 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Doom 3
[2012.01.22 13:53:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DOOM 3 Resurrection of Evil
[2012.01.22 13:44:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Doom 3
[2012.01.22 13:16:05 | 000,000,000 | ---D | C] -- C:\Program Files\Doom 3
[2012.01.18 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\Richard\Desktop\Bilder
[2012.01.12 17:32:45 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[2009.06.16 13:03:56 | 000,126,976 | ---- | C] ( ) -- C:\Windows\System32\Interop.SHDocVw.dll
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Richard\AppData\Roaming\*.tmp files -> C:\Users\Richard\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.07 21:41:21 | 000,001,356 | ---- | M] () -- C:\Users\Richard\AppData\Local\d3d9caps.dat
[2012.02.07 21:21:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.07 21:18:37 | 000,289,888 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.02.07 21:18:37 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.07 21:18:37 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.06 21:48:31 | 000,030,208 | ---- | M] () -- C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.06 20:57:13 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Richard\Desktop\OTL.exe
[2012.02.06 20:41:23 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.02.06 19:03:42 | 000,289,888 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.02.06 19:03:34 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.02.06 16:24:13 | 000,032,428 | ---- | M] () -- C:\Users\Richard\Desktop\Patrick_Star_Gone_Bad_by_KirbyOfStars[1].jpg
[2012.02.05 21:11:51 | 007,536,640 | ---- | M] () -- C:\Users\Richard\Desktop\El Chupacabra.mp3
[2012.02.04 12:40:40 | 006,179,466 | ---- | M] () -- C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3
[2012.02.04 12:23:45 | 000,766,391 | ---- | M] () -- C:\Users\Richard\Desktop\Unbenannt.jpg
[2012.02.04 12:14:38 | 084,155,271 | ---- | M] () -- C:\Users\Richard\Desktop\Resident Evil (Games).wmv
[2012.02.04 04:12:03 | 000,539,136 | ---- | M] () -- C:\Users\Richard\Desktop\Mein Resident Evil Projekt.MSWMM
[2012.02.04 03:01:11 | 807,898,963 | ---- | M] () -- C:\Users\Richard\Desktop\Resident_Evil_4_HD_Biohazard_4_HD_para_PS3_primeros_30_minutos_de_juego_Parte_1_2.wmv
[2012.02.04 02:41:17 | 078,283,195 | ---- | M] () -- C:\Users\Richard\Desktop\Trailer 2.wmv
[2012.02.02 18:23:08 | 000,072,319 | ---- | M] () -- C:\Users\Richard\Desktop\Bad+To+The+Bonehead+bttb+whac[1].jpg
[2012.02.01 23:01:26 | 029,112,069 | ---- | M] () -- C:\Users\Richard\Desktop\Metro_2033_-_Nazi_Megaphone_Music.wmv
[2012.02.01 22:41:42 | 004,406,567 | ---- | M] () -- C:\Users\Richard\Desktop\09-kalinka-russisch.mp3
[2012.02.01 22:20:41 | 002,389,465 | ---- | M] () -- C:\Users\Richard\Desktop\Katusha.mp3
[2012.02.01 15:15:11 | 029,699,186 | ---- | M] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.flv
[2012.02.01 14:36:25 | 007,408,402 | ---- | M] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.mp3
[2012.01.31 10:59:48 | 063,035,150 | ---- | M] () -- C:\Users\Richard\Desktop\.wmv
[2012.01.31 08:56:25 | 000,000,330 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForRichard.job
[2012.01.30 19:55:14 | 073,269,329 | ---- | M] () -- C:\Users\Richard\Desktop\Hatecore.wmv
[2012.01.30 19:01:03 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.30 19:01:03 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.30 19:01:03 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.30 19:01:03 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.30 13:27:36 | 028,715,189 | ---- | M] () -- C:\Users\Richard\Desktop\Iron Sky Teaser 2.wmv
[2012.01.30 12:43:58 | 000,001,915 | ---- | M] () -- C:\Users\Public\Desktop\MP3 Downloader.lnk
[2012.01.30 12:43:58 | 000,001,911 | ---- | M] () -- C:\Users\Public\Desktop\Video Search.lnk
[2012.01.30 12:43:52 | 000,000,981 | ---- | M] () -- C:\Users\Public\Desktop\aTube Catcher.lnk
[2012.01.30 12:40:58 | 013,758,448 | ---- | M] (DsNET Corp) -- C:\Users\Richard\Desktop\aTube_Catcher_Setup2.6.769.exe
[2012.01.25 19:26:43 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.01.25 19:03:28 | 000,001,831 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.01.22 14:28:46 | 000,000,771 | ---- | M] () -- C:\Users\Richard\Desktop\Doom3.lnk
[2012.01.22 14:26:48 | 019,653,399 | ---- | M] () -- C:\Users\Richard\Desktop\DOOM3-1.3.1.exe
[2012.01.22 13:53:20 | 000,001,461 | ---- | M] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk
[2012.01.22 13:53:16 | 000,000,338 | ---- | M] () -- C:\Windows\d3xp.ini
[2012.01.22 13:44:29 | 000,001,415 | ---- | M] () -- C:\Users\Public\Desktop\Doom 3.lnk
[2012.01.22 13:44:24 | 000,000,331 | ---- | M] () -- C:\Windows\doom3.ini
[2012.01.20 17:26:07 | 033,520,769 | ---- | M] () -- C:\Users\Richard\Desktop\DeeEmGY_-_Unfinished_War.flv
[2012.01.18 00:01:44 | 000,000,375 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.01.16 15:21:16 | 000,001,889 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012.01.16 00:16:42 | 000,000,349 | ---- | M] () -- C:\Users\Public\Documents\PCLECHAL.INI
[2012.01.12 17:32:45 | 000,000,215 | ---- | M] () -- C:\Users\Richard\Desktop\Metro 2033.url
[2012.01.12 09:14:11 | 000,410,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.01.11 15:27:40 | 025,374,587 | ---- | M] () -- C:\Users\Richard\Desktop\Nordglanz_-_Als_die_Alten_jung_noch_waren.wmv
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Richard\AppData\Roaming\*.tmp files -> C:\Users\Richard\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.06 16:24:20 | 000,032,428 | ---- | C] () -- C:\Users\Richard\Desktop\Patrick_Star_Gone_Bad_by_KirbyOfStars[1].jpg
[2012.02.05 21:10:36 | 007,536,640 | ---- | C] () -- C:\Users\Richard\Desktop\El Chupacabra.mp3
[2012.02.04 12:23:42 | 000,766,391 | ---- | C] () -- C:\Users\Richard\Desktop\Unbenannt.jpg
[2012.02.04 12:12:27 | 084,155,271 | ---- | C] () -- C:\Users\Richard\Desktop\Resident Evil (Games).wmv
[2012.02.04 04:12:02 | 000,539,136 | ---- | C] () -- C:\Users\Richard\Desktop\Mein Resident Evil Projekt.MSWMM
[2012.02.04 02:47:45 | 807,898,963 | ---- | C] () -- C:\Users\Richard\Desktop\Resident_Evil_4_HD_Biohazard_4_HD_para_PS3_primeros_30_minutos_de_juego_Parte_1_2.wmv
[2012.02.04 02:39:48 | 078,283,195 | ---- | C] () -- C:\Users\Richard\Desktop\Trailer 2.wmv
[2012.02.02 18:23:28 | 000,072,319 | ---- | C] () -- C:\Users\Richard\Desktop\Bad+To+The+Bonehead+bttb+whac[1].jpg
[2012.02.01 23:01:12 | 029,112,069 | ---- | C] () -- C:\Users\Richard\Desktop\Metro_2033_-_Nazi_Megaphone_Music.wmv
[2012.02.01 22:41:26 | 004,406,567 | ---- | C] () -- C:\Users\Richard\Desktop\09-kalinka-russisch.mp3
[2012.02.01 22:20:35 | 002,389,465 | ---- | C] () -- C:\Users\Richard\Desktop\Katusha.mp3
[2012.02.01 15:13:17 | 029,699,186 | ---- | C] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.flv
[2012.02.01 14:36:11 | 007,408,402 | ---- | C] () -- C:\Users\Richard\Desktop\Jamiroquai Deeper Underground.mp3
[2012.01.31 10:56:54 | 063,035,150 | ---- | C] () -- C:\Users\Richard\Desktop\.wmv
[2012.01.30 19:54:23 | 073,269,329 | ---- | C] () -- C:\Users\Richard\Desktop\Hatecore.wmv
[2012.01.30 13:37:27 | 006,179,466 | ---- | C] () -- C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3
[2012.01.30 13:26:48 | 028,715,189 | ---- | C] () -- C:\Users\Richard\Desktop\Iron Sky Teaser 2.wmv
[2012.01.30 12:43:58 | 000,001,915 | ---- | C] () -- C:\Users\Public\Desktop\MP3 Downloader.lnk
[2012.01.30 12:43:58 | 000,001,911 | ---- | C] () -- C:\Users\Public\Desktop\Video Search.lnk
[2012.01.30 12:43:52 | 000,000,981 | ---- | C] () -- C:\Users\Public\Desktop\aTube Catcher.lnk
[2012.01.25 19:03:28 | 000,001,831 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.01.23 14:45:23 | 000,000,860 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.01.22 14:28:46 | 000,000,771 | ---- | C] () -- C:\Users\Richard\Desktop\Doom3.lnk
[2012.01.22 14:26:32 | 019,653,399 | ---- | C] () -- C:\Users\Richard\Desktop\DOOM3-1.3.1.exe
[2012.01.22 13:53:20 | 000,001,461 | ---- | C] () -- C:\Users\Public\Desktop\DOOM 3 Resurrection of Evil.lnk
[2012.01.22 13:53:16 | 000,000,338 | ---- | C] () -- C:\Windows\d3xp.ini
[2012.01.22 13:44:29 | 000,001,415 | ---- | C] () -- C:\Users\Public\Desktop\Doom 3.lnk
[2012.01.22 13:44:24 | 000,000,331 | ---- | C] () -- C:\Windows\doom3.ini
[2012.01.20 17:24:00 | 033,520,769 | ---- | C] () -- C:\Users\Richard\Desktop\DeeEmGY_-_Unfinished_War.flv
[2012.01.16 15:21:16 | 000,001,889 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2012.01.16 15:21:16 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
[2012.01.12 17:32:45 | 000,000,215 | ---- | C] () -- C:\Users\Richard\Desktop\Metro 2033.url
[2012.01.11 15:26:47 | 025,374,587 | ---- | C] () -- C:\Users\Richard\Desktop\Nordglanz_-_Als_die_Alten_jung_noch_waren.wmv
[2011.10.24 20:23:39 | 000,107,520 | -HS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.12.22 20:38:07 | 000,444,283 | ---- | C] () -- C:\Program Files\Common Files\WinPcapNmap.exe
[2010.06.23 11:35:52 | 000,790,528 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2010.06.23 11:35:52 | 000,134,144 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2010.06.04 19:31:56 | 000,000,280 | ---- | C] () -- C:\Windows\game.ini
[2010.05.26 14:01:15 | 000,000,745 | ---- | C] () -- C:\Windows\CoD.INI
[2010.05.18 00:47:52 | 000,108,032 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2010.05.11 19:08:30 | 000,000,620 | ---- | C] () -- C:\Windows\eReg.dat
[2010.04.27 20:22:14 | 000,000,600 | ---- | C] () -- C:\Windows\Rtcw.INI
[2010.04.17 20:30:41 | 000,289,888 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.04.17 20:30:41 | 000,289,888 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.04.13 17:49:45 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE
[2010.03.10 19:56:41 | 000,000,416 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\burnaware.ini
[2010.02.24 00:06:04 | 000,031,007 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\UserTile.png
[2010.01.27 03:09:02 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2009.08.16 09:08:36 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.07.23 15:15:27 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.07.23 11:17:28 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.07.23 11:17:27 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.06.16 13:03:58 | 000,053,248 | ---- | C] () -- C:\Windows\System32\dossec.dll
[2009.06.16 12:25:02 | 000,121,512 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2009.06.09 08:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll
[2009.03.08 21:39:00 | 000,000,095 | ---- | C] () -- C:\Users\Richard\AppData\Local\fusioncache.dat
[2009.03.08 20:44:40 | 000,022,328 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\PnkBstrK.sys
[2009.03.08 20:44:19 | 000,669,184 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2009.02.01 15:43:56 | 000,066,872 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2009.02.01 15:43:52 | 000,136,888 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2009.02.01 15:43:40 | 000,111,928 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.12.09 16:23:13 | 000,052,216 | RHS- | C] () -- C:\Users\Richard\AppData\Roaming\appconf32.exe
[2008.10.12 21:13:55 | 000,000,604 | ---- | C] () -- C:\Windows\Sof2.INI
[2008.07.03 16:04:27 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2008.07.03 16:04:27 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2008.07.03 16:04:27 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2008.04.18 20:29:11 | 000,000,583 | ---- | C] () -- C:\Windows\QIII.INI
[2008.04.17 20:04:42 | 000,008,653 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.03.28 12:15:10 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.01.29 21:12:36 | 000,001,356 | ---- | C] () -- C:\Users\Richard\AppData\Local\d3d9caps.dat
[2007.12.26 03:10:10 | 000,000,202 | ---- | C] () -- C:\Users\Richard\AppData\Roaming\wklnhst.dat
[2007.12.24 01:34:53 | 000,030,208 | ---- | C] () -- C:\Users\Richard\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.10.12 04:54:08 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2007.10.12 04:54:08 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2007.10.12 04:54:08 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2007.10.12 04:54:08 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007.10.11 19:43:36 | 000,114,973 | ---- | C] () -- C:\Windows\hpqins13.dat
[2007.10.11 19:39:06 | 000,003,758 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2007.10.11 19:38:47 | 000,066,048 | ---- | C] () -- C:\Windows\System32\hcwxds.dll
[2007.10.11 19:31:42 | 000,061,440 | ---- | C] () -- C:\Windows\System32\OsdRemove.exe
[2007.10.11 19:29:23 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2007.10.11 19:29:23 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2007.02.05 19:05:26 | 000,000,038 | ---- | C] () -- C:\Windows\AviSplitter.INI
[2007.01.26 00:04:12 | 000,138,752 | ---- | C] () -- C:\Windows\System32\mase32.dll
[2007.01.26 00:04:12 | 000,027,648 | ---- | C] () -- C:\Windows\System32\ma32.dll
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,410,016 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.06.23 09:09:34 | 000,019,968 | R--- | C] () -- C:\Windows\System32\cpuinf32.dll
 
========== LOP Check ==========
 
[2009.12.27 01:54:47 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Apowersoft
[2011.12.30 20:19:00 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bioshock
[2010.04.17 21:22:18 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bioshock2
[2010.09.08 20:16:45 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Bytemobile
[2011.10.24 19:53:32 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Cocoon Software
[2008.12.22 17:10:57 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Codemasters
[2008.10.12 19:51:26 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\DAEMON Tools
[2011.05.30 18:19:49 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Desktopicon
[2010.12.19 17:12:25 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.04.27 14:11:31 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\FinalVideoDownloader
[2010.02.02 16:01:58 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Gearbox Software
[2012.02.06 18:56:27 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\ICQ
[2012.02.06 18:56:18 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\kock
[2008.12.29 17:21:08 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Leadertech
[2008.10.29 16:44:11 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Mail.Ru
[2010.03.13 14:18:13 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\MetaProducts
[2010.02.18 21:09:10 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Mra
[2010.02.24 00:06:04 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\PeerNetworking
[2010.09.25 12:01:01 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\PhotoScape
[2010.04.02 14:09:09 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Sony
[2010.04.02 13:58:52 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Sony Setup
[2010.07.16 22:23:59 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Stardock
[2007.12.26 03:10:36 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Template
[2011.04.17 10:44:12 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\thriXXX
[2008.12.29 22:11:10 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Touchstone
[2010.08.03 03:03:50 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\TuneUp Software
[2012.02.06 20:48:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\UAs
[2008.12.29 19:05:47 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Ubisoft
[2010.01.16 15:26:01 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\UltraGet
[2011.04.11 21:30:02 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\VDownloader
[2010.07.19 14:27:22 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\VistaCodecs
[2010.09.08 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Vodafone
[2010.09.08 20:18:30 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Vodafone Mobile Connect
[2008.04.11 14:21:21 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\WinBatch
[2010.07.31 23:26:28 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Xilisoft
[2012.02.06 20:48:43 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\xmldm
[2012.01.16 17:55:31 | 000,000,000 | ---D | M] -- C:\Users\Richard\AppData\Roaming\Youtube Downloader HD
[2012.02.07 21:18:53 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2007.12.19 20:46:07 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.10.31 16:43:06 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.12.19 20:36:42 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.12.26 12:50:45 | 000,000,000 | -H-D | M] -- C:\hp
[2010.12.05 16:45:16 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2010.07.21 19:02:11 | 000,000,000 | ---D | M] -- C:\MyAudio
[2009.09.05 21:08:24 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2012.01.30 13:24:31 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.02.01 20:13:00 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2007.12.19 20:36:42 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.02.04 20:28:36 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.03.13 14:18:28 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.31 08:56:16 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 08:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 08:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.03.29 03:09:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.03.29 03:09:01 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.03.29 03:09:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.03.29 03:15:24 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008.03.29 03:15:23 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2009.02.01 15:19:44 | 000,004,608 | ---- | M] () MD5=F737B39DC1264F170DD0F43249866D6A -- C:\Users\Richard\AppData\Local\Xenocode\ApplianceCaches\GameCamV2.exe_v70A6B3A1\Native\STUBEXE\@WINDIR@\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 08:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 10:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 08:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 08:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 08:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 10:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.10.12 05:02:17 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2007.10.12 05:02:17 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 08:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 10:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 09:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 06:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 11:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 11:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
[2011.05.20 18:57:08 | 000,353,792 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtmsft.dll
[2011.05.20 18:57:08 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\dxtrans.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2012.02.07 21:56:07 | 006,029,312 | -HS- | M] () -- C:\Users\Richard\ntuser.dat
[2012.02.07 21:56:07 | 000,262,144 | -H-- | M] () -- C:\Users\Richard\ntuser.dat.LOG1
[2007.12.19 20:40:07 | 000,000,000 | -H-- | M] () -- C:\Users\Richard\ntuser.dat.LOG2
[2010.07.21 02:29:04 | 000,065,536 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2010.07.21 02:29:04 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2007.12.19 23:10:27 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2012.02.06 21:52:17 | 000,065,536 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TM.blf
[2012.02.06 21:52:17 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TMContainer00000000000000000001.regtrans-ms
[2010.07.21 15:36:07 | 000,524,288 | -HS- | M] () -- C:\Users\Richard\ntuser.dat{ee09eb06-94b3-11df-b3e7-001d60e0644a}.TMContainer00000000000000000002.regtrans-ms
[2007.12.19 20:40:07 | 000,000,020 | -HS- | M] () -- C:\Users\Richard\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<          >
 
========== Files - Unicode (All) ==========
[2012.02.03 14:57:43 | 005,452,948 | ---- | M] ()(C:\Users\Richard\Desktop\????? - ????.mp3) -- C:\Users\Richard\Desktop\Мечта - Один.mp3
[2012.02.03 01:11:19 | 005,452,948 | ---- | C] ()(C:\Users\Richard\Desktop\????? - ????.mp3) -- C:\Users\Richard\Desktop\Мечта - Один.mp3
[2012.02.01 19:47:48 | 000,000,000 | ---D | M](C:\Users\Richard\Desktop\??????) -- C:\Users\Richard\Desktop\Киборг
[2012.01.29 21:28:51 | 000,000,000 | ---D | M](C:\Users\Richard\Desktop\????????) -- C:\Users\Richard\Desktop\Коловрат
[2012.01.23 16:23:39 | 000,000,000 | ---D | C](C:\Users\Richard\Desktop\????????) -- C:\Users\Richard\Desktop\Коловрат
[2012.01.20 18:46:34 | 016,308,921 | ---- | M] ()(C:\Users\Richard\Desktop\???????? ???????.wmv) -- C:\Users\Richard\Desktop\Кавказцы звереют.wmv
[2012.01.20 18:46:11 | 016,308,921 | ---- | C] ()(C:\Users\Richard\Desktop\???????? ???????.wmv) -- C:\Users\Richard\Desktop\Кавказцы звереют.wmv
[2012.01.18 22:49:36 | 000,000,000 | ---D | C](C:\Users\Richard\Desktop\??????) -- C:\Users\Richard\Desktop\Киборг
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\Richard\Desktop\El Chupacabra.mp3:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\Richard\Desktop\ASP - Ich Komm Dich Holn.mp3:TOC.WMV
@Alternate Data Stream - 136 bytes -> C:\ProgramData\TEMP:8CE646EE
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:D1B5B4F1
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:010ADD2C

< End of report >
--- --- ---

Plastikrudi 07.02.2012 22:03
Habe in einem anderen Forum dieselben Beitrge gelesen;) ist es normal das bei mir Extra Txt.Logfile mir nicht anzeigt? nur OTL Tx.T

markusg 08.02.2012 11:52
hi


dieses script sowie evtl. folgende scripts sind nur fr den jeweiligen user.
wenn ihr probleme habt, erffnet eigene topics und wartet auf, fr euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [Userinit] C:\Users\Richard\AppData\Roaming\appconf32.exe ()
O4 - HKCU..\Run: [Firefox helper] C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe ()
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\xmldm
[2012.02.06 18:56:18 | 000,000,000 | ---D | C] -- C:\Users\Richard\AppData\Roaming\kock
 :Files
C:\Users\Richard\AppData\Roaming\appconf32.exe
C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nchsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drcke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • ffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und ffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Plastikrudi 08.02.2012 12:55
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully.
C:\Users\Richard\AppData\Roaming\appconf32.exe moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Firefox helper deleted successfully.
C:\Users\Richard\AppData\Local\Mozilla\Firefox\firefox.exe moved successfully.
C:\Users\Richard\AppData\Roaming\xmldm folder moved successfully.
C:\Users\Richard\AppData\Roaming\kock folder moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 41620 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: IUSR_NMPR

User: Public

User: Richard
->Flash cache emptied: 43173 bytes

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: IUSR_NMPR
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Richard
->Temp folder emptied: 140557920 bytes
->Temporary Internet Files folder emptied: 435782565 bytes
->Java cache emptied: 50222685 bytes
->FireFox cache emptied: 188612851 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 466944 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4209441 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 3826584 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 13690539 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 799,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 02082012_124509

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Plastikrudi 08.02.2012 12:56
ist der Virus weg? weil bekomme jetzt keine warn meldung mehr. )))

markusg 08.02.2012 13:30
wo ist der upload? ich warte noch auf den.

Plastikrudi 08.02.2012 14:55
ok habe die MovedFile hochgeladen...))

markusg 08.02.2012 15:17
danke.
nutzt du das system fr onlinebanking, einkufe, sonstige zahlungsabwicklungen, oder hnlich wichtiges, wie zb berufliches?

Plastikrudi 08.02.2012 17:21
nein eigentlich nicht,))) nur Pirvat.))

markusg 08.02.2012 17:22
per was? Pirvat kenne ich nicht.

Plastikrudi 08.02.2012 17:25
also quasi. alles mglcihe Filme gucken oder musik hren halt, kaum ging ich auf eine Stream seite iLoad.to bekam ich diese Meldung. habe brigens Avast als Antiviren programm.

markusg 08.02.2012 17:34
ja, selbst schuld, wer sich illegale inhalte im netz anguckt hatts nicht besser verdient.
die leute machen richtig geld mit euch, investiere es lieber in filme....

Combofix darf ausschlielich ausgefhrt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgefhrt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite fr Downloadlinks und Anweisungen fr dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stren.
  • Poste bitte die C:\Combofix.txt in deiner nchsten Antwort.

Plastikrudi 08.02.2012 17:36
Sorry, wollte fragen, muss ich mein PC fomartieren? ist der Virus noch da ? oder ist der weg? sorry ,kenn mich berhaupt nicht damit aus:dummguck:


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:41 Uhr.
Seite 1 von 3 1 23
100 Beitrge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131