Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Spiele-Account gehackt, Viren vorhanden! (https://www.trojaner-board.de/115510-spiele-account-gehackt-viren-vorhanden.html)

Leomuck 21.05.2012 11:48
Spiele-Account gehackt, Viren vorhanden!
 
Hallo zusammen!

Mir wurde gerade in einem Online-Spiel der Account gehackt. Ich war auf keinen Phishing-Seiten, habe niemandem das Passwort gegeben. Insofern kann es sich wohl nur um einen Hack des Passworts oder eine Infizierung meines PCs handeln? (soweit mein technisches Verständnis)

Kann mir jemand helfen? Ich habe bisher Malwarebytes Anti-Malware durchlaufen lassen, da wurden auch gleich ein paar wenige Sachen gefunden. Außerdem hat Microsoft Security Essentials einige Funde gemeldet, allerdings datiert auf heute Vormittag (der Hack fand aber schon davor statt). OTL.txt habe ich auch angehängt.

Zusätzlich habe ich die Schritte in der Anleitung hier im Board befolgt. Deshalb im Anhang die Inhalte der Dateien DDS.txt und Attach.txt. Außerdem hat mein Standard-Virenprogramm noch einige Sachen gefunden. Allerdings sind die Funde erst heute Vormittag aufgetaucht, also nach dem Problem mit dem Spiel.

Ich habe im Übrigen Windows 7 (64-bit), falls das was zur Sache tut.

Microsoft Security Essentials
Code:
Trojan:Win32/Biloky.A
Kategorie: Trojaner

Beschreibung: Dieses Programm ist gefährlich. Es führt Befehle eines Angreifers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
containerfile:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\38da1d1e-1416bb68
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\38da1d1e-1416bb68->(UPX)

Exploit:Java/Blacole.ES
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
containerfile:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\7e292fbd-4f8fff93
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\7e292fbd-4f8fff93->Dot.class

TrojanDownloader:Win32/Cbeplay.P
Kategorie: Downloadtrojaner

Beschreibung: Dieses Programm ist gefährlich. Es lädt andere Programme herunter.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52\64e8a074-3ab63e7b

Exploit:Java/CVE-2011-3544.gen!E .P
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37\2b6462a5-1918f025
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53\43c9a235-4656c21d

Exploit:Java/Blacole.ET 544.gen!E
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
containerfile:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\4505e417-7b0567c8
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\4505e417-7b0567c8->a/a.class

Exploit:Java/CVE-2012-0507.F
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
containerfile:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\4505e417-7b0567c8
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\4505e417-7b0567c8->a/Ner.class

TrojanDownloader:Java/Rexec.I
Kategorie: Downloadtrojaner

Beschreibung: Dieses Programm ist gefährlich. Es lädt andere Programme herunter.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\Local\Temp\Main.class

Exploit:Java/CVE-2012-0507.D!ldr
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
containerfile:C:\Users\***\AppData\Local\Temp\jar_cache2119994641622208803.tmp
file:C:\Users\***\AppData\Local\Temp\jar_cache2119994641622208803.tmp->wtgrpdpjpmmdtkrvpy/bugdpywrnpsajj.class

PWS:Win32/Banker.O 0507.D!ldr
Kategorie: Kennwortstehlprogramm

Beschreibung: Dieses Programm ist gefährlich. Es zeichnet Benutzerkennwörter auf.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\Roaming\appconf32.exe

Exploit:Java/Blacole.FN
Von Security Essentials wurde folgender Fehler erkannt: Fehlercode: 0x80508023. Auf dem Computer wurde keine Schadsoftware oder andere potenziell unerwünschte Software gefunden.

Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\2e46ec92-1529f3fc-temp->ta/er.class
file:C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18\2e46ec92-6c7171d5-temp->ta/er.class
file:C:\Users\***\AppData\Local\Temp\jar_cache738795103008500899.tmp->ta/er.class
file:C:\Users\***\AppData\Local\Temp\jar_cache931162373304490553.tmp->ta/er.class

Exploit:JS/Blacole.DG
Kategorie: Exploit

Beschreibung: Dieses Programm ist gefährlich. Es nutzt die Sicherheitslücken eines Computers aus.

Empfohlene Aktion: Entfernen Sie diese Software unverzüglich.

Elemente:
file:C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Cache\f_008116
Malwarebytes
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.20.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** [Administrator]

Schutz: Deaktiviert

21.05.2012 10:00:15
mbam-log-2012-05-21 (10-00-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 763102
Laufzeit: 2 Stunde(n), 18 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (userinit.exeC:\Users\***\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files (x86)\Fritz!Box Reconnect\bat\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Fritz!Box Reconnect\exe\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Downloads\SoftonicDownloader_fuer_sweet-home-3d.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
OTL.txt
Code:
OTL logfile created on: 21.05.2012 09:40:29 - Run 1
OTL by OldTimer - Version 3.2.43.1    Folder = D:\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 5,81 Gb Available Physical Memory | 72,83% Memory free
15,96 Gb Paging File | 13,44 Gb Available in Paging File | 84,20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 14,15 Gb Free Space | 9,66% Space Free | Partition Type: NTFS
Drive D: | 785,03 Gb Total Space | 370,79 Gb Free Space | 47,23% Space Free | Partition Type: NTFS
 
Computer Name: LEOMUCK-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\Downloads\OTL.exe (OldTimer Tools)
PRC - c:\program files (x86)\trillian\plugins\skypekit.exe ()
PRC - C:\Program Files (x86)\Trillian\trillian.exe (Cerulean Studios)
PRC - C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\ProgramData\DatacardService\DCService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Windows\SysWOW64\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe ()
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\pdf.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\libglesv2.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\libegl.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\avutil-51.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\avformat-54.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\avcodec-54.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\gcswf32.dll ()
MOD - C:\Users\***\AppData\Local\Google\Chrome\APPLIC~1\190108~1.46\gcswf32.dll ()
MOD - c:\program files (x86)\trillian\plugins\skypekit.exe ()
MOD - C:\Program Files (x86)\Trillian\libspeex.dll ()
MOD - C:\Program Files (x86)\Trillian\libpng15.dll ()
MOD - C:\Program Files (x86)\Trillian\libungif.dll ()
MOD - C:\Program Files (x86)\Trillian\zlib1.dll ()
MOD - C:\Program Files (x86)\Trillian\languages\en\buddy.dll ()
MOD - C:\Program Files (x86)\Trillian\languages\en\talk.dll ()
MOD - c:\program files (x86)\trillian\languages\en\trillian.dll ()
MOD - C:\Program Files (x86)\Trillian\languages\en\events.dll ()
MOD - C:\Program Files (x86)\Trillian\languages\en\toolkit.dll ()
MOD - C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files (x86)\ScanWizard 5\SFRes.dll ()
MOD - C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CTXFIGER.DLL ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll ()
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SXDS10) -- C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe (soft Xpansion)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)
DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)
DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (MotioninJoyXFilter) -- C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (huawei_enumerator) -- C:\Windows\SysNative\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5E 04 A9 0F 1F 22 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.own3d.tv/"
FF - prefs.js..network.proxy.http: "62.75.221.36"
FF - prefs.js..network.proxy.http_port: 5544
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.18 00:51:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.05.01 17:20:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.04.16 10:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions
[2011.08.17 22:22:20 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2012.03.17 15:31:42 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions\foxyproxy@eric.h.jung
[2011.11.11 12:25:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.08 22:46:05 | 000,399,561 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\{53A03D43-5363-4669-8190-99061B2DEBA5}.XPI
[2012.01.06 01:50:19 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.08.25 22:11:14 | 000,550,833 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2012.02.01 14:15:08 | 000,048,898 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.03.18 00:51:54 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.14 01:58:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.14 01:58:02 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.14 01:58:02 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.14 01:58:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.14 01:58:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.14 01:58:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Java Deployment Toolkit 6.0.250.6 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U25 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Google Update (Enabled) = C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_0\
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Adblock Plus (Beta) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Search by Image (by Google) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm\1.1.1_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.3_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.3_0\.orig
CHR - Extension: Reddit Enhancement Suite = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.1.0_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\RunOnce: [InnoSetupRegFile.0000000001] C:\Windows\is-IV6FH.exe ()
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab (Creative Software AutoUpdate Support Package 1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F1EE8F7-4C7F-496C-BCE2-022BF09A0950}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exeC:\Users\***\AppData\Roaming\appconf32.exe) -  File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.19 19:21:56 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\plakate
[2012.05.17 12:06:22 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Adobe
[2012.05.17 12:04:57 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\Windows\IsUn0407.exe
[2012.05.17 12:04:54 | 000,000,000 | ---D | C] -- C:\Windows\_ISTMP1.DIR
[2012.05.17 11:31:10 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner (2)
[2012.05.16 17:46:16 | 000,000,000 | ---D | C] -- D:\Dokumente\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012.05.16 17:11:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.05.16 16:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012.05.16 13:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange
[2012.05.16 13:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software
[2012.05.16 13:35:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B05828CB-5222-4349-A1F2-41DE829FC1F4}
[2012.05.16 13:34:50 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7911F548-8E3D-42AA-9C6D-4F6C26EEC7A4}
[2012.05.15 18:42:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hewlett-Packard
[2012.05.11 20:19:26 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner
[2012.05.11 19:22:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{62EFB906-1777-4178-8168-F4D9A254F530}
[2012.05.09 19:25:02 | 001,544,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2012.05.09 19:24:58 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.05.09 19:24:57 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.05.09 19:24:57 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.05.09 11:54:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.05.09 11:54:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2012.05.09 11:54:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.05.09 11:53:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.05.06 14:13:55 | 000,000,000 | ---D | C] -- D:\Dokumente\Texte
[2012.05.05 16:53:44 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Multivalent
[2012.05.05 16:48:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dev-Cpp
[2012.05.05 16:48:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bloodshed Dev-C++
[2012.05.05 16:35:30 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\pdftk
[2012.05.05 16:34:39 | 000,000,000 | ---D | C] -- C:\Users\***\.Multivalent
[2012.05.05 16:23:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ghostscript
[2012.05.05 16:23:51 | 000,000,000 | ---D | C] -- C:\Program Files\gs
[2012.04.29 12:39:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartFTP Client
[2012.04.29 12:39:12 | 000,000,000 | ---D | C] -- C:\Program Files\SmartFTP Client
[2012.04.29 12:38:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SmartFTP Client 4.0 (x64) Setup Files
[2012.04.28 12:43:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Spoon
[2012.04.28 12:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanWizard 5 für Windows
[2012.04.28 12:26:44 | 000,060,928 | ---- | C] (OnSpec Electronic, Inc.) -- C:\Windows\SysWow64\drivers\Smplscsi.sys
[2012.04.28 12:26:43 | 000,015,396 | ---- | C] (Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd5.dll
[2012.04.28 12:26:43 | 000,013,962 | ---- | C] ( Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd6.dll
[2012.04.28 12:26:43 | 000,012,499 | ---- | C] (Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd7.dll
[2012.04.28 12:26:43 | 000,000,000 | ---D | C] -- C:\Kpcms
[2012.04.28 12:26:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ScanWizard 5
[2012.04.28 12:24:51 | 000,000,000 | ---D | C] -- C:\Medion
[2012.04.27 16:06:04 | 000,000,000 | ---D | C] -- D:\Dokumente\My Digital Editions
[2012.04.27 16:06:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.04.27 09:26:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7406F87C-E70D-44F5-97CF-1754A7190422}
[2012.04.27 09:25:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{0A645F5C-8714-4399-AA5B-9153221D18C6}
[2012.04.23 20:41:58 | 000,000,000 | ---D | C] -- C:\Windows\Hewlett-Packard
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]
[2 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.21 09:40:01 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2921942961-698358322-522096465-1000UA.job
[2012.05.21 09:40:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2921942961-698358322-522096465-1000Core.job
[2012.05.21 09:39:27 | 000,711,240 | ---- | M] () -- C:\Windows\is-IV6FH.exe
[2012.05.21 09:39:27 | 000,012,782 | ---- | M] () -- C:\Windows\is-IV6FH.msg
[2012.05.21 09:39:27 | 000,000,436 | ---- | M] () -- C:\Windows\is-IV6FH.lst
[2012.05.21 09:23:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.05.21 09:00:30 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.21 09:00:30 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.21 08:53:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.21 08:53:12 | 2133,868,543 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.21 02:40:22 | 000,063,172 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.21 02:40:22 | 000,063,172 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.21 02:40:22 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.19 14:00:51 | 001,648,032 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.19 14:00:51 | 000,713,502 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.05.19 14:00:51 | 000,658,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.19 14:00:51 | 000,153,674 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.05.19 14:00:51 | 000,126,170 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.17 14:48:51 | 000,579,407 | ---- | M] () -- C:\Users\***\Desktop\tiere.pdf
[2012.05.17 14:48:39 | 000,016,083 | ---- | M] () -- C:\Users\***\Desktop\tiere.sla
[2012.05.17 14:36:40 | 003,093,545 | ---- | M] () -- C:\Users\***\Desktop\selektion.pdf
[2012.05.17 14:35:56 | 003,701,971 | ---- | M] () -- C:\Users\***\Desktop\zpa.pdf
[2012.05.17 14:35:48 | 000,016,083 | ---- | M] () -- C:\Users\***\Desktop\werbung.sla.autosave
[2012.05.17 14:34:16 | 002,493,799 | ---- | M] () -- C:\Users\***\Desktop\Werbung.pdf
[2012.05.17 14:33:49 | 001,846,955 | ---- | M] () -- C:\Users\***\Desktop\bildung.pdf
[2012.05.17 14:32:41 | 001,862,249 | ---- | M] () -- C:\Users\***\Desktop\bildung24.pdf
[2012.05.17 14:27:14 | 000,273,716 | ---- | M] () -- C:\Users\***\Desktop\flyer11.pdf
[2012.05.17 14:25:48 | 000,017,710 | ---- | M] () -- C:\Users\***\Desktop\bildung.sla.autosave
[2012.05.17 14:19:48 | 000,275,291 | ---- | M] () -- C:\Users\***\Desktop\flyer10.pdf
[2012.05.17 14:14:17 | 000,269,714 | ---- | M] () -- C:\Users\***\Desktop\flyer8.pdf
[2012.05.17 13:30:59 | 000,272,298 | ---- | M] () -- C:\Users\***\Desktop\flyer7.pdf
[2012.05.17 13:25:09 | 001,862,250 | ---- | M] () -- C:\Users\***\Desktop\bildung5.pdf
[2012.05.17 13:22:07 | 001,819,528 | ---- | M] () -- C:\Users\***\Desktop\bildung3.pdf
[2012.05.17 13:19:02 | 001,819,550 | ---- | M] () -- C:\Users\***\Desktop\bildung2.pdf
[2012.05.17 12:45:01 | 000,071,449 | ---- | M] () -- C:\Users\***\Desktop\2012_SR_Wahl_Musterstimmzettel.pdf
[2012.05.17 12:41:56 | 000,270,603 | ---- | M] () -- C:\Users\***\Desktop\flyer5.pdf
[2012.05.17 12:16:23 | 003,039,868 | ---- | M] () -- C:\Users\***\Desktop\Soziale Selektion.pdf
[2012.05.17 12:13:37 | 003,039,904 | ---- | M] () -- C:\Users\***\Desktop\Dokument-3-3.pdf
[2012.05.17 12:06:07 | 000,001,259 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.05.17 12:04:02 | 003,032,458 | ---- | M] () -- C:\Users\***\Desktop\Dokument-3-2.pdf
[2012.05.17 11:45:43 | 003,028,098 | ---- | M] () -- C:\Users\***\Desktop\Dokument-1.pdf
[2012.05.17 11:45:20 | 003,028,100 | ---- | M] () -- C:\Users\***\Desktop\Dokument-2.pdf
[2012.05.17 11:28:48 | 000,008,592 | ---- | M] () -- C:\Users\***\.recently-used.xbel
[2012.05.16 17:32:25 | 000,001,213 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.14 12:35:37 | 000,019,091 | ---- | M] () -- D:\Dokumente\12 Wahlvorschlaege Formular Studenten.pdf
[2012.05.10 08:51:49 | 004,949,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.05 16:25:22 | 000,000,043 | ---- | M] () -- C:\Windows\gswin64.ini
[2012.05.02 00:07:38 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.05.02 00:07:29 | 001,669,618 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.04.28 22:00:27 | 000,216,749 | ---- | M] () -- C:\Users\***\flyer1-Seite001.png
[2012.04.28 22:00:27 | 000,129,521 | ---- | M] () -- C:\Users\***\flyer1-Seite002.png
[2012.04.28 21:53:31 | 000,231,053 | ---- | M] () -- C:\Users\***\Dokument-5.pdf
[2012.04.28 21:49:29 | 000,127,720 | ---- | M] () -- C:\Users\***\Dokument-5-Seite002.png
[2012.04.28 21:49:28 | 000,216,749 | ---- | M] () -- C:\Users\***\Dokument-5-Seite001.png
[2012.04.28 21:43:30 | 000,143,249 | ---- | M] () -- C:\Users\***\Dokument-5-Seite002 - Kopie.png
[2012.04.28 21:43:29 | 000,217,065 | ---- | M] () -- C:\Users\***\Dokument-5-Seite001 - Kopie.png
[2012.04.28 21:34:35 | 000,138,732 | ---- | M] () -- C:\Users\***\Dokument-6-Seite002.png
[2012.04.28 21:34:34 | 000,193,046 | ---- | M] () -- C:\Users\***\Dokument-6-Seite001.png
[2012.04.28 12:47:32 | 000,000,035 | ---- | M] () -- C:\Windows\Ulead32.INI
[2012.04.28 12:26:55 | 000,001,980 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner Finder.lnk
[2012.04.28 12:26:55 | 000,001,948 | ---- | M] () -- C:\Users\Public\Desktop\ScanWizard 5.lnk
[2012.04.27 15:30:43 | 000,003,584 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]
[2 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.21 09:39:27 | 000,711,240 | ---- | C] () -- C:\Windows\is-IV6FH.exe
[2012.05.21 09:39:27 | 000,012,782 | ---- | C] () -- C:\Windows\is-IV6FH.msg
[2012.05.21 09:39:27 | 000,000,436 | ---- | C] () -- C:\Windows\is-IV6FH.lst
[2012.05.17 14:42:09 | 000,579,407 | ---- | C] () -- C:\Users\***\Desktop\tiere.pdf
[2012.05.17 14:42:02 | 000,016,083 | ---- | C] () -- C:\Users\***\Desktop\tiere.sla
[2012.05.17 14:36:40 | 003,093,545 | ---- | C] () -- C:\Users\***\Desktop\selektion.pdf
[2012.05.17 14:35:56 | 003,701,971 | ---- | C] () -- C:\Users\***\Desktop\zpa.pdf
[2012.05.17 14:32:40 | 001,862,249 | ---- | C] () -- C:\Users\***\Desktop\bildung24.pdf
[2012.05.17 14:27:13 | 000,273,716 | ---- | C] () -- C:\Users\***\Desktop\flyer11.pdf
[2012.05.17 14:19:48 | 000,275,291 | ---- | C] () -- C:\Users\***\Desktop\flyer10.pdf
[2012.05.17 14:14:16 | 000,269,714 | ---- | C] () -- C:\Users\***\Desktop\flyer8.pdf
[2012.05.17 13:29:46 | 000,272,298 | ---- | C] () -- C:\Users\***\Desktop\flyer7.pdf
[2012.05.17 13:22:19 | 001,862,250 | ---- | C] () -- C:\Users\***\Desktop\bildung5.pdf
[2012.05.17 13:19:31 | 001,819,528 | ---- | C] () -- C:\Users\***\Desktop\bildung3.pdf
[2012.05.17 13:19:02 | 001,819,550 | ---- | C] () -- C:\Users\***\Desktop\bildung2.pdf
[2012.05.17 13:15:48 | 000,017,710 | ---- | C] () -- C:\Users\***\Desktop\bildung.sla.autosave
[2012.05.17 13:12:20 | 001,846,955 | ---- | C] () -- C:\Users\***\Desktop\bildung.pdf
[2012.05.17 12:44:50 | 000,071,449 | ---- | C] () -- C:\Users\***\Desktop\2012_SR_Wahl_Musterstimmzettel.pdf
[2012.05.17 12:38:18 | 000,270,603 | ---- | C] () -- C:\Users\***\Desktop\flyer5.pdf
[2012.05.17 12:25:48 | 000,016,083 | ---- | C] () -- C:\Users\***\Desktop\werbung.sla.autosave
[2012.05.17 12:20:18 | 002,493,799 | ---- | C] () -- C:\Users\***\Desktop\Werbung.pdf
[2012.05.17 12:11:27 | 003,039,904 | ---- | C] () -- C:\Users\***\Desktop\Dokument-3-3.pdf
[2012.05.17 12:06:07 | 000,001,259 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.05.17 12:00:42 | 003,032,458 | ---- | C] () -- C:\Users\***\Desktop\Dokument-3-2.pdf
[2012.05.17 12:00:19 | 003,039,868 | ---- | C] () -- C:\Users\***\Desktop\Soziale Selektion.pdf
[2012.05.17 11:45:42 | 003,028,098 | ---- | C] () -- C:\Users\***\Desktop\Dokument-1.pdf
[2012.05.17 11:45:20 | 003,028,100 | ---- | C] () -- C:\Users\***\Desktop\Dokument-2.pdf
[2012.05.17 11:28:48 | 000,008,592 | ---- | C] () -- C:\Users\***\.recently-used.xbel
[2012.05.16 17:13:40 | 000,001,213 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.14 12:35:40 | 000,019,091 | ---- | C] () -- D:\Dokumente\12 Wahlvorschlaege Formular Studenten.pdf
[2012.05.05 16:25:06 | 000,000,043 | ---- | C] () -- C:\Windows\gswin64.ini
[2012.04.28 21:56:13 | 000,129,521 | ---- | C] () -- C:\Users\***\flyer1-Seite002.png
[2012.04.28 21:56:12 | 000,216,749 | ---- | C] () -- C:\Users\***\flyer1-Seite001.png
[2012.04.28 21:49:43 | 000,231,053 | ---- | C] () -- C:\Users\***\Dokument-5.pdf
[2012.04.28 21:44:42 | 000,217,065 | ---- | C] () -- C:\Users\***\Dokument-5-Seite001 - Kopie.png
[2012.04.28 21:44:42 | 000,143,249 | ---- | C] () -- C:\Users\***\Dokument-5-Seite002 - Kopie.png
[2012.04.28 21:20:26 | 000,193,046 | ---- | C] () -- C:\Users\***\Dokument-6-Seite001.png
[2012.04.28 21:20:26 | 000,138,732 | ---- | C] () -- C:\Users\***\Dokument-6-Seite002.png
[2012.04.28 21:12:04 | 000,127,720 | ---- | C] () -- C:\Users\***\Dokument-5-Seite002.png
[2012.04.28 20:53:32 | 000,216,749 | ---- | C] () -- C:\Users\***\Dokument-5-Seite001.png
[2012.04.28 12:29:52 | 000,000,035 | ---- | C] () -- C:\Windows\Ulead32.INI
[2012.04.28 12:26:55 | 000,001,980 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner Finder.lnk
[2012.04.28 12:26:55 | 000,001,948 | ---- | C] () -- C:\Users\Public\Desktop\ScanWizard 5.lnk
[2012.04.28 12:26:44 | 000,285,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsio.sys
[2012.04.28 12:26:44 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsreged.sys
[2012.04.27 16:06:01 | 000,002,196 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions.lnk
[2012.04.27 15:30:43 | 000,003,584 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.16 12:26:49 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.03.19 17:15:07 | 000,000,016 | ---- | C] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.12.19 01:40:55 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2011.11.04 23:35:31 | 000,000,575 | ---- | C] () -- C:\Windows\Lidos6.ini
[2011.10.27 23:26:15 | 000,012,331 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-Jardinains!.dat
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.24 09:53:45 | 000,013,030 | ---- | C] () -- C:\Users\***\AppData\Roaming\PDOXUSRS.NET
[2011.08.18 07:55:21 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2011.07.26 15:30:42 | 000,007,598 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.07.19 10:33:55 | 001,256,448 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.07.19 10:33:55 | 000,200,192 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.07.11 18:11:15 | 000,282,864 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.07.11 18:11:14 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.07.11 18:11:14 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.30 16:36:06 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2011.05.26 10:58:41 | 000,122,700 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.05.04 19:12:47 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.05.04 19:12:47 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.05.04 19:12:28 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.05.01 17:20:51 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.05.01 14:21:16 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.05.01 13:52:50 | 001,669,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.01 13:00:24 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

< End of report >
DDS.txt
DDS Logfile:
DDS Logfile:
DDS Logfile:
DDS Logfile:
Code:
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by *** at 12:24:08 on 2012-05-21
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8175.6293 [GMT 2:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\SysWOW64\svchost.exe -k Akamai
C:\ProgramData\DatacardService\DCService.exe
C:\Windows\SysWOW64\NLSSRV32.EXE
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Windows\SysWOW64\Ctxfihlp.exe
C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\SysWOW64\CTXFISPI.EXE
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\ProgramData\DatacardService\DCSHelper.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\DllHost.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\system32\sppsvc.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\***\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\msfeedssync.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = <local>
mWinlogon: Userinit=userinit.exe,
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
mRun: [CTxfiHlp] CTXFIHLP.EXE
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ADOBEG~1.LNK - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SCANNE~1.LNK - C:\Program Files (x86)\ScanWizard 5\ScannerFinder.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{0F1EE8F7-4C7F-496C-BCE2-022BF09A0950} : DhcpNameServer = 192.168.178.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
mRun-x64: [CTxfiHlp] CTXFIHLP.EXE
mRun-x64: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun-x64: [(Standard)]
mRun-x64: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun-x64: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\4oupg7jb.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.own3d.tv/
FF - prefs.js: network.proxy.http - 62.75.221.36
FF - prefs.js: network.proxy.http_port - 5544
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll
FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
FF - plugin: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
FF - plugin: C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\system32\DRIVERS\dtsoftbus01.sys --> C:\Windows\system32\DRIVERS\dtsoftbus01.sys [?]
R2 Akamai;Akamai NetSession Interface;C:\Windows\System32\svchost.exe -k Akamai [2009-7-14 20992]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]
R2 DCService.exe;DCService.exe;C:\ProgramData\DatacardService\DCService.exe [2010-5-8 229376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-5-21 654408]
R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2012-3-22 69640]
R2 vpnagent;Cisco AnyConnect Secure Mobility Agent;C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe [2012-1-13 476112]
R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]
R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]
R3 CT20XUT.SYS;CT20XUT.SYS;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
R3 CTHWIUT.SYS;CTHWIUT.SYS;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\system32\Drivers\EtronHub3.sys --> C:\Windows\system32\Drivers\EtronHub3.sys [?]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\system32\Drivers\EtronXHCI.sys --> C:\Windows\system32\Drivers\EtronXHCI.sys [?]
R3 huawei_enumerator;huawei_enumerator;C:\Windows\system32\DRIVERS\ew_jubusenum.sys --> C:\Windows\system32\DRIVERS\ew_jubusenum.sys [?]
R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-2-29 158856]
S3 acsock;acsock;C:\Windows\system32\DRIVERS\acsock64.sys --> C:\Windows\system32\DRIVERS\acsock64.sys [?]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-9 253088]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2011-5-4 79360]
S3 CT20XUT;CT20XUT;C:\Windows\system32\drivers\CT20XUT.SYS --> C:\Windows\system32\drivers\CT20XUT.SYS [?]
S3 CTEXFIFX;CTEXFIFX;C:\Windows\system32\drivers\CTEXFIFX.SYS --> C:\Windows\system32\drivers\CTEXFIFX.SYS [?]
S3 CTHWIUT;CTHWIUT;C:\Windows\system32\drivers\CTHWIUT.SYS --> C:\Windows\system32\drivers\CTHWIUT.SYS [?]
S3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;C:\Windows\system32\DRIVERS\MijXfilt.sys --> C:\Windows\system32\DRIVERS\MijXfilt.sys [?]
S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]
S3 NisSrv;Microsoft-Netzwerkinspektion;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 SXDS10;soft Xpansion Dispatch Service;C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe [2011-12-9 229520]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
.
=============== Created Last 30 ================
.
2012-05-20 09:17:12        8955792        ----a-w-        C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D56736AE-AE2A-4BE5-9E6A-020EE6A749C8}\mpengine.dll
2012-05-18 10:52:53        8955792        ----a-w-        C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-05-17 10:06:22        --------        d-----w-        C:\Windows\SysWow64\Adobe
2012-05-17 10:04:57        328704        ----a-w-        C:\Windows\IsUn0407.exe
2012-05-17 10:04:54        --------        d-----w-        C:\Windows\_ISTMP1.DIR
2012-05-16 15:13:40        --------        d-----w-        C:\ProgramData\Blizzard Entertainment
2012-05-16 15:13:40        --------        d-----w-        C:\Program Files (x86)\Diablo III
2012-05-16 15:11:03        --------        d-----w-        C:\ProgramData\Battle.net
2012-05-16 14:09:51        --------        d-----w-        C:\Program Files (x86)\Common Files\Blizzard Entertainment
2012-05-16 11:42:43        --------        d-----w-        C:\Program Files\Tracker Software
2012-05-16 11:35:03        --------        d-----w-        C:\Users\***\AppData\Local\{B05828CB-5222-4349-A1F2-41DE829FC1F4}
2012-05-16 11:34:50        --------        d-----w-        C:\Users\***\AppData\Local\{7911F548-8E3D-42AA-9C6D-4F6C26EEC7A4}
2012-05-11 17:22:08        --------        d-----w-        C:\Users\***\AppData\Local\{62EFB906-1777-4178-8168-F4D9A254F530}
2012-05-09 17:25:02        1544704        ----a-w-        C:\Windows\System32\DWrite.dll
2012-05-09 17:25:02        1077248        ----a-w-        C:\Windows\SysWow64\DWrite.dll
2012-05-09 17:24:58        5559664        ----a-w-        C:\Windows\System32\ntoskrnl.exe
2012-05-09 17:24:58        3146240        ----a-w-        C:\Windows\System32\win32k.sys
2012-05-09 17:24:57        3968368        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe
2012-05-09 17:24:57        3913072        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe
2012-05-09 17:24:21        75120        ----a-w-        C:\Windows\System32\drivers\partmgr.sys
2012-05-09 17:24:10        1918320        ----a-w-        C:\Windows\System32\drivers\tcpip.sys
2012-05-09 17:24:09        936960        ----a-w-        C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 17:24:09        1732096        ----a-w-        C:\Program Files\Windows Journal\NBDoc.DLL
2012-05-09 17:24:09        1402880        ----a-w-        C:\Program Files\Windows Journal\JNWDRV.dll
2012-05-09 17:24:09        1393664        ----a-w-        C:\Program Files\Windows Journal\JNTFiltr.dll
2012-05-09 17:24:09        1367552        ----a-w-        C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-09 09:54:30        --------        d-----w-        C:\Program Files (x86)\AMD AVT
2012-05-09 09:54:20        --------        d-----w-        C:\Program Files (x86)\AMD APP
2012-05-05 14:48:36        --------        d-----w-        C:\Users\***\AppData\Roaming\Dev-Cpp
2012-05-05 14:34:39        --------        d-----w-        C:\Users\***\.Multivalent
2012-05-05 14:23:51        --------        d-----w-        C:\Program Files\gs
2012-04-29 10:39:12        --------        d-----w-        C:\Program Files\SmartFTP Client
2012-04-29 10:38:56        --------        d-----w-        C:\Program Files (x86)\SmartFTP Client 4.0 (x64) Setup Files
2012-04-28 10:43:12        --------        d-----w-        C:\Users\***\AppData\Local\Spoon
2012-04-28 10:26:44        7680        ----a-w-        C:\Windows\SysWow64\drivers\Onsreged.sys
2012-04-28 10:26:44        60928        ----a-w-        C:\Windows\SysWow64\drivers\Smplscsi.sys
2012-04-28 10:26:44        285216        ----a-w-        C:\Windows\SysWow64\drivers\Onsio.sys
2012-04-28 10:26:43        15396        ----a-w-        C:\Windows\SysWow64\Msmusd5.dll
2012-04-28 10:26:43        13962        ----a-w-        C:\Windows\SysWow64\Msmusd6.dll
2012-04-28 10:26:43        12499        ----a-w-        C:\Windows\SysWow64\Msmusd7.dll
2012-04-28 10:26:43        --------        d-----w-        C:\Kpcms
2012-04-28 10:26:37        --------        d-----w-        C:\Program Files (x86)\ScanWizard 5
2012-04-28 10:26:31        77824        ----a-w-        C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ctor.dll
2012-04-28 10:26:31        32768        ----a-w-        C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\objectps.dll
2012-04-28 10:26:31        225280        ----a-w-        C:\Program Files (x86)\Common Files\InstallShield\IScript\IScript.dll
2012-04-28 10:26:31        176128        ----a-w-        C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\iuser.dll
2012-04-28 10:25:17        212992        ----a-w-        C:\Program Files (x86)\Common Files\InstallShield\engine\6\Intel 32\ILog.dll
2012-04-28 10:24:51        --------        d-----w-        C:\Medion
2012-04-27 07:26:31        --------        d-----w-        C:\Users\***\AppData\Local\{7406F87C-E70D-44F5-97CF-1754A7190422}
2012-04-27 07:25:44        --------        d-----w-        C:\Users\***\AppData\Local\{0A645F5C-8714-4399-AA5B-9153221D18C6}
2012-04-23 18:41:58        --------        d-----w-        C:\Windows\Hewlett-Packard
.
==================== Find3M  ====================
.
2012-04-16 07:18:18        418464        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe
2012-04-16 07:18:17        70304        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-04-08 23:07:29        264        ----a-w-        C:\Users\***\AppData\Roaming\srvblck5.tmp
2012-04-06 05:22:40        11174400        ----a-w-        C:\Windows\System32\drivers\atikmdag.sys
2012-04-06 02:22:00        159744        ----a-w-        C:\Windows\System32\atiapfxx.exe
2012-04-06 02:21:52        909312        ----a-w-        C:\Windows\SysWow64\aticfx32.dll
2012-04-06 02:20:04        1067520        ----a-w-        C:\Windows\System32\aticfx64.dll
2012-04-06 02:16:52        442368        ----a-w-        C:\Windows\System32\ATIDEMGX.dll
2012-04-06 02:16:46        503808        ----a-w-        C:\Windows\System32\atieclxx.exe
2012-04-06 02:16:02        236544        ----a-w-        C:\Windows\System32\atiesrxx.exe
2012-04-06 02:14:44        120320        ----a-w-        C:\Windows\System32\atitmm64.dll
2012-04-06 02:14:30        21504        ----a-w-        C:\Windows\System32\atimuixx.dll
2012-04-06 02:14:26        59392        ----a-w-        C:\Windows\System32\atiedu64.dll
2012-04-06 02:14:20        43520        ----a-w-        C:\Windows\SysWow64\ati2edxx.dll
2012-04-06 02:13:42        6800896        ----a-w-        C:\Windows\SysWow64\atidxx32.dll
2012-04-06 02:10:50        26181632        ----a-w-        C:\Windows\System32\atio6axx.dll
2012-04-06 02:00:10        64000        ----a-w-        C:\Windows\System32\coinst.dll
2012-04-06 01:54:46        7479296        ----a-w-        C:\Windows\System32\atidxx64.dll
2012-04-06 01:50:56        19753984        ----a-w-        C:\Windows\SysWow64\atioglxx.dll
2012-04-06 01:35:24        1120768        ----a-w-        C:\Windows\System32\atiumd6v.dll
2012-04-06 01:34:50        1831424        ----a-w-        C:\Windows\SysWow64\atiumdmv.dll
2012-04-06 01:34:34        4731904        ----a-w-        C:\Windows\System32\atiumd6a.dll
2012-04-06 01:34:04        6203392        ----a-w-        C:\Windows\SysWow64\atiumdag.dll
2012-04-06 01:30:16        51200        ----a-w-        C:\Windows\System32\aticalrt64.dll
2012-04-06 01:30:14        46080        ----a-w-        C:\Windows\SysWow64\aticalrt.dll
2012-04-06 01:30:08        44544        ----a-w-        C:\Windows\System32\aticalcl64.dll
2012-04-06 01:30:06        44032        ----a-w-        C:\Windows\SysWow64\aticalcl.dll
2012-04-06 01:29:54        16090624        ----a-w-        C:\Windows\System32\aticaldd64.dll
2012-04-06 01:25:30        13764096        ----a-w-        C:\Windows\SysWow64\aticaldd.dll
2012-04-06 01:23:24        7431680        ----a-w-        C:\Windows\System32\atiumd64.dll
2012-04-06 01:22:54        4795904        ----a-w-        C:\Windows\SysWow64\atiumdva.dll
2012-04-06 01:11:28        514560        ----a-w-        C:\Windows\System32\atiadlxx.dll
2012-04-06 01:11:20        360448        ----a-w-        C:\Windows\SysWow64\atiadlxy.dll
2012-04-06 01:11:06        17408        ----a-w-        C:\Windows\System32\atig6pxx.dll
2012-04-06 01:11:04        14848        ----a-w-        C:\Windows\SysWow64\atiglpxx.dll
2012-04-06 01:11:04        14848        ----a-w-        C:\Windows\System32\atiglpxx.dll
2012-04-06 01:11:00        41984        ----a-w-        C:\Windows\System32\atig6txx.dll
2012-04-06 01:10:52        33280        ----a-w-        C:\Windows\SysWow64\atigktxx.dll
2012-04-06 01:10:44        343040        ----a-w-        C:\Windows\System32\drivers\atikmpag.sys
2012-04-06 01:09:56        54784        ----a-w-        C:\Windows\System32\atiuxp64.dll
2012-04-06 01:09:48        41984        ----a-w-        C:\Windows\SysWow64\atiuxpag.dll
2012-04-06 01:09:42        44544        ----a-w-        C:\Windows\System32\atiu9p64.dll
2012-04-06 01:09:34        32256        ----a-w-        C:\Windows\SysWow64\atiu9pag.dll
2012-04-06 01:09:02        53248        ----a-w-        C:\Windows\System32\drivers\ati2erec.dll
2012-04-06 01:06:08        54784        ----a-w-        C:\Windows\System32\atimpc64.dll
2012-04-06 01:06:08        54784        ----a-w-        C:\Windows\System32\amdpcom64.dll
2012-04-06 01:06:04        53760        ----a-w-        C:\Windows\SysWow64\atimpc32.dll
2012-04-06 01:06:04        53760        ----a-w-        C:\Windows\SysWow64\amdpcom32.dll
2012-04-05 20:34:26        187392        ----a-w-        C:\Windows\System32\clinfo.exe
2012-04-05 20:34:10        74752        ----a-w-        C:\Windows\System32\OpenVideo64.dll
2012-04-05 20:34:04        64512        ----a-w-        C:\Windows\SysWow64\OpenVideo.dll
2012-04-05 20:33:56        63488        ----a-w-        C:\Windows\System32\OVDecode64.dll
2012-04-05 20:33:52        56320        ----a-w-        C:\Windows\SysWow64\OVDecode.dll
2012-04-05 20:33:44        16457216        ----a-w-        C:\Windows\System32\amdocl64.dll
2012-04-05 20:32:56        13007872        ----a-w-        C:\Windows\SysWow64\amdocl.dll
2012-04-04 13:56:40        24904        ----a-w-        C:\Windows\System32\drivers\mbam.sys
2012-03-22 20:44:38        69640        ----a-w-        C:\Windows\SysWow64\NLSSRV32.EXE
2012-03-22 20:44:02        17928        ----a-w-        C:\Windows\System32\nitrolocalui2.dll
2012-03-20 18:44:12        98688        ----a-w-        C:\Windows\System32\drivers\NisDrvWFP.sys
2012-03-20 18:44:12        203888        ----a-w-        C:\Windows\System32\drivers\MpFilter.sys
2012-03-19 15:15:06        136        ----a-w-        C:\Users\***\AppData\Roaming\srvblck2.tmp
2012-03-09 12:07:04        29184        ----a-w-        C:\Windows\System32\kdbsdk64.dll
2012-03-09 12:06:14        24576        ----a-w-        C:\Windows\SysWow64\kdbsdk32.dll
2012-03-01 06:46:16        23408        ----a-w-        C:\Windows\System32\drivers\fs_rec.sys
2012-03-01 06:38:27        220672        ----a-w-        C:\Windows\System32\wintrust.dll
2012-03-01 06:33:50        81408        ----a-w-        C:\Windows\System32\imagehlp.dll
2012-03-01 06:28:47        5120        ----a-w-        C:\Windows\System32\wmi.dll
2012-03-01 05:37:41        172544        ----a-w-        C:\Windows\SysWow64\wintrust.dll
2012-03-01 05:33:23        159232        ----a-w-        C:\Windows\SysWow64\imagehlp.dll
2012-03-01 05:29:16        5120        ----a-w-        C:\Windows\SysWow64\wmi.dll
2012-02-28 06:56:48        2311168        ----a-w-        C:\Windows\System32\jscript9.dll
2012-02-28 06:49:56        1390080        ----a-w-        C:\Windows\System32\wininet.dll
2012-02-28 06:48:57        1493504        ----a-w-        C:\Windows\System32\inetcpl.cpl
2012-02-28 06:42:55        2382848        ----a-w-        C:\Windows\System32\mshtml.tlb
2012-02-28 01:18:55        1799168        ----a-w-        C:\Windows\SysWow64\jscript9.dll
2012-02-28 01:11:21        1427456        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl
2012-02-28 01:11:07        1127424        ----a-w-        C:\Windows\SysWow64\wininet.dll
2012-02-28 01:03:16        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb
2012-02-24 17:49:45        76888        ----a-w-        C:\Windows\SysWow64\PnkBstrA.exe
2012-02-24 17:49:36        282864        ----a-w-        C:\Windows\SysWow64\PnkBstrB.xtr
2012-02-24 17:49:36        282864        ----a-w-        C:\Windows\SysWow64\PnkBstrB.exe
2012-02-24 17:45:31        280904        ----a-w-        C:\Windows\SysWow64\PnkBstrB.ex0
2012-02-23 12:32:04        95760        ----a-w-        C:\Windows\System32\drivers\AtihdW76.sys
.
============= FINISH: 12:27:34,61 ===============
--- --- ---

--- --- ---

--- --- ---

--- --- ---
--- --- ---
--- --- ---
[/CODE]


Attach.txt
Code:
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 01.05.2011 12:56:44
System Uptime: 21.05.2012 12:20:44 (0 hours ago)
.
Motherboard: ASRock |  | P67 Pro3
Processor: Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz | CPUSocket | 1584/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 146 GiB total, 13,901 GiB free.
D: is FIXED (NTFS) - 785 GiB total, 370,791 GiB free.
E: is CDROM ()
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
PNP Device ID: ROOT\NET\0000
Service: vpnva
.
==== System Restore Points ===================
.
RP233: 20.05.2012 11:16:48 - Windows Update
.
==== Installed Programs ======================
.
3DMark 11
Adobe AIR
Adobe Community Help
Adobe Content Viewer
Adobe Digital Editions
Adobe Download Assistant
Adobe Flash Player 10 ActiveX
Adobe SVG Viewer
Adobe Widget Browser
Akamai NetSession Interface
Akamai NetSession Interface Service
AMX Mod X Installer 1.8.1
Apple Application Support
Apple Software Update
Assassin's Creed Revelations
Audiosurf
Bandisoft MPEG-1 Decoder
Battlefield 3™
Battlelog Web Plugins
BILDmobil
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Cisco AnyConnect Secure Mobility Client
Cisco AnyConnect Secure Mobility Client
Counter-Strike
Creative Audio-Systemsteuerung
Creative Software AutoUpdate
Creative Sound Blaster Properties x64 Edition
D3DX10
DAEMON Tools Lite
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Diablo III
Digitale Bibliothek 4
Dota 2
Dropbox
Dungeon Defenders
ESN Sonar
Etron USB3.0 Host Controller
FileZilla Client 3.5.3
FLAC 1.2.1b (remove only)
foobar2000 v1.1.1
Free PDF to Word Doc Converter v1.1
Free YouTube to MP3 Converter version 3.9.40.602
FreeMind
German Truck Simulator 1.00
GIMP 2.6.11
Google Chrome
Grand Theft Auto San Andreas
Graph 4.3
GSiteCrawler
GTS ModManager v1.0 Beta 2
Heroes of Newerth
Hewlett-Packard ACLM.NET v1.1.0.0
HLSW v1.4.0.2
HP FWUpdateEDO2
HP Officejet Pro 8100 Hilfe
HP Product Detection
HP Update
IrfanView (remove only)
Jardinains!
Java Auto Updater
Java(TM) 6 Update 25
JDownloader 0.9
Joe
Junk Mail filter update
League of Legends
LIDOS 6
LingoPad 2.6 (Build 360)
LOLReplay
Magicka
Malwarebytes Anti-Malware Version 1.61.0.1400
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Excel MUI (German) 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Standard 2010
Microsoft Office Word MUI (German) 2010
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
Microsoft XNA Framework Redistributable 3.1
Microsoft XNA Framework Redistributable 4.0
Microsoft_VC80_ATL_x86
Microsoft_VC80_CRT_x86
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFCLOC_x86
Microsoft_VC90_ATL_x86
Microsoft_VC90_CRT_x86
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFCLOC_x86
Miro Video Converter
Mozilla Firefox 11.0 (x86 de)
Mp3tag v2.49b
MSVCRT
MSVCRT_amd64
Mumble 1.2.3
Nettalk 6.7
Nexon Game Manager
Notepad++
NVIDIA PhysX
OpenAL
Opera 11.64
Orcs Must Die!
Origin
Pando Media Booster
phase-6 2.1.2.4a
PokerStars
PunkBuster Services
Railworks 3 Train Simulator 2012 Deluxe
Rainlendar2 (remove only)
Real Alternative 2.0.2
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
RStudio
ScanWizard 5
Scribus 1.4.0
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft Excel 2010 (KB2597166) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2598039) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Skype™ 5.8
SmartFTP Client Setup Files 4.0 (x64) (remove only)
SopCast 3.4.8
Steam
TeamSpeak 3 Client
The Elder Scrolls V: Skyrim
TIPP10 Version 2.1.0
Trillian
Ubisoft Game Launcher
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
VLC media player 2.0.0
Windows Live Communications Platform
Windows Live Essentials
Windows Live Installer
Windows Live Mail
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinHTTrack Website Copier 3.44-5
X-Lite 4
.
==== End Of File ===========================
P.S. Sorry, wenn ich was vergessen hab. Ich bin gerade etwas aufgeregt..

Übrigens sind seit dem Durchführen der Scans viele Ordner nicht mehr zugänglich, z.B. C:/Programme (Zugriff verweigert).


Liebe Grüße,
Leander

cosinus 21.05.2012 14:33
Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

Leomuck 21.05.2012 15:33
Huhu,

danke für die Antwort!

Das sind alle Logs, die ich gefunden habe. Bin aber gerade nicht zu Hause, kann es also nicht 100% garantieren. Ich kann mich aber auch nicht dran erinnern, öfters gescannt zu haben. Nur die zwei Mal, wo ich auch Probleme hatte mit Viren.

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5406

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.12.2010 11:08:40
mbam-log-2010-12-28 (11-08-40).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 156975
Laufzeit: 2 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\Leomuck\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
       









Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5415

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

29.12.2010 12:59:39
mbam-log-2010-12-29 (12-59-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 501264
Laufzeit: 1 Stunde(n), 19 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
       







Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5422

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30.12.2010 15:28:04
mbam-log-2010-12-30 (15-28-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 512683
Laufzeit: 1 Stunde(n), 29 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
       







Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5777

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

17.02.2011 00:45:52
mbam-log-2011-02-17 (00-45-52).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 504214
Laufzeit: 1 Stunde(n), 15 Minute(n), 54 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Ich hab irgendwie richtig Bedenken, den PC überhaupt zu benutzen..wegen Keylogger und so?

Vielen Dank für die Hilfe!


Liebe Grüße,
Leo

cosinus 21.05.2012 15:37
Führ bitte auch ESET aus, danach sehen wir weiter:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Leomuck 21.05.2012 16:24
Hallo!

Anbei der Log:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=67f827827d5dd94392194f3a30ca4580
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-05-21 03:00:06
# local_time=2012-05-21 05:00:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776574 100 94 32810336 89229152 0 0
# compatibility_mode=8192 67108863 100 0 112 112 0 0
# scanned=574999
# found=10
# cleaned=0
# scan_time=13104
C:\Users\***\AppData\Local\Microsoft\Windows Live Mail\Googlemail  3e9\[Google Mail]\Spam\1CBB33E9-00006738.eml        HTML/Pharmacy.A trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Microsoft\Windows Live Mail\Googlemail  3e9\[Google Mail]\Spam\23832657-000066D2.eml        HTML/Pharmacy.A trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Microsoft\Windows Live Mail\Googlemail  3e9\[Google Mail]\Spam\7DC41E67-00006647.eml        HTML/Pharmacy.A trojan (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Temp\ICReinstall\cnet_xampplite-win32-1_7_3_exe.exe        a variant of Win32/InstallCore.D application (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\Local\Temp\is1598539481\MyBabylonTB.exe        Win32/Toolbar.Babylon application (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\41570ebd-37c20525        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\7e292fbd-4f8fff93        multiple threats (unable to clean)        00000000000000000000000000000000        I
C:\Users\***\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9\f3a4849-5303abb2        probably a variant of Java/Exploit.CVE-2011-3544.BH trojan (unable to clean)        00000000000000000000000000000000        I
D:\Downloads\cnet_office-convert-pdf-to-jpg-jpeg-tiff-free_exe.exe        a variant of Win32/InstallCore.D application (unable to clean)        00000000000000000000000000000000        I
D:\Downloads\cnet_xampplite-win32-1_7_3_exe.exe        a variant of Win32/InstallCore.D application (unable to clean)        00000000000000000000000000000000        I

Liebe Grüße und vielen Dank,
Leo

cosinus 21.05.2012 18:27
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

Leomuck 21.05.2012 18:38
Huhu,

danke für die Antwort!

Also ich benutz den PC wie immer. Soweit keine Auffälligkeiten, zumindest keine, die ich bei normalem Gebrauch bemerken würde. Ich hab jetzt keine Spiele mehr gespielt oder dergleichen, weil ich etwas Angst um meine Passwörter hab.Aber ansonsten kann ich eigentlich nicht meckern. Fühlt sich alles ganz normal an. Laut Task-Manager ist auch die Prozessorauslastung minimal. Ich habe keine komischen Erscheinungen auf meinem PC, nichts hängt oder sonst irgendwas. Wie immer eigentlich.

Im Startmenü (das ich eigentlich nie benutze, deshalb auch nicht genau "kenne") kommt mir auch alles normal vor. Ich hab jetzt keine detaillierte Auflistung über alle Programme, die da sein müssten, aber ich bin die Liste einfach mal durchgegangen und das kam mir komplett normal vor.

Das Einzige, was mir aufgefallen ist: wenn ich im Explorer C:/ anwähle, wird mir Programme, Programme (x86) und noch mal Programme angezeigt. Letztes kann ich nicht öffnen, da wird der Zugriff verweigert. Das scheint mir aber erst so, seitdem ich die Schritte aus der Anleitung hier im Forum befolgt habe. Ich hab auch auf dem Desktop plötzlich ein paar Dateien, die halb durchsichtig sind.

Im Übrigen habe ich zwischenzeitig noch mal Malwarebytes laufen lassen (weil ich nichts zu tun hatte). Außerdem muss ich mich korrigieren, einer der oben geposteten Malwarebytes-Logs war gar nicht vom dem PC. Hier alle, die mir Malwarebytes anzeigt (sorry für den Fehler!):
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.21.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-PC [Administrator]

Schutz: Deaktiviert

21.05.2012 17:40:54
mbam-log-2012-05-21 (17-40-54).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 763356
Laufzeit: 1 Stunde(n), 51 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)







Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.20.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-PC [Administrator]

Schutz: Deaktiviert

21.05.2012 10:00:15
mbam-log-2012-05-21 (10-00-15).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 763102
Laufzeit: 2 Stunde(n), 18 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Userinit (Hijack.UserInit) -> Bösartig: (userinit.exeC:\Users\***\AppData\Roaming\appconf32.exe,) Gut: (userinit.exe) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
C:\Program Files (x86)\Fritz!Box Reconnect\bat\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Fritz!Box Reconnect\exe\nc.exe (PUP.Netcat) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Downloads\SoftonicDownloader_fuer_sweet-home-3d.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)






Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6974

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

29.06.2011 10:37:38
mbam-log-2011-06-29 (10-37-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 416293
Laufzeit: 53 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)






Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6692

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

27.05.2011 16:24:30
mbam-log-2011-05-27 (16-24-30).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 329692
Laufzeit: 43 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Liebe Grüße,
Leander

cosinus 21.05.2012 18:49
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Leomuck 21.05.2012 19:05
Huhu,

danke für die Antwort!

Anbei das Logfile:
Code:
OTL logfile created on: 21.05.2012 19:51:05 - Run 2
OTL by OldTimer - Version 3.2.43.1    Folder = D:\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
7,98 Gb Total Physical Memory | 4,83 Gb Available Physical Memory | 60,47% Memory free
15,96 Gb Paging File | 12,91 Gb Available in Paging File | 80,88% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 146,39 Gb Total Space | 13,35 Gb Free Space | 9,12% Space Free | Partition Type: NTFS
Drive D: | 785,03 Gb Total Space | 370,79 Gb Free Space | 47,23% Space Free | Partition Type: NTFS
 
Computer Name: LEOMUCK-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - C:\ProgramData\DatacardService\DCService.exe ()
PRC - C:\ProgramData\DatacardService\DCSHelper.exe (Huawei Technologies Co., Ltd.)
PRC - C:\Windows\SysWOW64\Ctxfihlp.exe (Creative Technology Ltd)
PRC - C:\Windows\SysWOW64\CTxfispi.exe (Creative Technology Ltd)
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CTXFIGER.DLL ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_6c825ce.dll ()
SRV - (NisSrv) -- C:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (vpnagent) -- C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (SXDS10) -- C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe (soft Xpansion)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (DCService.exe) -- C:\ProgramData\DatacardService\DCService.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NisDrv) -- C:\Windows\SysNative\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (vpnva) -- C:\Windows\SysNative\drivers\vpnva64.sys (Cisco Systems, Inc.)
DRV:64bit: - (acsock) -- C:\Windows\SysNative\drivers\acsock64.sys (Cisco Systems, Inc.)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc)
DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (MotioninJoyXFilter) -- C:\Windows\SysNative\drivers\MijXfilt.sys (MotioninJoy)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (huawei_enumerator) -- C:\Windows\SysNative\drivers\ew_jubusenum.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (ha20x2k) -- C:\Windows\SysNative\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV:64bit: - (emupia) -- C:\Windows\SysNative\drivers\emupia2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctsfm2k) -- C:\Windows\SysNative\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctprxy2k) -- C:\Windows\SysNative\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV:64bit: - (ossrv) -- C:\Windows\SysNative\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV:64bit: - (ctaud2k) Creative Audio Driver (WDM) -- C:\Windows\SysNative\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV:64bit: - (ctac32k) -- C:\Windows\SysNative\drivers\ctac32k.sys (Creative Technology Ltd)
DRV:64bit: - (CTEXFIFX.SYS) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTEXFIFX) -- C:\Windows\SysNative\drivers\CTEXFIFX.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT.SYS) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CTHWIUT) -- C:\Windows\SysNative\drivers\CTHWIUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT.SYS) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (CT20XUT) -- C:\Windows\SysNative\drivers\CT20XUT.sys (Creative Technology Ltd.)
DRV:64bit: - (hwdatacard) -- C:\Windows\SysNative\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
 
 
 
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5E 04 A9 0F 1F 22 CD 01  [binary data]
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2921942961-698358322-522096465-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.own3d.tv/"
FF - prefs.js..network.proxy.http: "62.75.221.36"
FF - prefs.js..network.proxy.http_port: 5544
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_233.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.18 00:51:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2011.05.01 17:20:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2012.04.16 10:10:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions
[2011.08.17 22:22:20 | 000,000,000 | ---D | M] (Live HTTP Headers) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions\{8f8fe09b-0bd3-4470-bc1b-8cad42b8203a}
[2012.03.17 15:31:42 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\4oupg7jb.default\extensions\foxyproxy@eric.h.jung
[2011.11.11 12:25:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.08 22:46:05 | 000,399,561 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\{53A03D43-5363-4669-8190-99061B2DEBA5}.XPI
[2012.01.06 01:50:19 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011.08.25 22:11:14 | 000,550,833 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\DIVXWEBPLAYER@DIVX.COM.XPI
[2012.02.01 14:15:08 | 000,048,898 | ---- | M] () (No name found) -- C:\USERS\LEOMUCK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4OUPG7JB.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.03.18 00:51:54 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.02.14 01:58:02 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.14 01:58:02 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.14 01:58:02 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.14 01:58:02 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.14 01:58:02 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.14 01:58:02 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\***\AppData\Local\Google\Chrome\Application\19.0.1084.46\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\***\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_233.dll
CHR - plugin: Java Deployment Toolkit 6.0.250.6 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U25 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: PDF-XChange Viewer (Enabled) = C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll
CHR - plugin: Nexon Game Controller (Enabled) = C:\ProgramData\NexonUS\NGM\npNxGameUS.dll
CHR - plugin: Google Update (Enabled) = C:\Users\***\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - Extension: Click to activate/deactivate ProxTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_0\
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Adblock Plus (Beta) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.2_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Search by Image (by Google) = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\dajedkncpodkggklbegccjpmnglmnflm\1.1.1_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.3_0\
CHR - Extension: Grooveshark Germany unlocker = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\docdgimmdejoiemdafcgeodchlbllgac\2.3.3_0\.orig
CHR - Extension: Reddit Enhancement Suite = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.1.0_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15116/CTPID.cab (Creative Software AutoUpdate Support Package 1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F1EE8F7-4C7F-496C-BCE2-022BF09A0950}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AML Device Install.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^phase-6 Reminder.lnk - C:\PROGRA~2\phase-6\phase-6\reminder\reminder.exe - (phase-6)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: AdobeAAMUpdater-1.0 - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: AdobeCS5.5ServiceManager - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Akamai NetSession Interface - hkey= - key= - C:\Users\***\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
MsConfig:64bit - StartUpReg: Cisco AnyConnect Secure Mobility Agent for Windows - hkey= - key= - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe (Cisco Systems, Inc.)
MsConfig:64bit - StartUpReg: Google Update - hkey= - key= - C:\Users\***\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.)
MsConfig:64bit - StartUpReg: Malwarebytes' Anti-Malware - hkey= - key= - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: Pando Media Booster - hkey= - key= - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - StartUpReg: SwitchBoard - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: X-Lite 4 - hkey= - key= - C:\Program Files (x86)\CounterPath\X-Lite 4\X-Lite4.exe (CounterPath)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - Service
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: MsMpSvc - C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - Service
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: MsMpSvc - C:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32:64bit: vidc.XVID - xvidvfw.dll ()
Drivers32: msacm.bdmpeg - C:\Windows\SysWow64\bdmpega.acm ()
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.mpeg - C:\Windows\SysWow64\bdmpegv.dll ()
Drivers32: vidc.xvid - C:\Windows\SysWow64\xvidvfw.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.05.21 13:19:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.05.19 19:21:56 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\plakate
[2012.05.17 12:06:22 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Adobe
[2012.05.17 12:04:54 | 000,000,000 | ---D | C] -- C:\Windows\_ISTMP1.DIR
[2012.05.17 11:31:10 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner (2)
[2012.05.16 17:46:16 | 000,000,000 | ---D | C] -- D:\Dokumente\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo III
[2012.05.16 17:13:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012.05.16 17:11:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.05.16 16:09:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012.05.16 13:42:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF-XChange
[2012.05.16 13:42:43 | 000,000,000 | ---D | C] -- C:\Program Files\Tracker Software
[2012.05.16 13:35:03 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{B05828CB-5222-4349-A1F2-41DE829FC1F4}
[2012.05.16 13:34:50 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7911F548-8E3D-42AA-9C6D-4F6C26EEC7A4}
[2012.05.15 18:42:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hewlett-Packard
[2012.05.11 20:19:26 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Neuer Ordner
[2012.05.11 19:22:08 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{62EFB906-1777-4178-8168-F4D9A254F530}
[2012.05.09 11:54:31 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2012.05.09 11:54:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT
[2012.05.09 11:54:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD APP
[2012.05.09 11:53:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center
[2012.05.06 14:13:55 | 000,000,000 | ---D | C] -- D:\Dokumente\Texte
[2012.05.05 16:53:44 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Multivalent
[2012.05.05 16:48:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Dev-Cpp
[2012.05.05 16:48:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bloodshed Dev-C++
[2012.05.05 16:35:30 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\pdftk
[2012.05.05 16:34:39 | 000,000,000 | ---D | C] -- C:\Users\***\.Multivalent
[2012.05.05 16:23:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ghostscript
[2012.05.05 16:23:51 | 000,000,000 | ---D | C] -- C:\Program Files\gs
[2012.04.29 12:39:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SmartFTP Client
[2012.04.29 12:39:12 | 000,000,000 | ---D | C] -- C:\Program Files\SmartFTP Client
[2012.04.29 12:38:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SmartFTP Client 4.0 (x64) Setup Files
[2012.04.28 12:43:12 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Spoon
[2012.04.28 12:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScanWizard 5 für Windows
[2012.04.28 12:26:44 | 000,060,928 | ---- | C] (OnSpec Electronic, Inc.) -- C:\Windows\SysWow64\drivers\Smplscsi.sys
[2012.04.28 12:26:43 | 000,015,396 | ---- | C] (Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd5.dll
[2012.04.28 12:26:43 | 000,013,962 | ---- | C] ( Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd6.dll
[2012.04.28 12:26:43 | 000,012,499 | ---- | C] (Microtek International Inc.) -- C:\Windows\SysWow64\Msmusd7.dll
[2012.04.28 12:26:43 | 000,000,000 | ---D | C] -- C:\Kpcms
[2012.04.28 12:26:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ScanWizard 5
[2012.04.28 12:24:51 | 000,000,000 | ---D | C] -- C:\Medion
[2012.04.27 16:06:04 | 000,000,000 | ---D | C] -- D:\Dokumente\My Digital Editions
[2012.04.27 16:06:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2012.04.27 09:26:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{7406F87C-E70D-44F5-97CF-1754A7190422}
[2012.04.27 09:25:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{0A645F5C-8714-4399-AA5B-9153221D18C6}
[2012.04.23 20:41:58 | 000,000,000 | ---D | C] -- C:\Windows\Hewlett-Packard
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]
[2 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.05.21 19:40:01 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2921942961-698358322-522096465-1000UA.job
[2012.05.21 19:23:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.05.21 17:50:00 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.21 17:50:00 | 000,014,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.21 17:40:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.21 17:40:09 | 2133,868,543 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.21 17:39:48 | 000,063,172 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.21 17:39:48 | 000,063,172 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.21 17:39:48 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000007-00000000-00000002-00001102-00000005-00211102}.rfx
[2012.05.21 13:44:29 | 001,648,032 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.21 13:44:29 | 000,713,502 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.05.21 13:44:29 | 000,658,530 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.21 13:44:29 | 000,153,674 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.05.21 13:44:29 | 000,126,170 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.21 12:23:54 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.05.21 09:40:00 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2921942961-698358322-522096465-1000Core.job
[2012.05.17 14:48:51 | 000,579,407 | ---- | M] () -- C:\Users\***\Desktop\tiere.pdf
[2012.05.17 14:48:39 | 000,016,083 | ---- | M] () -- C:\Users\***\Desktop\tiere.sla
[2012.05.17 14:36:40 | 003,093,545 | ---- | M] () -- C:\Users\***\Desktop\selektion.pdf
[2012.05.17 14:35:56 | 003,701,971 | ---- | M] () -- C:\Users\***\Desktop\zpa.pdf
[2012.05.17 14:35:48 | 000,016,083 | ---- | M] () -- C:\Users\***\Desktop\werbung.sla.autosave
[2012.05.17 14:34:16 | 002,493,799 | ---- | M] () -- C:\Users\***\Desktop\Werbung.pdf
[2012.05.17 14:33:49 | 001,846,955 | ---- | M] () -- C:\Users\***\Desktop\bildung.pdf
[2012.05.17 14:32:41 | 001,862,249 | ---- | M] () -- C:\Users\***\Desktop\bildung24.pdf
[2012.05.17 14:27:14 | 000,273,716 | ---- | M] () -- C:\Users\***\Desktop\flyer11.pdf
[2012.05.17 14:25:48 | 000,017,710 | ---- | M] () -- C:\Users\***\Desktop\bildung.sla.autosave
[2012.05.17 14:19:48 | 000,275,291 | ---- | M] () -- C:\Users\***\Desktop\flyer10.pdf
[2012.05.17 14:14:17 | 000,269,714 | ---- | M] () -- C:\Users\***\Desktop\flyer8.pdf
[2012.05.17 13:30:59 | 000,272,298 | ---- | M] () -- C:\Users\***\Desktop\flyer7.pdf
[2012.05.17 13:25:09 | 001,862,250 | ---- | M] () -- C:\Users\***\Desktop\bildung5.pdf
[2012.05.17 13:22:07 | 001,819,528 | ---- | M] () -- C:\Users\***\Desktop\bildung3.pdf
[2012.05.17 13:19:02 | 001,819,550 | ---- | M] () -- C:\Users\***\Desktop\bildung2.pdf
[2012.05.17 12:45:01 | 000,071,449 | ---- | M] () -- C:\Users\***\Desktop\2012_SR_Wahl_Musterstimmzettel.pdf
[2012.05.17 12:41:56 | 000,270,603 | ---- | M] () -- C:\Users\***\Desktop\flyer5.pdf
[2012.05.17 12:16:23 | 003,039,868 | ---- | M] () -- C:\Users\***\Desktop\Soziale Selektion.pdf
[2012.05.17 12:13:37 | 003,039,904 | ---- | M] () -- C:\Users\***\Desktop\Dokument-3-3.pdf
[2012.05.17 12:06:07 | 000,001,259 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.05.17 12:04:02 | 003,032,458 | ---- | M] () -- C:\Users\***\Desktop\Dokument-3-2.pdf
[2012.05.17 11:45:43 | 003,028,098 | ---- | M] () -- C:\Users\***\Desktop\Dokument-1.pdf
[2012.05.17 11:45:20 | 003,028,100 | ---- | M] () -- C:\Users\***\Desktop\Dokument-2.pdf
[2012.05.17 11:28:48 | 000,008,592 | ---- | M] () -- C:\Users\***\.recently-used.xbel
[2012.05.16 17:32:25 | 000,001,213 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.14 12:35:37 | 000,019,091 | ---- | M] () -- D:\Dokumente\12 Wahlvorschlaege Formular Studenten.pdf
[2012.05.10 08:51:49 | 004,949,776 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.05 16:25:22 | 000,000,043 | ---- | M] () -- C:\Windows\gswin64.ini
[2012.05.02 00:07:38 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2012.05.02 00:07:29 | 001,669,618 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.04.28 22:00:27 | 000,216,749 | ---- | M] () -- C:\Users\***\flyer1-Seite001.png
[2012.04.28 22:00:27 | 000,129,521 | ---- | M] () -- C:\Users\***\flyer1-Seite002.png
[2012.04.28 21:53:31 | 000,231,053 | ---- | M] () -- C:\Users\***\Dokument-5.pdf
[2012.04.28 21:49:29 | 000,127,720 | ---- | M] () -- C:\Users\***\Dokument-5-Seite002.png
[2012.04.28 21:49:28 | 000,216,749 | ---- | M] () -- C:\Users\***\Dokument-5-Seite001.png
[2012.04.28 21:43:30 | 000,143,249 | ---- | M] () -- C:\Users\***\Dokument-5-Seite002 - Kopie.png
[2012.04.28 21:43:29 | 000,217,065 | ---- | M] () -- C:\Users\***\Dokument-5-Seite001 - Kopie.png
[2012.04.28 21:34:35 | 000,138,732 | ---- | M] () -- C:\Users\***\Dokument-6-Seite002.png
[2012.04.28 21:34:34 | 000,193,046 | ---- | M] () -- C:\Users\***\Dokument-6-Seite001.png
[2012.04.28 12:47:32 | 000,000,035 | ---- | M] () -- C:\Windows\Ulead32.INI
[2012.04.28 12:26:55 | 000,001,980 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner Finder.lnk
[2012.04.28 12:26:55 | 000,001,948 | ---- | M] () -- C:\Users\Public\Desktop\ScanWizard 5.lnk
[2012.04.27 15:30:43 | 000,003,584 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2 C:\Users\***\Desktop\*.tmp files -> C:\Users\***\Desktop\*.tmp -> ]
[2 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.05.21 12:23:54 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.05.17 14:42:09 | 000,579,407 | ---- | C] () -- C:\Users\***\Desktop\tiere.pdf
[2012.05.17 14:42:02 | 000,016,083 | ---- | C] () -- C:\Users\***\Desktop\tiere.sla
[2012.05.17 14:36:40 | 003,093,545 | ---- | C] () -- C:\Users\***\Desktop\selektion.pdf
[2012.05.17 14:35:56 | 003,701,971 | ---- | C] () -- C:\Users\***\Desktop\zpa.pdf
[2012.05.17 14:32:40 | 001,862,249 | ---- | C] () -- C:\Users\***\Desktop\bildung24.pdf
[2012.05.17 14:27:13 | 000,273,716 | ---- | C] () -- C:\Users\***\Desktop\flyer11.pdf
[2012.05.17 14:19:48 | 000,275,291 | ---- | C] () -- C:\Users\***\Desktop\flyer10.pdf
[2012.05.17 14:14:16 | 000,269,714 | ---- | C] () -- C:\Users\***\Desktop\flyer8.pdf
[2012.05.17 13:29:46 | 000,272,298 | ---- | C] () -- C:\Users\***\Desktop\flyer7.pdf
[2012.05.17 13:22:19 | 001,862,250 | ---- | C] () -- C:\Users\***\Desktop\bildung5.pdf
[2012.05.17 13:19:31 | 001,819,528 | ---- | C] () -- C:\Users\***\Desktop\bildung3.pdf
[2012.05.17 13:19:02 | 001,819,550 | ---- | C] () -- C:\Users\***\Desktop\bildung2.pdf
[2012.05.17 13:15:48 | 000,017,710 | ---- | C] () -- C:\Users\***\Desktop\bildung.sla.autosave
[2012.05.17 13:12:20 | 001,846,955 | ---- | C] () -- C:\Users\***\Desktop\bildung.pdf
[2012.05.17 12:44:50 | 000,071,449 | ---- | C] () -- C:\Users\***\Desktop\2012_SR_Wahl_Musterstimmzettel.pdf
[2012.05.17 12:38:18 | 000,270,603 | ---- | C] () -- C:\Users\***\Desktop\flyer5.pdf
[2012.05.17 12:25:48 | 000,016,083 | ---- | C] () -- C:\Users\***\Desktop\werbung.sla.autosave
[2012.05.17 12:20:18 | 002,493,799 | ---- | C] () -- C:\Users\***\Desktop\Werbung.pdf
[2012.05.17 12:11:27 | 003,039,904 | ---- | C] () -- C:\Users\***\Desktop\Dokument-3-3.pdf
[2012.05.17 12:06:07 | 000,001,259 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
[2012.05.17 12:00:42 | 003,032,458 | ---- | C] () -- C:\Users\***\Desktop\Dokument-3-2.pdf
[2012.05.17 12:00:19 | 003,039,868 | ---- | C] () -- C:\Users\***\Desktop\Soziale Selektion.pdf
[2012.05.17 11:45:42 | 003,028,098 | ---- | C] () -- C:\Users\***\Desktop\Dokument-1.pdf
[2012.05.17 11:45:20 | 003,028,100 | ---- | C] () -- C:\Users\***\Desktop\Dokument-2.pdf
[2012.05.17 11:28:48 | 000,008,592 | ---- | C] () -- C:\Users\***\.recently-used.xbel
[2012.05.16 17:13:40 | 000,001,213 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2012.05.14 12:35:40 | 000,019,091 | ---- | C] () -- D:\Dokumente\12 Wahlvorschlaege Formular Studenten.pdf
[2012.05.05 16:25:06 | 000,000,043 | ---- | C] () -- C:\Windows\gswin64.ini
[2012.04.28 21:56:13 | 000,129,521 | ---- | C] () -- C:\Users\***\flyer1-Seite002.png
[2012.04.28 21:56:12 | 000,216,749 | ---- | C] () -- C:\Users\***\flyer1-Seite001.png
[2012.04.28 21:49:43 | 000,231,053 | ---- | C] () -- C:\Users\***\Dokument-5.pdf
[2012.04.28 21:44:42 | 000,217,065 | ---- | C] () -- C:\Users\***\Dokument-5-Seite001 - Kopie.png
[2012.04.28 21:44:42 | 000,143,249 | ---- | C] () -- C:\Users\***\Dokument-5-Seite002 - Kopie.png
[2012.04.28 21:20:26 | 000,193,046 | ---- | C] () -- C:\Users\***\Dokument-6-Seite001.png
[2012.04.28 21:20:26 | 000,138,732 | ---- | C] () -- C:\Users\***\Dokument-6-Seite002.png
[2012.04.28 21:12:04 | 000,127,720 | ---- | C] () -- C:\Users\***\Dokument-5-Seite002.png
[2012.04.28 20:53:32 | 000,216,749 | ---- | C] () -- C:\Users\***\Dokument-5-Seite001.png
[2012.04.28 12:29:52 | 000,000,035 | ---- | C] () -- C:\Windows\Ulead32.INI
[2012.04.28 12:26:55 | 000,001,980 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Scanner Finder.lnk
[2012.04.28 12:26:55 | 000,001,948 | ---- | C] () -- C:\Users\Public\Desktop\ScanWizard 5.lnk
[2012.04.28 12:26:44 | 000,285,216 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsio.sys
[2012.04.28 12:26:44 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\drivers\Onsreged.sys
[2012.04.27 16:06:01 | 000,002,196 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions.lnk
[2012.04.27 15:30:43 | 000,003,584 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.04.16 12:26:49 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.03.19 17:15:07 | 000,000,016 | ---- | C] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.03.09 14:06:14 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.02.15 04:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 04:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.12.19 01:40:55 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2011.11.04 23:35:31 | 000,000,575 | ---- | C] () -- C:\Windows\Lidos6.ini
[2011.10.27 23:26:15 | 000,012,331 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall-Jardinains!.dat
[2011.10.25 22:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.08.24 09:53:45 | 000,013,030 | ---- | C] () -- C:\Users\***\AppData\Roaming\PDOXUSRS.NET
[2011.08.18 07:55:21 | 000,164,352 | ---- | C] () -- C:\Windows\SysWow64\SpoonUninstall.exe
[2011.07.26 15:30:42 | 000,007,598 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2011.07.19 10:33:55 | 001,256,448 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.07.19 10:33:55 | 000,200,192 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.07.11 18:11:15 | 000,282,864 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.07.11 18:11:14 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2011.07.11 18:11:14 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.06.30 16:36:06 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2011.05.26 10:58:41 | 000,122,700 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.05.04 19:12:47 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.05.04 19:12:47 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2011.05.04 19:12:28 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL
[2011.05.01 17:20:51 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.05.01 14:21:16 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.05.01 13:52:50 | 001,669,618 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.05.01 13:00:24 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
 
========== LOP Check ==========
 
[2011.07.06 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.minecraft
[2012.03.19 18:12:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\11001
[2012.01.16 23:32:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.07.27 16:27:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Crayon Physics Deluxe
[2011.05.05 10:30:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2012.05.05 16:51:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dev-Cpp
[2011.07.15 14:04:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DisneyInteractiveStudios
[2011.12.17 18:00:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DL
[2012.04.09 09:08:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Downloaded Installations
[2012.05.21 09:50:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.07.09 14:04:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.01.24 10:25:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Feedreader
[2012.05.14 12:44:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2012.04.12 12:36:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FireShot
[2012.05.20 19:54:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\foobar2000
[2011.12.04 12:38:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FTPRush
[2012.04.29 15:27:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2011.09.15 18:44:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HandBrake
[2012.02.25 18:48:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HLSW
[2012.05.04 15:53:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2012.03.19 17:14:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\kock
[2011.12.17 18:19:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lidos7
[2011.11.05 12:32:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lingo4u
[2011.05.01 15:13:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient
[2011.06.05 19:58:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MotioninJoy
[2012.02.06 17:26:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mp3tag
[2012.03.08 11:08:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mumble
[2012.05.15 22:18:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nettalk
[2012.03.28 12:29:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nitro PDF
[2012.02.29 00:00:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++
[2011.09.01 16:37:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2012.01.04 18:14:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin
[2012.02.11 14:38:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Phase6
[2011.05.18 11:10:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PunkBuster
[2012.04.17 14:58:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RStudio
[2012.05.05 16:25:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Scribus
[2012.02.11 15:21:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TIPP10
[2012.02.10 20:05:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Trillian
[2011.12.17 01:07:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2011.09.10 21:51:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2011.09.15 19:34:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinFF
[2012.03.19 17:15:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
[2012.05.20 11:05:49 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.07.06 15:41:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.minecraft
[2012.03.19 18:12:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\11001
[2011.08.18 07:55:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AccurateRip
[2012.04.27 16:06:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2012.03.02 17:27:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\adobeflash
[2011.09.16 00:51:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer
[2011.05.01 13:00:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ATI
[2012.01.16 23:32:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011.07.27 16:27:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Crayon Physics Deluxe
[2011.05.05 10:30:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2012.05.05 16:51:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dev-Cpp
[2011.07.15 14:04:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DisneyInteractiveStudios
[2011.12.17 18:00:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DL
[2012.04.09 09:08:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Downloaded Installations
[2012.05.21 09:50:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dropbox
[2011.07.09 14:04:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.01.24 10:25:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Feedreader
[2012.05.14 12:44:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2012.04.12 12:36:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FireShot
[2012.05.20 19:54:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\foobar2000
[2011.12.04 12:38:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FTPRush
[2012.04.29 15:27:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2011.09.15 18:44:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HandBrake
[2012.02.25 18:48:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HLSW
[2012.05.15 18:42:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HpUpdate
[2011.05.01 12:56:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2012.05.04 15:53:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\IrfanView
[2012.03.19 17:14:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\kock
[2011.12.17 18:19:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lidos7
[2011.11.05 12:32:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lingo4u
[2011.05.01 15:13:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient
[2011.05.01 14:57:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2011.05.27 15:39:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2012.01.04 21:43:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Player Classic
[2012.03.15 13:54:15 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2011.06.05 19:58:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\MotioninJoy
[2012.02.11 14:38:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mozilla
[2012.02.06 17:26:58 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mp3tag
[2012.03.08 11:08:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mumble
[2012.05.15 22:18:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nettalk
[2012.03.28 12:29:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Nitro PDF
[2012.02.29 00:00:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Notepad++
[2011.09.01 16:37:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2012.01.04 18:14:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin
[2012.02.11 14:38:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Phase6
[2011.05.18 11:10:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PunkBuster
[2011.08.25 22:08:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Real
[2012.04.17 14:58:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RStudio
[2012.05.05 16:25:27 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Scribus
[2012.02.11 14:36:22 | 000,000,000 | RH-D | M] -- C:\Users\***\AppData\Roaming\SecuROM
[2012.05.21 02:38:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Skype
[2011.05.04 13:40:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\skypePM
[2012.02.24 00:08:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SmartFTP
[2012.02.11 15:21:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TIPP10
[2012.02.10 20:05:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Trillian
[2011.12.17 01:07:28 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2012.04.09 09:08:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\vlc
[2011.09.10 21:51:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Windows Live Writer
[2011.09.15 19:34:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinFF
[2011.05.01 19:26:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR
[2012.03.19 17:15:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
 
< %APPDATA%\*.exe /s >
[2012.02.15 01:03:14 | 024,246,216 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe
[2012.02.15 01:03:44 | 000,174,752 | ---- | M] (Dropbox, Inc.) -- C:\Users\***\AppData\Roaming\Dropbox\bin\Uninstall.exe
[2012.01.16 23:32:00 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\***\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011.05.29 16:31:07 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{36A1E3D6-288A-4EEE-A081-30D9808B2BE3}\ARPPRODUCTICON.exe
[2011.05.29 16:31:07 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{36A1E3D6-288A-4EEE-A081-30D9808B2BE3}\NewShortcut21_65EFA0CB403943C5A40BFD2784C7E05E.exe
[2011.05.29 16:31:07 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{36A1E3D6-288A-4EEE-A081-30D9808B2BE3}\NewShortcut2_65EFA0CB403943C5A40BFD2784C7E05E.exe
[2011.09.15 19:45:03 | 000,082,726 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{9D0E65B9-B525-43C0-A2C9-5D73D24ADB80}\_853F67D554F05449430E7E.exe
[2011.09.15 19:45:03 | 000,082,726 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{9D0E65B9-B525-43C0-A2C9-5D73D24ADB80}\_EF62F249AA2BABEF762CDA.exe
[2011.06.05 21:49:33 | 000,110,352 | ---- | M] (www.motioninjoy.com) -- C:\Users\***\AppData\Roaming\MotioninJoy\DS3tool\update\DS3_Tool.exe
[2011.02.24 17:07:45 | 000,835,440 | R--- | M] () -- C:\Users\***\AppData\Roaming\PunkBuster\pbsetup\pbsvc.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<          >

< End of report >
P.S. Noch mal der Hinweis darauf, dass ich die falschen Malwarebytes-Logs angehängt hatte. Die richtigen (alle, die auf diesem PC erstellt wurden), habe ich letzten Post noch mal angehängt.
P.P.S. Kann ich den PC denn während dieser Prozedur normal benutzen? Also auf Seiten einloggen, etc. - oder ist das zu gefährlich?


Liebe Grüße,
Leo

cosinus 21.05.2012 20:05
Warte doch erstmal bis wir hier fertig sind bevor du dich wieder irgendwo einloggst!


Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
:OTL
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1:9421;<local>
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://www.own3d.tv/"
FF - prefs.js..network.proxy.http: "62.75.221.36"
FF - prefs.js..network.proxy.http_port: 5544
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\Shell\AutoRun\command - "" = F:\Setup.exe
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell - "" = AutoRun
O33 - MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\Shell\AutoRun\command - "" = G:\AutoRun.exe
[2012.05.17 12:04:54 | 000,000,000 | ---D | C] -- C:\Windows\_ISTMP1.DIR
[2012.03.19 17:15:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
[2012.03.19 18:12:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\11001
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Leomuck 21.05.2012 20:12
Huhu,

vielen Dank für deine Mühe!

Anbei das Log:
Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: false removed from browser.search.update
Prefs.js: "hxxp://www.own3d.tv/" removed from browser.startup.homepage
Prefs.js: "62.75.221.36" removed from network.proxy.http
Prefs.js: 5544 removed from network.proxy.http_port
Prefs.js: 0 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
File F:\Setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
File G:\AutoRun.exe not found.
C:\Windows\_ISTMP1.DIR\_ISTMP1.DIR folder moved successfully.
Folder C:\Users\***\AppData\Roaming\xmldm\ not found.
Folder C:\Users\***\AppData\Roaming\11001\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: ***
->Temp folder emptied: 1935697576 bytes
->Temporary Internet Files folder emptied: 490519563 bytes
->Java cache emptied: 1671372 bytes
->FireFox cache emptied: 92740791 bytes
->Google Chrome cache emptied: 242174687 bytes
->Apple Safari cache emptied: 14628864 bytes
->Opera cache emptied: 12002690 bytes
->Flash cache emptied: 306843 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1618992 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 312130087 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 499589248 bytes
 
Total Files Cleaned = 3.436,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: ***
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.1 log created on 05212012_210833

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
Liebe Grüße,
Leo

cosinus 21.05.2012 21:00
Zitat:
Folder C:\Users\***\AppData\Roaming\11001\ not found.
Hast du die Sternchen nicht in den realen Benutzernamen zurückeditiert?

Leomuck 21.05.2012 21:02
Oh entschuldige, das habe ich gar nicht gesehen.
Soll ich die zwei Befehle, wo Sternchen enthalten waren, noch mal in OTL ausführen (Fix) lassen?

Oder gleich noch mal alles zusammen?

Sorry für die Umstände!

cosinus 22.05.2012 10:40
Ja nochmal wiederholen, richtig zurückeditiert

Leomuck 22.05.2012 13:59
Huhu!

Okay, ich hab das Ganze also einfach nochmal gemacht, diesmal mit den Sternchen zurückeditiert.

Hier das Log:
Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: false removed from browser.search.update
Prefs.js: "hxxp://www.own3d.tv/" removed from browser.startup.homepage
Prefs.js: "62.75.221.36" removed from network.proxy.http
Prefs.js: 5544 removed from network.proxy.http_port
Prefs.js: 0 removed from network.proxy.type
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop not found.
Registry value HKEY_USERS\S-1-5-21-2921942961-698358322-522096465-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{490ef4f3-754c-11e0-bfc6-002522a665fa}\ not found.
File F:\Setup.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a13-0a41-11e1-9e09-002522a665fa}\ not found.
File G:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9a978a16-0a41-11e1-9e09-002522a665fa}\ not found.
File G:\AutoRun.exe not found.
C:\Windows\_ISTMP1.DIR\_ISTMP0.DIR folder moved successfully.
C:\Windows\_ISTMP1.DIR folder moved successfully.
C:\Users\***\AppData\Roaming\xmldm folder moved successfully.
C:\Users\***\AppData\Roaming\11001\components folder moved successfully.
C:\Users\***\AppData\Roaming\11001 folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: ***
->Temp folder emptied: 557 bytes
->Temporary Internet Files folder emptied: 251032 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Google Chrome cache emptied: 6731845 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 13908 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 7,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: ***
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.43.1 log created on 05222012_145541

Files\Folders moved on Reboot...
C:\Users\***\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

Liebe Grüße und Danke,
Leo


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:15 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131