| Sahiiira | 09.07.2012 10:32 |
Troj. hermes_v01 - kein vertrauenwürdiges Zertifikat
Hallo zusammen,
Ich habe bei web.de ne Mail bekommen, dass ich mit dem Trojaner hermes_v01 infiziert bin. Konnte diese Mail auch nur übers Handy aufrufen, da über den PC immer kommt „nicht vertrauenswürdige Zertifikate“ und ich kann mich nirgends einloggen und auch auf einige Seiten komme ich gar nicht drauf mit Firefox.
Antivir sagt was von Gatika.D57…
Ich danke für die Hilfe
habe vorab diese Scan durchgeführt, als Vorbild diesen Thread: http://www.trojaner-board.de/118620-...m-rechner.html
Log nach dem OTL-Fix: Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9CB91CDC-85DD-4A9F-9C19-759FCC789895}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9CB91CDC-85DD-4A9F-9C19-759FCC789895}\ not found.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "foxsearch" removed from browser.search.defaultenginename
Prefs.js: "foxsearch" removed from browser.search.order.1
Prefs.js: "foxsearch" removed from browser.search.selectedEngine
File C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\foxsearch.src not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\3FWHZQA3LT not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
Unable to delete ADS C:\ProgramData\Temp:D428F1D2 .
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Auflösungscache wurde geleert.
C:\Dokumente und Einstellungen\Sahira\Desktop\cmd.bat deleted successfully.
C:\Dokumente und Einstellungen\Sahira\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1518925 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Sahira
->Temp folder emptied: 65659095 bytes
->Temporary Internet Files folder emptied: 70170976 bytes
->Java cache emptied: 18483388 bytes
->FireFox cache emptied: 49780417 bytes
->Flash cache emptied: 506 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1138654 bytes
%systemroot%\System32 .tmp files removed: 2676103 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 158032929 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 351,00 mb
OTL by OldTimer - Version 3.2.53.1 log created on 07072012_122006
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Komplett-Scan Malwarebytes Anti-Malware: Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.07.07.04
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 6.0.2900.5512
Sahira :: LYLA [Administrator]
07.07.2012 12:29:06
mbam-log-2012-07-07 (12-29-06).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 317762
Laufzeit: 49 Minute(n), 13 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 3
C:\System Volume Information\_restore{79A69D07-E22D-4CF3-B973-97F9286FDDC1}\RP41\A0048649.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\_restore{79A69D07-E22D-4CF3-B973-97F9286FDDC1}\RP41\A0048650.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\_restore{79A69D07-E22D-4CF3-B973-97F9286FDDC1}\RP42\A0052926.exe (PUP.OfferBundler.ST) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
CCleaner: Code:
Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 30.06.2012 10.3.181.34
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 30.06.2012 11.1.102.55
Adobe Reader X (10.1.3) - Deutsch Adobe Systems Incorporated 10.04.2012 181,00MB 10.1.3
Adobe Shockwave Player 11.6 Adobe Systems, Inc. 10.03.2012 11.6.4.634
Avira Free Antivirus Avira 07.07.2012 12.0.0.1125
CCleaner Piriform 22.06.2012 3.20
Cisco Systems VPN Client 5.0.07.0410 Cisco Systems, Inc. 29.01.2012 12,37MB 5.0.7
Compatibility Pack for the 2007 Office system Microsoft Corporation 08.01.2011 76,14MB 12.0.6514.5001
Counter-Strike Valve 06.01.2011
CyberLink YouCam 5 CyberLink Corp. 10.06.2012 5.0.0909
Diablo III Blizzard Entertainment 07.07.2012 1.0.3.10235
FormatFactory 2.95 Free Time 14.05.2012 2.95
Java(TM) 6 Update 31 Oracle 12.04.2012 91,30MB 6.0.310
Logitech Vid HD Logitech Inc.. 19.02.2011 7.2 (7248)
Logitech Webcam Software Logitech Inc. 19.02.2011 44,29MB 12.10.1113
Logitech Webcam Software-Treiberpaket Logitech Inc. 19.02.2011 12.10.1110
MainConcept DTV Decoder Pro MainConcept GmbH 09.01.2011 11,28MB 1.5.0.2
Malwarebytes Anti-Malware Version 1.61.0.1400 Malwarebytes Corporation 07.07.2012 1.61.0.1400
Media Go Sony 30.10.2011 99,32MB 2.0.317
Microsoft .NET Framework 2.0 Language Pack - DEU Microsoft Corporation 30.10.2011
Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 21.03.2012 183,00MB 2.2.30729
Microsoft Office XP Professional mit FrontPage Microsoft Corporation 08.01.2011 172,00MB 10.0.2701.0
Microsoft Silverlight Microsoft Corporation 10.09.2011 19,44MB 4.0.60531.0
Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Corporation 10.06.2011
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 30.10.2011 5,25MB 8.0.59193
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 22.04.2011 9,64MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 06.01.2011 15,07MB 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 07.07.2012 11,13MB 10.0.40219
Mozilla Firefox 13.0.1 (x86 de) Mozilla 04.07.2012 13.0.1
Mozilla Maintenance Service Mozilla 04.07.2012 13.0.1
MyPhoneExplorer F.J. Wechselberger 31.10.2011 1.8.2
Nero 8 Classic Edition Nero AG 20.05.2011 310,00MB 8.3.24
No23 Recorder No23 08.09.2011 2.1.0.3
NVIDIA Drivers NVIDIA Corporation 06.01.2011
Picasa 3 Google, Inc. 06.01.2011 3.8
ProgDVB 10.02.2011
QIP 2010 3.1.5890 20.07.2011 3.1.5890
QuickTime 11.01.2011
REALTEK GbE & FE Ethernet PCI-E NIC Driver Realtek 06.01.2011 1.13.0000
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 06.01.2011 5.10.0.5506
RollerCoaster Tycoon 3 Atari 05.03.2011
Security Task Manager 1.8d Neuber Software 29.08.2011 1.8d
Skype™ 5.10 Skype Technologies S.A. 01.07.2012 19,39MB 5.10.114
Sony Ericsson Update Engine Sony Ericsson Mobile Communications AB 22.04.2012 2.12.5.57
Sony PC Companion 2.10.053 Sony 22.04.2012 2.10.053
Spybot - Search & Destroy Safer Networking Limited 30.07.2011 1.6.2
Steam Valve Corporation 06.01.2011 42,28MB 1.0.0.0
TeamSpeak 3 Client TeamSpeak Systems GmbH 03.08.2011
TechniSat DVB Receiver 09.01.2011
TechniSat DVB-PC TV Star TechniSat 09.01.2011 1.0.0
The Rosetta Stone 06.03.2012
VLC media player 1.1.5 VideoLAN 06.01.2011 1.1.5
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray Microsoft Corporation 06.01.2011 1.0
Windows Live Essentials Microsoft Corporation 20.02.2011 14.0.8117.0416
Windows Media Format 11 runtime 10.06.2011
Windows XP Service Pack 3 Microsoft Corporation 06.01.2011 20080414.031514
WinRAR 06.01.2011
WISO Steuer-Sparbuch 2011 Data Service GmbH 08.02.2011 18.00.6928
xp-AntiSpy 3.97-10 Christian Taubenheim 06.01.2011
OTL-File: Code:
OTL logfile created on: 07.07.2012 13:38:33 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Dokumente und Einstellungen\Sahira\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,52 Gb Available Physical Memory | 76,10% Memory free
3,85 Gb Paging File | 3,41 Gb Available in Paging File | 88,49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 127,99 Gb Total Space | 27,52 Gb Free Space | 21,50% Space Free | Partition Type: NTFS
Drive E: | 803,52 Gb Total Space | 693,17 Gb Free Space | 86,27% Space Free | Partition Type: NTFS
Computer Name: LYLA | User Name: Sahira | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.07.07 12:13:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Sahira\Desktop\OTL.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.02 00:31:35 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2011.09.09 13:37:16 | 000,247,016 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\YouCam\YouCamService.exe
PRC - [2010.09.27 12:58:24 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe
PRC - [2009.10.07 02:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2009.03.05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2008.04.14 08:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2012.04.16 23:11:02 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2010.09.27 13:03:08 | 000,201,512 | ---- | M] () -- C:\WINDOWS\system32\vpnapi.dll
MOD - [2008.04.14 08:52:18 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
========== Win32 Services (SafeList) ==========
SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2012.06.15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.01.18 14:38:28 | 000,155,320 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Programme\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2010.09.27 12:58:24 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Programme\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)
SRV - [2009.10.07 02:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.02.28 17:07:48 | 000,529,704 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe -- (NMIndexingService)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\DRIVERS\UIUSYS.SYS -- (UIUSys)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.10.01 14:31:49 | 000,443,448 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2011.04.14 05:48:48 | 000,027,760 | ---- | M] (CyberLink Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\clwvd.sys -- (clwvd)
DRV - [2010.09.27 12:56:00 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys -- (CVPNDRVA)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.10.07 10:49:50 | 000,023,832 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lvuvcflt.sys -- (FilterService)
DRV - [2009.10.07 10:49:38 | 006,756,632 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvuvc.sys -- (LVUVC) Logitech Webcam 120(UVC)
DRV - [2009.10.07 02:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.03.25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mdm.sys -- (s1018mdm)
DRV - [2009.03.25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018unic.sys -- (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)
DRV - [2009.03.25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mgmt.sys -- (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)
DRV - [2009.03.25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018obex.sys -- (s1018obex)
DRV - [2009.03.25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)
DRV - [2009.03.25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018nd5.sys -- (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)
DRV - [2009.03.25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s1018mdfl.sys -- (s1018mdfl)
DRV - [2008.11.16 19:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dne2000.sys -- (DNE)
DRV - [2007.11.14 20:05:16 | 000,394,952 | ---- | M] (Zone Labs, LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant)
DRV - [2007.11.01 15:38:56 | 004,620,288 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007.10.23 19:51:04 | 000,103,296 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2007.01.18 21:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2003.08.19 02:19:38 | 000,438,776 | R--- | M] (B2C2, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SkyNET.sys -- (SKYNET)
DRV - [2002.11.28 16:18:04 | 000,015,360 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL)
DRV - [2002.11.28 12:43:49 | 000,022,016 | ---- | M] (Elaborate Bytes AG) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\ElbyVCD.sys -- (ElbyVCD)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..CT2736476.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:3.5.0.12
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:3.0.2
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.8013
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFSB10&ctid=CT2736476&SearchSource=2&q="
FF - prefs.js..network.proxy.http: "188.241.71.1"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Programme\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: File not found
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Programme\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.04 18:01:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.13 16:54:27 | 000,000,000 | ---D | M]
[2011.01.06 15:46:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Mozilla\Extensions
[2012.07.07 12:26:12 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Mozilla\Firefox\Profiles\n6jfhfv3.default\extensions
[2012.06.24 14:55:32 | 000,000,000 | ---D | M] (Freeware.de) -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Mozilla\Firefox\Profiles\n6jfhfv3.default\extensions\{7e111a5c-3d11-4f56-9463-5310c3c69025}
[2012.06.15 23:21:46 | 000,000,000 | ---D | M] (DoNotTrackPlus) -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Mozilla\Firefox\Profiles\n6jfhfv3.default\extensions\donottrackplus@abine.com
[2011.04.30 12:31:19 | 000,002,057 | ---- | M] () -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Mozilla\Firefox\Profiles\n6jfhfv3.default\searchplugins\youtube-videosuche.xml
[2012.07.04 18:01:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.06.15 23:21:46 | 000,182,698 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\SAHIRA\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\N6JFHFV3.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.06.15 00:19:07 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.04.12 19:04:17 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.15 00:46:56 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2011.07.30 23:08:35 | 000,436,304 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 15016 more lines...
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [YouCam Service] C:\Programme\CyberLink\YouCam\YouCamService.exe (CyberLink Corp.)
O4 - HKCU..\Run: [LicenseValidator] C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Identities\{4A4C8082-DC73-4677-A755-565FC6ED242B}\LicenseValidator.exe File not found
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk = C:\WINDOWS\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D52372E4-B50C-4185-85CC-ABC9FA90F59F}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Sahira\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Sahira\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.01.06 14:20:10 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{3ff41a40-52e7-11e0-88da-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{3ff41a40-52e7-11e0-88da-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{3ff41a40-52e7-11e0-88da-806d6172696f}\Shell\AutoRun\command - "" = G:\autorun.exe
O33 - MountPoints2\{f80d8bc3-02ec-11e1-bd5a-00d0d7022c48}\Shell - "" = AutoRun
O33 - MountPoints2\{f80d8bc3-02ec-11e1-bd5a-00d0d7022c48}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{f80d8bc3-02ec-11e1-bd5a-00d0d7022c48}\Shell\AutoRun\command - "" = G:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.07.07 13:37:06 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Sahira\Recent
[2012.07.07 13:35:28 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2012.07.07 13:33:06 | 003,889,704 | ---- | C] (Piriform Ltd) -- C:\Dokumente und Einstellungen\Sahira\Desktop\ccsetup320.exe
[2012.07.07 12:27:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Malwarebytes
[2012.07.07 12:27:38 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.07.07 12:27:38 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.07.07 12:27:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.07.07 12:27:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2012.07.07 12:25:18 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Sahira\Desktop\mbam-setup-1[1].61.0.1400.exe
[2012.07.07 12:20:06 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.07.07 12:13:39 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Sahira\Desktop\OTL.exe
[2012.07.07 12:00:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Avira
[2012.07.07 11:55:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Avira
[2012.07.07 11:55:35 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\ssmdrv.sys
[2012.07.07 11:55:34 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2012.07.07 11:55:34 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2012.07.07 11:55:34 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2012.07.07 11:55:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
[2012.07.07 11:55:30 | 000,000,000 | ---D | C] -- C:\Programme\Avira
[2012.07.04 18:01:30 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service
[2012.07.03 21:46:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\TeamViewer
[2012.07.03 21:46:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Media Player Classic
[2012.06.24 14:55:22 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2012.06.24 14:55:14 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\WINDOWS\System32\dhRichClient3.dll
[2012.06.24 14:55:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\DesktopIconForAmazon
[2012.06.23 19:15:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Eigene Dateien\Ebooks
[2012.06.19 18:02:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sahira\Desktop\Thisrts
[2012.06.10 19:01:37 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\kswdmcap.ax
[2012.06.10 19:01:37 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\kstvtune.ax
[2012.06.10 19:01:37 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\vidcap.ax
[2012.06.10 19:01:36 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\vfwwdm32.dll
[2012.06.10 19:01:34 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\ksxbar.ax
[2012.06.10 19:01:31 | 000,027,760 | ---- | C] (CyberLink Corporation) -- C:\WINDOWS\System32\drivers\clwvd.sys
[2012.06.10 19:01:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\CyberLink YouCam 5
[2012.06.10 19:00:35 | 000,000,000 | ---D | C] -- C:\Programme\CyberLink
========== Files - Modified Within 30 Days ==========
[2012.07.07 13:33:12 | 003,889,704 | ---- | M] (Piriform Ltd) -- C:\Dokumente und Einstellungen\Sahira\Desktop\ccsetup320.exe
[2012.07.07 13:25:37 | 000,002,423 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VPN Client.lnk
[2012.07.07 13:25:35 | 000,206,492 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2012.07.07 13:25:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.07.07 13:24:26 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\lvuvc.hs
[2012.07.07 13:24:23 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\logiflt.iad
[2012.07.07 12:25:18 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Dokumente und Einstellungen\Sahira\Desktop\mbam-setup-1[1].61.0.1400.exe
[2012.07.07 12:20:08 | 000,411,148 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2012.07.07 12:20:08 | 000,397,196 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012.07.07 12:20:08 | 000,072,328 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2012.07.07 12:20:08 | 000,059,668 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012.07.07 12:13:41 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Sahira\Desktop\OTL.exe
[2012.07.07 11:43:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.07.04 17:54:21 | 000,275,762 | ---- | M] () -- C:\Dokumente und Einstellungen\Sahira\Desktop\ff.JPG
[2012.07.04 17:52:02 | 000,205,772 | ---- | M] () -- C:\Dokumente und Einstellungen\Sahira\Desktop\bookmarks-2012-07-04.json
[2012.07.04 17:17:33 | 000,000,245 | -HS- | M] () -- C:\boot.ini
========== Files Created - No Company Name ==========
[2012.07.04 18:01:31 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk
[2012.07.04 17:54:20 | 000,275,762 | ---- | C] () -- C:\Dokumente und Einstellungen\Sahira\Desktop\ff.JPG
[2012.07.04 17:52:02 | 000,205,772 | ---- | C] () -- C:\Dokumente und Einstellungen\Sahira\Desktop\bookmarks-2012-07-04.json
[2012.05.14 18:30:34 | 000,032,256 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll
[2012.03.21 17:16:24 | 000,040,960 | ---- | C] () -- C:\WINDOWS\ASWComp.dat
[2012.01.07 20:43:01 | 000,000,617 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2011.10.16 20:52:40 | 000,000,071 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2011.05.20 19:26:02 | 000,001,024 | ---- | C] () -- C:\Dokumente und Einstellungen\Sahira\.rnd
[2011.04.30 15:09:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.04.30 15:08:25 | 000,133,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.02.19 13:23:40 | 000,128,512 | ---- | C] () -- C:\Dokumente und Einstellungen\Sahira\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.02.19 12:48:37 | 000,082,289 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2011.02.08 20:06:19 | 000,000,080 | ---- | C] () -- C:\WINDOWS\wiso.ini
[2011.02.07 22:58:08 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2011.01.19 17:33:28 | 000,000,117 | ---- | C] () -- C:\Dokumente und Einstellungen\Sahira\default.pls
[2011.01.19 17:33:25 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2011.01.09 14:20:37 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\libbz2.dll
[2011.01.09 13:51:05 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2011.01.09 00:23:05 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2011.01.06 16:29:14 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2011.01.06 16:11:10 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2011.01.06 15:46:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2011.01.06 14:21:12 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.01.06 14:18:30 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010.09.27 13:03:08 | 000,201,512 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
[2010.09.27 12:57:26 | 000,197,416 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
========== LOP Check ==========
[2012.05.17 15:40:35 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net
[2011.02.08 20:06:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ Data Service GmbH
[2011.09.08 18:08:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Caphyon
[2011.01.09 14:18:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CMUV
[2012.04.11 18:11:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\install_clap
[2011.08.29 13:57:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
[2012.04.22 21:59:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sony
[2012.03.21 17:03:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Temp
[2011.04.28 19:11:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\.minecraft
[2011.03.05 14:02:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Atari
[2012.06.24 14:55:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\DesktopIconForAmazon
[2012.04.11 18:11:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\DVDVideoSoft
[2011.09.25 13:40:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Garmin
[2011.07.30 22:56:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\HLSW
[2011.02.19 12:49:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Leadertech
[2012.05.14 18:20:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\mkvtoolnix
[2011.07.14 11:37:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\MP3SkypeRecorder
[2011.09.08 17:39:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Music Editor Free
[2011.10.31 11:07:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\MyPhoneExplorer
[2011.04.19 19:31:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\SharePod
[2011.10.30 15:29:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\Sony
[2012.07.03 21:46:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\TeamViewer
[2011.08.03 10:56:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\ts3overlay
[2011.10.16 21:02:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Sahira\Anwendungsdaten\UDC Profiles
========== Purity Check ==========
========== Files - Unicode (All) ==========
Einstellungen\Sahira\Eigene Dateien\S????G? - SFERA 102. -- C:\Dokumente und Einstellungen\Sahira\Eigene Dateien\ΣΥΛΛΟΓΗ - SFERA 102. [2012.01.22 15:33:14 | 000,000,000 | ---D | M](C:\Dokumente und Einstellungen\Sahira\Eigene Dateien\S????G? - SFERA 102 -- C:\Dokumente und Einstellungen\Sahira\Eigene Dateien\ΣΥΛΛΟΓΗ - SFERA 102.)
< End of report >
Extra.txt: Code:
OTL Extras logfile created on: 07.07.2012 13:38:33 - Run 1
OTL by OldTimer - Version 3.2.53.1 Folder = C:\Dokumente und Einstellungen\Sahira\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,52 Gb Available Physical Memory | 76,10% Memory free
3,85 Gb Paging File | 3,41 Gb Available in Paging File | 88,49% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 127,99 Gb Total Space | 27,52 Gb Free Space | 21,50% Space Free | Partition Type: NTFS
Drive E: | 803,52 Gb Total Space | 693,17 Gb Free Space | 86,27% Space Free | Partition Type: NTFS
Computer Name: LYLA | User Name: Sahira | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Steam\Steam.exe" = C:\Programme\Steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"C:\Programme\QIP 2010\qip.exe" = C:\Programme\QIP 2010\qip.exe:*:Enabled:QIP 2010 -- (QIP)
"C:\Programme\Skype\Plugin Manager\skypePM.exe" = C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Programme\TechniSat DVB\bin\Server4PC.exe" = C:\Programme\TechniSat DVB\bin\Server4PC.exe:*:Disabled:Server4PC -- (B2C2, Inc.)
"E:\Daten 2010\Daten\SIERRA\Half-Life\hl.exe" = E:\Daten 2010\Daten\SIERRA\Half-Life\hl.exe:*:Enabled:Half-Life Launcher
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Logitech\Vid HD\Vid.exe" = C:\Programme\Logitech\Vid HD\Vid.exe:*:Enabled:Logitech Vid HD -- (Logitech Inc.)
"C:\Programme\HLSW\hlsw.exe" = C:\Programme\HLSW\hlsw.exe:*:Enabled:HLSW Application
"C:\UT2004\System\UT2004.exe" = C:\UT2004\System\UT2004.exe:*:Enabled:UT2004 -- ()
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Programme\EA Games\Command and Conquer Generäle\game.dat" = C:\Programme\EA Games\Command and Conquer Generäle\game.dat:*:Enabled:game
"C:\Programme\EA Games\Command and Conquer Generäle\patchget.dat" = C:\Programme\EA Games\Command and Conquer Generäle\patchget.dat:*:Enabled:patchgrabber
"C:\Programme\accordiva\SecuExpress 2 Deluxe\VideoServer.exe" = C:\Programme\accordiva\SecuExpress 2 Deluxe\VideoServer.exe:*:Enabled:VideoServer
"C:\Programme\accordiva\SecuExpress 2 Deluxe\SecuWatcher.exe" = C:\Programme\accordiva\SecuExpress 2 Deluxe\SecuWatcher.exe:*:Enabled:SecuWatcher
"C:\Programme\Steam\SteamApps\blazyng\counter-strike\hl.exe" = C:\Programme\Steam\SteamApps\blazyng\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve)
"C:\Programme\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe" = C:\Programme\Sony Ericsson\Update Engine\Sony Ericsson Update Engine.exe:*:Enabled:Update Engine -- ()
"C:\Dokumente und Einstellungen\Sahira\Desktop\Diablo-III-Setup-deDE.exe" = C:\Dokumente und Einstellungen\Sahira\Desktop\Diablo-III-Setup-deDE.exe:*:Enabled:Blizzard Downloader
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.524\Agent.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.524\Agent.exe:*:Enabled:Blizzard Agent -- (Blizzard Entertainment)
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.954\Agent.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.954\Agent.exe:*:Enabled:Blizzard Agent
"C:\Programme\Diablo III\Diablo III.exe" = C:\Programme\Diablo III\Diablo III.exe:*:Enabled:Diablo III -- (Blizzard Entertainment)
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.976\Agent.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.976\Agent.exe:*:Enabled:Blizzard Agent
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.998\Agent.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.998\Agent.exe:*:Enabled:Blizzard Agent -- (Blizzard Entertainment)
"C:\Programme\Steam\SteamApps\bestgabber@web.de\counter-strike\hl.exe" = C:\Programme\Steam\SteamApps\bestgabber@web.de\counter-strike\hl.exe:*:Enabled:Counter-Strike -- (Valve)
"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.1040\Agent.exe" = C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Battle.net\Agent\Agent.1040\Agent.exe:*:Enabled:Blizzard Agent -- (Blizzard Entertainment)
"C:\Programme\Klebezettel NG\klebez.exe" = C:\Programme\Klebezettel NG\klebez.exe:*:Enabled:Elektronische Haftnotizen für Windows
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5
"{02F0B8AE-7501-4333-AFBE-6BAABFEC7637}" = WISO Steuer-Sparbuch 2011
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{167A1F6A-9BF2-4B24-83DB-C6D659F680EA}" = Media Go
"{1CE60928-8325-49A8-8B06-633E48DD2B67}" = Cisco Systems VPN Client 5.0.07.0410
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6DED41BC-C9EF-4330-B4E5-46CB2C5C6E2D}" = No23 Recorder
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{793FCE60-DE5E-4977-A942-A7B69A45B17D}" = MainConcept DTV Decoder Pro
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE9F9FBC-5253-46D2-9883-09E55003D794}" = TechniSat DVB-PC TV Star
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D6D5CB84-0E6E-4E69-B300-C690B6911031}" = Nero 8 Classic Edition
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.053
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"Diablo III" = Diablo III
"FormatFactory" = FormatFactory 2.95
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam 5
"Logitech Vid" = Logitech Vid HD
"lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"No23 Recorder" = No23 Recorder
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"ProgDVB" = ProgDVB
"QuickTime" = QuickTime
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"Security Task Manager" = Security Task Manager 1.8d
"Steam App 10" = Counter-Strike
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TechniSat DVB Receiver" = TechniSat DVB Receiver
"The Rosetta Stone" = The Rosetta Stone
"Update Engine" = Sony Ericsson Update Engine
"VLC media player" = VLC media player 1.1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xp-AntiSpy" = xp-AntiSpy 3.97-10
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QIP 2010" = QIP 2010 3.1.5890
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 30.08.2011 12:51:48 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000671f.
Error - 30.08.2011 12:52:10 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000673a.
Error - 30.08.2011 13:12:29 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000673a.
Error - 30.08.2011 13:13:11 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000673a.
Error - 18.09.2011 12:51:26 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000671f.
Error - 18.09.2011 12:52:10 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000673a.
Error - 18.09.2011 12:53:27 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung therosettastone.exe, Version 9.0.0.383,
fehlgeschlagenes Modul iml32.dll, Version 8.5.1.104, Fehleradresse 0x0000673a.
Error - 25.09.2011 07:45:40 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 6.0.2.4262,
fehlgeschlagenes Modul npgarmin.dll, Version 3.0.1.0, Fehleradresse 0x004a9f08.
Error - 25.09.2011 08:10:39 | Computer Name = LYLA | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 6.0.2.4262,
fehlgeschlagenes Modul npgarmin.dll, Version 3.0.1.0, Fehleradresse 0x004aa177.
[ System Events ]
Error - 07.07.2012 05:53:59 | Computer Name = LYLA | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 07.07.2012 06:20:07 | Computer Name = LYLA | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 07.07.2012 06:20:07 | Computer Name = LYLA | Source = Service Control Manager | ID = 7034
Description = Dienst "Cisco Systems, Inc. VPN Service" wurde unerwartet beendet.
Dies ist bereits 1 Mal passiert.
Error - 07.07.2012 06:20:07 | Computer Name = LYLA | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 07.07.2012 06:20:07 | Computer Name = LYLA | Source = Service Control Manager | ID = 7034
Description = Dienst "Process Monitor" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 07.07.2012 06:22:06 | Computer Name = LYLA | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 07.07.2012 06:22:06 | Computer Name = LYLA | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 07.07.2012 07:25:27 | Computer Name = LYLA | Source = sr | ID = 1
Description = Beim Verarbeiten der Datei "" auf Volume "HarddiskVolume1" ist im
Wiederherstellungsfilter der unerwartete Fehler "0xC0000001" aufgetreten. Die Volumeüberwachung
wurde angehalten.
Error - 07.07.2012 07:25:27 | Computer Name = LYLA | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
Error - 07.07.2012 07:25:27 | Computer Name = LYLA | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "E:" aus.
< End of report >
|
