OTL Logfile: Code:
OTL logfile created on: 05.12.2012 09:25:45 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Christia\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
1023,55 Mb Total Physical Memory | 433,54 Mb Available Physical Memory | 42,36% Memory free
2,00 Gb Paging File | 1,02 Gb Available in Paging File | 50,77% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,98 Gb Total Space | 23,62 Gb Free Space | 59,09% Space Free | Partition Type: NTFS
Drive D: | 34,54 Gb Total Space | 32,11 Gb Free Space | 92,98% Space Free | Partition Type: NTFS
Drive E: | 60,72 Gb Total Space | 10,71 Gb Free Space | 17,63% Space Free | Partition Type: NTFS
Drive F: | 70,20 Gb Total Space | 1,03 Gb Free Space | 1,47% Space Free | Partition Type: NTFS
Drive G: | 19,91 Gb Total Space | 11,92 Gb Free Space | 59,88% Space Free | Partition Type: NTFS
Drive M: | 2,55 Gb Total Space | 2,51 Gb Free Space | 98,43% Space Free | Partition Type: NTFS
Computer Name: CHRISTIAN | User Name: Christia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Christia\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_287.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
========== Modules (No Company Name) ==========
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
========== Services (SafeList) ==========
SRV - (SBSDWSCService) -- C:\Program Files\Spybot File not found
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (nvUpdatusService) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (dc3d) -- C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (nvmpu401) -- C:\Windows\System32\drivers\nvmpu401.sys (NVIDIA Corporation)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = Certified-Toolbar Search
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0500DF46-74B0-399A-B6E3-5ABF0F6B5226}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtCtC0DzzzytD0A0AyC0A0B0A0DyDtN0D0Tzu0CtAtCzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1681310637
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = blekko | spam-free search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 B7 1C 67 77 B1 C2 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = Certified-Toolbar Search
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0500DF46-74B0-399A-B6E3-5ABF0F6B5226}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{08DE07EB-8AB5-4D4D-8590-3B7440F8D876}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=IMB&o=15785&src=kw&q={searchTerms}&locale=&apn_ptnrs=HQ&apn_dtid=YYYYYYYYDE&apn_uid=08266cf2-fa01-4870-9957-6f5f53797369&apn_sauid=5484181B-6A05-48ED-B1B5-0212DA780BD0
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110824&tt=4612_5&babsrc=SP_ss&mntrId=f8ebbad50000000000000011d890aa6a
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2003.01.01 09:52:59 | 000,000,000 | ---D | M]
[2003.01.01 09:54:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christia\AppData\Roaming\mozilla\Extensions
[2012.11.26 12:29:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christia\AppData\Roaming\mozilla\Firefox\Profiles\1p8naavs.default\extensions
[2012.11.26 12:12:49 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Christia\AppData\Roaming\mozilla\Firefox\Profiles\1p8naavs.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2003.01.01 09:52:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.10.24 18:50:04 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.14 14:29:42 | 000,002,349 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.06 17:07:51 | 000,003,269 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
[2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A3235089-283E-444C-A918-8C8BA5B92105}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.11.27 10:02:25 | 000,000,000 | ---D | M] - D:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2012.11.14 16:03:46 | 209,715,200 | ---- | M] () - G:\Auto.part01.rar -- [ NTFS ]
O32 - AutoRun File - [2012.11.14 18:26:58 | 027,994,892 | ---- | M] () - G:\Auto.part02.rar.part -- [ NTFS ]
O33 - MountPoints2\{888105b4-1d63-11d7-95bb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{888105b4-1d63-11d7-95bb-806e6f6e6963}\Shell\AutoRun\command - "" = H:\Setup.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\ASUSACPI.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.11.30 13:37:09 | 000,000,000 | ---D | C] -- C:\Users\Christia\Documents\Simply Super Software
[2012.11.29 16:36:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Diagnostics
[2012.11.29 16:36:17 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.11.29 16:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2012.11.29 16:28:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2012.11.29 16:28:45 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2012.11.29 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Simply Super Software
[2012.11.29 16:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.11.29 16:17:49 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.11.29 16:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.11.29 11:17:43 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.11.29 11:17:43 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.11.29 11:10:39 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.11.29 11:10:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011
[2012.11.29 11:09:55 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2011
[2012.11.29 11:03:35 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.11.29 10:11:54 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\TuneUp Software
[2012.11.29 10:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.11.27 17:53:44 | 000,000,000 | -HSD | C] -- C:\found.000
[2012.11.27 14:13:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Malwarebytes
[2012.11.27 14:12:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.11.27 14:12:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.27 14:12:47 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.11.27 14:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.11.27 11:44:42 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.11.26 12:18:40 | 000,000,000 | ---D | C] -- C:\Users\Christia\dwhelper
[2012.11.26 10:25:13 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\ProgSense
[2012.11.26 10:25:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Orbit
[2012.11.26 10:25:00 | 000,000,000 | ---D | C] -- C:\Program Files\Orbitdownloader
[2012.11.26 10:22:09 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Orbit
[2012.11.24 12:32:35 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.11.16 10:48:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Adobe
[2012.11.16 10:38:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.11.16 10:38:34 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.11.16 08:40:21 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2012.11.16 08:40:21 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2012.11.16 08:39:05 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2012.11.16 08:39:04 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2012.11.16 08:39:04 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2012.11.16 08:37:44 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.11.16 08:37:41 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.11.16 08:37:40 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.11.16 08:37:40 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.11.16 08:37:40 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.11.16 08:37:36 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.11.16 08:37:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.11.16 08:37:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.11.16 08:35:38 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.11.16 08:34:30 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncsi.dll
[2012.11.16 08:34:29 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcorehc.dll
[2012.11.16 08:34:29 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2012.11.16 08:34:19 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2012.11.16 08:34:15 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcore6.dll
[2012.11.16 08:34:15 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2012.11.15 09:08:21 | 000,000,000 | ---D | C] -- C:\Program Files\Red Sky
[2012.11.15 09:01:04 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.11.15 08:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012.11.15 08:05:12 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Autodesk
[2012.11.15 08:01:02 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll
[2012.11.15 08:01:02 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll
[2012.11.15 08:01:01 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2012.11.15 08:00:48 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2012.11.15 07:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
[2012.11.15 07:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Autodesk Shared
[2012.11.14 20:01:46 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Autodesk
[2012.11.14 20:01:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Autodesk
[2012.11.14 14:40:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.11.14 14:39:50 | 000,746,984 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.11.14 14:39:49 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.11.14 14:32:26 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Google
[2012.11.14 14:32:00 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader
[2012.11.14 14:09:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.11.14 11:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader 2
[2012.11.14 11:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\i4j_jres
[2012.11.09 09:41:13 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.11.08 09:38:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.11.07 11:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.11.07 11:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.11.07 11:25:59 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012.11.07 07:37:18 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2012.11.07 07:37:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\.swt
[2012.11.07 07:12:14 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.11.06 20:50:34 | 000,000,000 | ---D | C] -- C:\TEMP
[2012.11.06 19:12:24 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.11.06 18:44:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ANNO 1503
[2012.11.06 18:41:13 | 000,000,000 | ---D | C] -- C:\Program Files\Alcohol Soft
[2012.11.06 18:32:28 | 000,436,792 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\System32\drivers\sptd.sys
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\WinRAR
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.11.06 18:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.11.06 17:50:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.11.06 17:36:39 | 000,000,000 | ---D | C] -- C:\Downloads
[2012.11.06 17:06:16 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\DownTango
[2012.11.06 15:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.11.06 15:23:25 | 007,697,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll
[2012.11.06 15:23:24 | 001,867,112 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll
[2012.11.06 15:23:23 | 002,574,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll
[2012.11.06 15:23:22 | 010,837,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys
[2012.11.06 15:23:22 | 000,888,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispgenco32.dll
[2012.11.06 15:23:13 | 001,009,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco32.dll
[2012.11.06 15:23:12 | 019,906,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll
[2012.11.06 15:23:11 | 015,309,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll
[2012.11.06 15:23:10 | 006,127,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvopencl.dll
[2012.11.06 15:23:09 | 017,559,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll
[2012.11.06 14:43:39 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2012.11.06 14:43:38 | 000,888,424 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco322050.dll
[2012.11.06 14:43:38 | 000,813,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco322030.dll
[2012.11.06 14:43:34 | 002,428,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll
[2012.11.06 14:43:34 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd
[2012.11.06 12:55:12 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.11.06 12:52:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2012.11.06 12:52:07 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rdpvideominiport.sys
[2012.11.06 12:52:00 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2012.11.06 12:52:00 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RdpGroupPolicyExtension.dll
[2012.11.06 12:51:59 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\TsUsbFlt.sys
[2012.11.06 12:51:52 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprt.exe
[2012.11.06 12:51:52 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2012.11.06 12:51:52 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpudd.dll
[2012.11.06 12:51:52 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpendp_winip.dll
[2012.11.06 12:51:52 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSWbPrxy.exe
[2012.11.06 12:51:52 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsRdpWebAccess.dll
[2012.11.06 12:51:52 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2012.11.06 12:51:52 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbGDCoInstaller.dll
[2012.11.06 12:51:52 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprtPS.dll
[2012.11.06 12:51:51 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.12.05 09:08:31 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.05 09:08:31 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.05 09:00:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.12.05 09:00:01 | 804,954,112 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.04 21:46:03 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.30 11:21:03 | 000,029,875 | ---- | M] () -- C:\Users\Christia\Documents\Log.zip
[2012.11.30 10:30:32 | 000,000,020 | ---- | M] () -- C:\Users\Christia\defogger_reenable
[2012.11.30 08:24:46 | 000,001,274 | ---- | M] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.11.30 08:24:46 | 000,001,250 | ---- | M] () -- C:\Users\Christia\Desktop\Spybot - Search & Destroy.lnk
[2012.11.29 11:10:27 | 000,002,159 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.11.29 11:10:27 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.11.27 14:12:50 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.27 10:05:01 | 000,000,017 | ---- | M] () -- C:\Users\Christia\AppData\Local\resmon.resmoncfg
[2012.11.27 09:32:13 | 000,651,768 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.27 09:32:13 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.27 09:32:13 | 000,129,468 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.27 09:32:13 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.26 10:25:08 | 000,001,037 | ---- | M] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Orbit.lnk
[2012.11.26 09:52:27 | 000,003,159 | ---- | M] () -- C:\Users\Christia\Documents\Rock.wpl
[2012.11.18 13:53:42 | 000,340,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.16 14:19:45 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2012.11.16 14:19:45 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2012.11.16 14:19:45 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2012.11.15 09:08:20 | 000,000,014 | ---- | M] () -- C:\end
[2012.11.15 08:09:50 | 000,001,667 | ---- | M] () -- C:\Users\Public\Desktop\AutoCAD 2011 - Deutsch.lnk
[2012.11.14 14:38:24 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.11.14 14:38:24 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.11.14 14:32:12 | 000,290,500 | ---- | M] () -- C:\Users\Christia\AppData\Local\funmoods-speeddial_sf.crx
[2012.11.09 10:50:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.11.09 09:43:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.11.09 09:43:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.11.30 11:21:02 | 000,029,875 | ---- | C] () -- C:\Users\Christia\Documents\Log.zip
[2012.11.30 10:30:06 | 000,000,020 | ---- | C] () -- C:\Users\Christia\defogger_reenable
[2012.11.29 11:10:27 | 000,002,159 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.11.29 11:10:27 | 000,002,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk
[2012.11.29 11:10:27 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.11.27 14:14:47 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2012.11.27 14:12:50 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.27 10:05:01 | 000,000,017 | ---- | C] () -- C:\Users\Christia\AppData\Local\resmon.resmoncfg
[2012.11.26 10:25:08 | 000,001,037 | ---- | C] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Orbit.lnk
[2012.11.26 09:50:59 | 000,003,159 | ---- | C] () -- C:\Users\Christia\Documents\Rock.wpl
[2012.11.16 10:39:25 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2012.11.16 08:40:29 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.16 08:39:03 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.15 08:09:50 | 000,001,667 | ---- | C] () -- C:\Users\Public\Desktop\AutoCAD 2011 - Deutsch.lnk
[2012.11.14 14:32:29 | 000,290,500 | ---- | C] () -- C:\Users\Christia\AppData\Local\funmoods-speeddial_sf.crx
[2012.11.09 10:50:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.11.09 09:43:00 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.11.09 09:43:00 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.11.07 11:26:09 | 000,001,274 | ---- | C] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.11.07 11:26:09 | 000,001,250 | ---- | C] () -- C:\Users\Christia\Desktop\Spybot - Search & Destroy.lnk
[2012.11.06 17:07:27 | 000,015,432 | ---- | C] () -- C:\Windows\Launcher.exe
[2012.11.06 17:06:10 | 000,000,014 | ---- | C] () -- C:\end
[2012.11.06 15:23:08 | 000,012,865 | ---- | C] () -- C:\Windows\System32\nvinfo.pb
[2012.11.03 18:30:17 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.11.03 18:27:38 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
========== ZeroAccess Check ==========
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2012.11.15 09:10:14 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Autodesk
[2012.11.26 15:01:24 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Orbit
[2012.11.26 10:25:13 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\ProgSense
[2012.11.29 16:18:01 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Simply Super Software
[2012.11.29 11:10:07 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\TuneUp Software
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:CB0AACC9
< End of report >
--- --- ---
OTL Log
hallo, hoffe das ist so richtig
zuerst kommt der aktuellste OTL Log, Extra Log
oben der Log con OTL ist etwas älter, dieser heir ist aktuell!!!!
Danke
OTL Logfile: Code:
OTL logfile created on: 05.12.2012 11:01:39 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Christia\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
1023,55 Mb Total Physical Memory | 426,75 Mb Available Physical Memory | 41,69% Memory free
2,00 Gb Paging File | 1,25 Gb Available in Paging File | 62,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,98 Gb Total Space | 23,70 Gb Free Space | 59,29% Space Free | Partition Type: NTFS
Drive D: | 34,54 Gb Total Space | 32,11 Gb Free Space | 92,98% Space Free | Partition Type: NTFS
Drive E: | 60,72 Gb Total Space | 10,71 Gb Free Space | 17,63% Space Free | Partition Type: NTFS
Drive F: | 70,20 Gb Total Space | 1,03 Gb Free Space | 1,47% Space Free | Partition Type: NTFS
Drive G: | 19,91 Gb Total Space | 11,92 Gb Free Space | 59,88% Space Free | Partition Type: NTFS
Drive M: | 2,55 Gb Total Space | 2,51 Gb Free Space | 98,43% Space Free | Partition Type: NTFS
Computer Name: CHRISTIAN | User Name: Christia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Christia\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\program files\avira\antivir desktop\ipmGui.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe (TuneUp Software)
PRC - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
========== Modules (No Company Name) ==========
========== Services (SafeList) ==========
SRV - (SBSDWSCService) -- C:\Program Files\Spybot File not found
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (nvUpdatusService) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (VGPU) -- System32\drivers\rdvgkmd.sys File not found
DRV - (tsusbhub) -- system32\drivers\tsusbhub.sys File not found
DRV - (Synth3dVsc) -- System32\drivers\synth3dvsc.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira Operations GmbH & Co. KG)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira Operations GmbH & Co. KG)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira Operations GmbH & Co. KG)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys ()
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (RdpVideoMiniport) -- C:\Windows\System32\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (dc3d) -- C:\Windows\System32\drivers\dc3d.sys (Microsoft Corporation)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys (TuneUp Software)
DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (ALCXWDM) -- C:\Windows\System32\drivers\RTKVAC.SYS (Realtek Semiconductor Corp.)
DRV - (nvmpu401) -- C:\Windows\System32\drivers\nvmpu401.sys (NVIDIA Corporation)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ASACPI.sys ()
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = Certified-Toolbar Search
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = Certified-Toolbar Search
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0500DF46-74B0-399A-B6E3-5ABF0F6B5226}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=ironpub&chnl=ironpub&cd=2XzuyEtN2Y1L1QzutDtDtCtC0DzzzytD0A0AyC0A0B0A0DyDtN0D0Tzu0CtAtCzytN1L2XzutBtFtBtFtDtFtAyEyE&cr=1681310637
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = blekko | spam-free search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Hotmail, Skype Download und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 B7 1C 67 77 B1 C2 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = Certified-Toolbar Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = Certified-Toolbar Search
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0500DF46-74B0-399A-B6E3-5ABF0F6B5226}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{08DE07EB-8AB5-4D4D-8590-3B7440F8D876}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=IMB&o=15785&src=kw&q={searchTerms}&locale=&apn_ptnrs=HQ&apn_dtid=YYYYYYYYDE&apn_uid=08266cf2-fa01-4870-9957-6f5f53797369&apn_sauid=5484181B-6A05-48ED-B1B5-0212DA780BD0
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=110824&tt=4612_5&babsrc=SP_ss&mntrId=f8ebbad50000000000000011d890aa6a
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.certified-toolbar.com?si=41460&bs=true&tid=2937&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_287.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2003.01.01 09:52:59 | 000,000,000 | ---D | M]
[2003.01.01 09:54:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christia\AppData\Roaming\mozilla\Extensions
[2012.11.26 12:29:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Christia\AppData\Roaming\mozilla\Firefox\Profiles\1p8naavs.default\extensions
[2012.11.26 12:12:49 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Christia\AppData\Roaming\mozilla\Firefox\Profiles\1p8naavs.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2003.01.01 09:52:59 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.10.24 18:50:04 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.10.24 23:03:12 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.11.14 14:29:42 | 000,002,349 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2012.10.24 23:03:11 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.10.24 23:03:12 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.10.24 23:03:12 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.11.06 17:07:51 | 000,003,269 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Web Search.xml
[2012.10.24 23:03:12 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.10.24 23:03:11 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A3235089-283E-444C-A918-8C8BA5B92105}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2012.11.27 10:02:25 | 000,000,000 | ---D | M] - D:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2012.11.14 16:03:46 | 209,715,200 | ---- | M] () - G:\Auto.part01.rar -- [ NTFS ]
O32 - AutoRun File - [2012.11.14 18:26:58 | 027,994,892 | ---- | M] () - G:\Auto.part02.rar.part -- [ NTFS ]
O33 - MountPoints2\{888105b4-1d63-11d7-95bb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{888105b4-1d63-11d7-95bb-806e6f6e6963}\Shell\AutoRun\command - "" = H:\Setup.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\ASUSACPI.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.12.05 09:52:21 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.11.30 13:37:09 | 000,000,000 | ---D | C] -- C:\Users\Christia\Documents\Simply Super Software
[2012.11.29 16:36:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Diagnostics
[2012.11.29 16:36:17 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.11.29 16:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2012.11.29 16:28:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2012.11.29 16:28:45 | 000,000,000 | ---D | C] -- C:\Program Files\Security Task Manager
[2012.11.29 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Simply Super Software
[2012.11.29 16:17:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.11.29 16:17:49 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.11.29 16:17:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.11.29 11:17:43 | 000,029,504 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2012.11.29 11:17:43 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2012.11.29 11:10:39 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2012.11.29 11:10:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011
[2012.11.29 11:09:55 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2011
[2012.11.29 11:03:35 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2012.11.29 10:11:54 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\TuneUp Software
[2012.11.29 10:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2012.11.27 17:53:44 | 000,000,000 | -HSD | C] -- C:\found.000
[2012.11.27 14:13:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Malwarebytes
[2012.11.27 14:12:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.11.27 14:12:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.11.27 14:12:47 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.11.27 14:12:46 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.11.27 11:44:42 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.11.26 12:18:40 | 000,000,000 | ---D | C] -- C:\Users\Christia\dwhelper
[2012.11.26 10:25:13 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\ProgSense
[2012.11.26 10:25:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Orbit
[2012.11.26 10:25:00 | 000,000,000 | ---D | C] -- C:\Program Files\Orbitdownloader
[2012.11.26 10:22:09 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Orbit
[2012.11.24 12:32:35 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.11.16 10:48:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Adobe
[2012.11.16 10:38:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2012.11.16 10:38:34 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2012.11.16 08:40:21 | 000,047,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfLdr.sys
[2012.11.16 08:40:21 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Wdfres.dll
[2012.11.16 08:39:05 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFPlatform.dll
[2012.11.16 08:39:04 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFx.dll
[2012.11.16 08:39:04 | 000,038,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WUDFCoinstaller.dll
[2012.11.16 08:37:44 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.11.16 08:37:41 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.11.16 08:37:40 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.11.16 08:37:40 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.11.16 08:37:40 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.11.16 08:37:36 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.11.16 08:37:36 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.11.16 08:37:33 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.11.16 08:35:38 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.11.16 08:34:30 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncsi.dll
[2012.11.16 08:34:29 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netcorehc.dll
[2012.11.16 08:34:29 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\netevent.dll
[2012.11.16 08:34:19 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\synceng.dll
[2012.11.16 08:34:15 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcore6.dll
[2012.11.16 08:34:15 | 000,044,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dhcpcsvc6.dll
[2012.11.15 09:08:21 | 000,000,000 | ---D | C] -- C:\Program Files\Red Sky
[2012.11.15 09:01:04 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.11.15 08:11:08 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Macrovision Shared
[2012.11.15 08:05:12 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Autodesk
[2012.11.15 08:01:02 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll
[2012.11.15 08:01:02 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll
[2012.11.15 08:01:01 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll
[2012.11.15 08:00:48 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll
[2012.11.15 07:59:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
[2012.11.15 07:58:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Autodesk Shared
[2012.11.14 20:01:46 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Autodesk
[2012.11.14 20:01:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Autodesk
[2012.11.14 14:40:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.11.14 14:39:50 | 000,746,984 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.11.14 14:39:49 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.11.14 14:32:26 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\Google
[2012.11.14 14:32:00 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader
[2012.11.14 14:09:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012.11.14 11:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\JDownloader 2
[2012.11.14 11:10:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\i4j_jres
[2012.11.09 09:41:13 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM
[2012.11.08 09:38:25 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012.11.07 11:26:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012.11.07 11:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2012.11.07 11:25:59 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2012.11.07 07:37:18 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2012.11.07 07:37:02 | 000,000,000 | ---D | C] -- C:\Users\Christia\.swt
[2012.11.07 07:12:14 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2012.11.06 20:50:34 | 000,000,000 | ---D | C] -- C:\TEMP
[2012.11.06 19:12:24 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
[2012.11.06 18:44:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ANNO 1503
[2012.11.06 18:41:13 | 000,000,000 | ---D | C] -- C:\Program Files\Alcohol Soft
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\WinRAR
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.11.06 18:11:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2012.11.06 18:11:27 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
[2012.11.06 17:50:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.11.06 17:36:39 | 000,000,000 | ---D | C] -- C:\Downloads
[2012.11.06 17:06:16 | 000,000,000 | ---D | C] -- C:\Users\Christia\AppData\Local\DownTango
[2012.11.06 15:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2012.11.06 15:23:25 | 007,697,768 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll
[2012.11.06 15:23:24 | 001,867,112 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll
[2012.11.06 15:23:23 | 002,574,696 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll
[2012.11.06 15:23:22 | 010,837,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys
[2012.11.06 15:23:22 | 000,888,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispgenco32.dll
[2012.11.06 15:23:13 | 001,009,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco32.dll
[2012.11.06 15:23:12 | 019,906,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll
[2012.11.06 15:23:11 | 015,309,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll
[2012.11.06 15:23:10 | 006,127,464 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvopencl.dll
[2012.11.06 15:23:09 | 017,559,912 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll
[2012.11.06 14:43:39 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll
[2012.11.06 14:43:38 | 000,888,424 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco322050.dll
[2012.11.06 14:43:38 | 000,813,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco322030.dll
[2012.11.06 14:43:34 | 002,428,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll
[2012.11.06 14:43:34 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd
[2012.11.06 12:55:12 | 000,000,000 | ---D | C] -- C:\NVIDIA
[2012.11.06 12:52:10 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe
[2012.11.06 12:52:07 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\rdpvideominiport.sys
[2012.11.06 12:52:00 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll
[2012.11.06 12:52:00 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RdpGroupPolicyExtension.dll
[2012.11.06 12:51:59 | 000,049,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\TsUsbFlt.sys
[2012.11.06 12:51:52 | 000,317,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprt.exe
[2012.11.06 12:51:52 | 000,269,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\aaclient.dll
[2012.11.06 12:51:52 | 000,221,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpudd.dll
[2012.11.06 12:51:52 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpendp_winip.dll
[2012.11.06 12:51:52 | 000,056,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TSWbPrxy.exe
[2012.11.06 12:51:52 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MsRdpWebAccess.dll
[2012.11.06 12:51:52 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tsgqec.dll
[2012.11.06 12:51:52 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\TsUsbGDCoInstaller.dll
[2012.11.06 12:51:52 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wksprtPS.dll
[2012.11.06 12:51:51 | 002,739,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorets.dll
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.12.05 11:04:26 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.05 11:04:26 | 000,020,480 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.05 10:55:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.12.05 10:55:28 | 804,954,112 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.05 10:46:07 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.12.05 09:52:21 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.11.30 11:21:03 | 000,029,875 | ---- | M] () -- C:\Users\Christia\Documents\Log.zip
[2012.11.30 08:24:46 | 000,001,274 | ---- | M] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.11.30 08:24:46 | 000,001,250 | ---- | M] () -- C:\Users\Christia\Desktop\Spybot - Search & Destroy.lnk
[2012.11.29 11:10:27 | 000,002,159 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.11.29 11:10:27 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.11.27 14:12:50 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.27 10:05:01 | 000,000,017 | ---- | M] () -- C:\Users\Christia\AppData\Local\resmon.resmoncfg
[2012.11.27 09:32:13 | 000,651,768 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.11.27 09:32:13 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.11.27 09:32:13 | 000,129,468 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.11.27 09:32:13 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.11.26 10:25:08 | 000,001,037 | ---- | M] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Orbit.lnk
[2012.11.26 09:52:27 | 000,003,159 | ---- | M] () -- C:\Users\Christia\Documents\Rock.wpl
[2012.11.18 13:53:42 | 000,340,384 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.11.16 14:19:45 | 000,133,824 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avipbb.sys
[2012.11.16 14:19:45 | 000,083,432 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avgntflt.sys
[2012.11.16 14:19:45 | 000,036,552 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\System32\drivers\avkmgr.sys
[2012.11.15 09:08:20 | 000,000,014 | ---- | M] () -- C:\end
[2012.11.15 08:09:50 | 000,001,667 | ---- | M] () -- C:\Users\Public\Desktop\AutoCAD 2011 - Deutsch.lnk
[2012.11.14 14:38:24 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll
[2012.11.14 14:38:24 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.11.14 14:32:12 | 000,290,500 | ---- | M] () -- C:\Users\Christia\AppData\Local\funmoods-speeddial_sf.crx
[2012.11.09 10:50:52 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.11.09 09:43:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2012.11.09 09:43:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.11.30 11:21:02 | 000,029,875 | ---- | C] () -- C:\Users\Christia\Documents\Log.zip
[2012.11.29 11:10:27 | 000,002,159 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2012.11.29 11:10:27 | 000,002,151 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2011.lnk
[2012.11.29 11:10:27 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2011.lnk
[2012.11.27 14:14:47 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2012.11.27 14:12:50 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.11.27 10:05:01 | 000,000,017 | ---- | C] () -- C:\Users\Christia\AppData\Local\resmon.resmoncfg
[2012.11.26 10:25:08 | 000,001,037 | ---- | C] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Orbit.lnk
[2012.11.26 09:50:59 | 000,003,159 | ---- | C] () -- C:\Users\Christia\Documents\Rock.wpl
[2012.11.16 10:39:25 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2012.11.16 08:40:29 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.16 08:39:03 | 000,000,003 | ---- | C] () -- C:\Windows\System32\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.15 08:09:50 | 000,001,667 | ---- | C] () -- C:\Users\Public\Desktop\AutoCAD 2011 - Deutsch.lnk
[2012.11.14 14:32:29 | 000,290,500 | ---- | C] () -- C:\Users\Christia\AppData\Local\funmoods-speeddial_sf.crx
[2012.11.09 10:50:52 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2012.11.09 09:43:00 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2012.11.09 09:43:00 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2012.11.07 11:26:09 | 000,001,274 | ---- | C] () -- C:\Users\Christia\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot - Search & Destroy.lnk
[2012.11.07 11:26:09 | 000,001,250 | ---- | C] () -- C:\Users\Christia\Desktop\Spybot - Search & Destroy.lnk
[2012.11.06 17:07:27 | 000,015,432 | ---- | C] () -- C:\Windows\Launcher.exe
[2012.11.06 17:06:10 | 000,000,014 | ---- | C] () -- C:\end
[2012.11.06 15:23:08 | 000,012,865 | ---- | C] () -- C:\Windows\System32\nvinfo.pb
[2012.11.03 18:30:17 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2012.11.03 18:27:38 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
========== ZeroAccess Check ==========
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2012.11.15 09:10:14 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Autodesk
[2012.11.26 15:01:24 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Orbit
[2012.11.26 10:25:13 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\ProgSense
[2012.11.29 16:18:01 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\Simply Super Software
[2012.11.29 11:10:07 | 000,000,000 | ---D | M] -- C:\Users\Christia\AppData\Roaming\TuneUp Software
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:CB0AACC9
< End of report >
--- --- ---
Extra Log
OTL EXTRAS Logfile: Code:
OTL Extras logfile created on: 05.12.2012 11:01:39 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Christia\Downloads
Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
1023,55 Mb Total Physical Memory | 426,75 Mb Available Physical Memory | 41,69% Memory free
2,00 Gb Paging File | 1,25 Gb Available in Paging File | 62,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 39,98 Gb Total Space | 23,70 Gb Free Space | 59,29% Space Free | Partition Type: NTFS
Drive D: | 34,54 Gb Total Space | 32,11 Gb Free Space | 92,98% Space Free | Partition Type: NTFS
Drive E: | 60,72 Gb Total Space | 10,71 Gb Free Space | 17,63% Space Free | Partition Type: NTFS
Drive F: | 70,20 Gb Total Space | 1,03 Gb Free Space | 1,47% Space Free | Partition Type: NTFS
Drive G: | 19,91 Gb Total Space | 11,92 Gb Free Space | 59,88% Space Free | Partition Type: NTFS
Drive M: | 2,55 Gb Total Space | 2,51 Gb Free Space | 98,43% Space Free | Partition Type: NTFS
Computer Name: CHRISTIAN | User Name: Christia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{29374356-7A98-416B-81FC-8DB85583A20B}" = dir=out | app=c:\program files\protected search\protectedsearch.exe |
"{4A53C8F9-276B-4316-833E-D28378DBBAFE}" = dir=in | app=c:\program files\protected search\protectedsearch.exe |
"{509BBE4E-F138-4666-ABA3-AACF19FF0E4A}" = dir=in | app=c:\program files\protected search\protectedsearch.exe |
"{A638FEAC-B2D1-412D-B5C0-F795873358BA}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{E5DB1862-6272-4F45-94AD-B66B50DAF556}" = dir=out | app=c:\program files\protected search\protectedsearch.exe |
"{FC85B2BD-74C3-47AF-A594-3F2A29700D4D}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"TCP Query User{00A9431A-2965-4314-B94B-ED0A4BD17764}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{2F85CA3F-0415-4E18-8E2A-FDA7BEAE5BE4}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"TCP Query User{A17CA6BF-D440-4C5B-B558-401BCDD7E5AF}C:\program files\common files\i4j_jres\1.6.0_27\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\common files\i4j_jres\1.6.0_27\bin\javaw.exe |
"UDP Query User{0427E154-CF49-4C38-8839-109ECA0AF655}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{F1267B31-EF6C-4FCF-BC8B-9670DCA59B2C}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{F9E0253D-7E71-4D22-9DAC-A7403F08F33D}C:\program files\common files\i4j_jres\1.6.0_27\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\common files\i4j_jres\1.6.0_27\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{5783F2D7-9001-0407-0002-0060B0CE6BBA}" = AutoCAD 2011 - Deutsch
"{5783F2D7-9001-0407-1002-0060B0CE6BBA}" = AutoCAD 2011 Language Pack - Deutsch
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{9DEABCB6-B759-4D52-92F8-51B34A2B4D40}" = Autodesk Material Library 2011
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI - Deutsch
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{CD1E078C-A6B9-47DA-B035-6365C85C7832}" = Autodesk Material Library 2011 Base Image library
"{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AutoCAD 2011 - Deutsch" = AutoCAD 2011 - Deutsch
"AutoCAD 2011 - Deutsch Version 2.1" = AutoCAD 2011 - Deutsch Version 2.1
"Avira AntiVir Desktop" = Avira Free Antivirus
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"Orbit_is1" = Orbit Downloader
"Security Task Manager" = Security Task Manager 1.8d
"Trojan Remover_is1" = Trojan Remover 6.8.5
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
Error encountered while reading event logs.
< End of report >
--- --- --- |
