Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Nochmal BKA-Trojaner (https://www.trojaner-board.de/102786-nochmal-bka-trojaner.html)

Silvos 22.08.2011 22:18
Nochmal BKA-Trojaner
 
Hallo Trojanerboard Team

vor einem Jahr habt ihr mir bei meinem PC-Problem schonmal durchgeholfen, jetzt brauch ich wieder (trotz vielen Recherchen) eure zuverlässige Hilfe.
Habe mir auf meinem Win Vista vor einer Woche den BKA-Trojaner eingefangen. Auf anleiten eines bekannten Polizisten sollte ich erstmal nur F8->Systemwiederherstellung machen, danach Antivir drüberlaufen lassen. Danach lief auch alles wieder. Aber nun ist er wieder da, und anscheinent auch schlauer, denn das Verfahren von letzter Woche hat nicht geklappt (er ist immernoch da und verweigert mir das Starten von Antivir oder Malewarebytes).

Wie kann ich jetzt meinen PC noch retten oder sehe ich einer Neuaufsetzung entgegen (was heikel wäre, da beim Kauf des PCs aus Acers Hand vor 4 Jahren keine Vista-CD beilag)?

Übrigens: Ich weiß der Trojaner setzt sich in den Windowsdateien/Programmen fest, kann er sich aber auch in meiner externen Festplatte/mp4-Player/USB-Stick eingenistet haben? Ein Glück wirkt der Trojaner nicht auf meinem Mac-Book :/

kira 23.08.2011 07:09
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
Zitat:
Zitat von Silvos (Beitrag 695745)

Wie kann ich jetzt meinen PC noch retten oder sehe ich einer Neuaufsetzung entgegen (was heikel wäre, da beim Kauf des PCs aus Acers Hand vor 4 Jahren keine Vista-CD beilag)?
Ohne RecoveryCd, kannst ja auch dein Notebook in den Auslieferungszustand zurücksetzen, da Acer alles auf einer versteckten Datei auf der Festplatte gespeichert. Musst nur eine belibige Taste drücken. Das erreichst über ALT + F10 beim Acerlogo, wie Du aus dem Handbuch der Herstellers entnehmen kannst, oder der technischer Support wenden.
Ausserdem kannst eins selbst erstellen, zwar verwende die Funktion "System backup to optical disk" von Acer eRecovery Management, um ein Backup-Image auf CD oder DVD zu brennen.
Benutzerhandbuch : ftp://ftp.work.acer-euro.com/noteboo...00_5110_de.pdf
-> Acer:-> http://www.sternenhimmelstuermer.eu/...erecovery.html
-> http://www.acer-userforum.de/acer-re...rbehebung.html

Zitat:
Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Lesestoff: "Hilfe: Ich wurde das Opfer eines Hackerangriffs. Was soll ich tun?" - Säubern eines gefährdeten Systems
Falls du doch für die Systemreinigung entscheidest - Ein System zu bereinigen kann ein paar Tage dauern (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst::

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!
Anleitung:-> GMER - Rootkit Scanner

2.
Kontrolle mit MBR -t, ob Master Boot Record in Ordnung ist (MBR-Rootkit)

Mit dem folgenden Tool prüfen wir, ob sich etwas Schädliches im Master Boot Record eingenistet hat.
  • Downloade die MBR.exe von Gmer und
    kopiere die Datei mbr.exe in den Ordner C:\Windows\system32.
    Falls Du den Ordner nicht sehen kannst, diese Einstellungen in den Ordneroptionen vornehmen.
  • Start => ausführen => cmd (da reinschreiben) => OK
    es öffnet sich eine Eingabeaufforderung.

    Vista- und Windows 7-User: Start => Alle Programme => Zubehör => Rechtsklick auf Eingabeaufforderung und wähle Als Administrator ausführen.
  • Nach dem Prompt (>_) folgenden

    aus der Codebox manuell eingeben oder alternativ den mit STRG + C ins Clipboard kopieren und einfügen.
    Einfügen in der Eingabeaufforderung: in der Titelleiste einen Rechtsklick machen => Bearbeiten => einfügen.

    Code:
    mbr.exe -t > C:\mbr.log & C:\mbr.log
    (Enter drücken)
  • Nach kurzer Zeit wird sich Dein Editor öffnen und die Datei C:\mbr.log beinhalten.
    Bitte kopiere den Inhalt hier in Deinen Thread.

3.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung/virus-protect.org

4.
Systemscan mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.

    http://image.hijackthis.eu/upload/otl_screen_neu.jpg
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

5.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool Ccleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

Silvos 23.08.2011 12:41
Hallo Kira und danke für das schnelle Antworten.

Habe mir alles durchgelesen, aber dennoch einige Fragen:
Zitat:
Ohne RecoveryCd, kannst ja auch dein Notebook in den Auslieferungszustand zurücksetzen, da Acer alles auf einer versteckten Datei auf der Festplatte gespeichert. Musst nur eine belibige Taste drücken. Das erreichst über ALT + F10 beim Acerlogo, wie Du aus dem Handbuch der Herstellers entnehmen kannst, oder der technischer Support wenden.
Ausserdem kannst eins selbst erstellen, zwar verwende die Funktion "System backup to optical disk" von Acer eRecovery Management, um ein Backup-Image auf CD oder DVD zu brennen.
Es ist zwar nicht erwähnenswert, aber es ist ein PC, kein Notebook. Solle ich das jetzt verwenden für die folgenden Schritte?

zu den Schritten 1-5:
das wäre alles kein Problem, aber ich kann leider keines der Programme dank des BKA-Trojaners ja nicht auf irgendwelche Programme zugreifen. Ich habe zwar auf anderen Seiten von sgn. Recoverydisks von Kapersky gehört, mit denen man den Trojaner entfernen kann, aber in diesen Foren waren auch sehr viele Skeptiker. Da frag ich lieber hier, ihr seit mir die kompetentesten :)

kira 23.08.2011 18:23
Zitat:
Zitat von Silvos (Beitrag 695871)
aber es ist ein PC, kein Notebook.
das ist prinzipiell egal, wenn die Recover Funktion vorhanden

wenn Du dein System reinigen möchtest, zumindest versuchen es zu retten:

Unbootbares System mit OTLPE Network scannen
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop.
    Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
  • Starte das unbootbare System neu und boote von der CD, die Du gerade erstellt hast.
    Anmerkung: Wenn Du nicht weißt, wie Du Deinen Computer dazu bringst, von CD zu booten, dann folge diesen Schritten hier.
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.

    http://image.hijackthis.de/upload/hjt1-034.jpg
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt gesichert und mit Notepad++ geöffnet.
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt in diesen Thread.
Falls Du kein Brennprogramm hast:

ISOBurner
Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen.
Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Silvos 23.08.2011 19:01
ok, ich lade OTLPEN.exe heute runter und versuche morgen (freier Tag) die empfohlenen Schritte zu befolgen.

Nur so nebenbei: Mein derzeitiger laufender Computer ist ein MacBook, dort kann ich ja eine CD mit mitgelieferten Programmen brennen (bzw bei einem Roling wird per Drag and Drop die zu kopierenden Dateien angezeigt und dann mit einen Klick auf "auf CD brennen" gebrannt, oder?) (ich versuch es einfach mal :pfeiff:)
Ausserdem, weil es ein Mac-Book ist, kann ich ja nicht auf dieses Programm zugreifen, oder? Würde ansonsten morgen einen Freund fragen, das runterladen und brennen hat sich ja insgesamt schnell erledigt.

Wenn möglich würde ich meinen infizierten PC gerne Bereinigen, eine System-auf-Werkzustandzurücksetzung wäre er die letzte Möglichkeit.

---
Eine Frage nebenbei: Ich habe gelesen (hier im Forum) das man auf seiner Extrernen Festplatte nur Dateien (persönliche) speichern solle, keine exe, da diese auch befallen sein könnten. Stimmt das? Reicht eine einfache Löschung aller exe-Dateien auf USB/ext.Festplatte aus? (Braucht man ja eh nicht unbedingt).

Silvos 24.08.2011 12:54
von CD gebootet, und OTPL ausgeführt. Allerdings steht da jetzt Select windows folder oder sowas, ich gehe also zuC/Windows und drücke ok. Dann wie beschrieben weiter. Als der Scan fertig war, stecke ich USB rein für übertragung der Dateien, aber danach ging Maus nuicht mehr, auch eine alte Maus funktionierte nicht mehr. Mit den Cursers kann ich nicht kopieren, also mach ich einen Restart. Und jetzt hängst :/

Silvos 24.08.2011 13:53
sry für die Doppelposts. Hier die txt-dateien:
Extra.txt:
Code:
OTL Extras logfile created on: 8/24/2011 4:23:16 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium  (Version = 6.0.6000) - Type = System
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228.13 Gb Total Space | 4.10 Gb Free Space | 1.80% Space Free | Partition Type: NTFS
Drive H: | 3.73 Gb Total Space | 2.42 Gb Free Space | 65.02% Space Free | Partition Type: FAT32
Drive I: | 227.87 Gb Total Space | 135.26 Gb Free Space | 59.36% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{0166E190-92D7-482A-A220-DE8B7354383A}" = Demigod
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07100048-E9B4-4DF6-A845-CAAFD093E477}" = Microsoft Encarta 2007 - Standard
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C88C4A1-A9D7-4C28-8F06-4C2048765193}" = Magic The Gathering - Battlegrounds
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0FAAA044-04CF-4766-84A2-A6A95CE196BD}" = Samsung PC Studio 3
"{0FE6B77F-54CD-45ED-BB64-A99477B0A8F1}" = 5600
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{16D2C649-CBA8-44EE-B730-12584667D487}" = Stronghold 2 Deluxe
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2605461E-AB2E-49F5-8A16-64B7F3595030}" = 5600Trb
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 20
"{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}" = Rome - Total War
"{370187B9-6964-38D0-851F-6C4898B0C2B1}" = Microsoft Visual C++  Compilers 2010 Standard - enu - x86
"{37AC7F94-2C0C-3DFF-8039-4B6AB79150D0}" = Microsoft Windows SDK for Visual Studio .NET 4.0 Framework Tools
"{39556553-8C77-4C5E-8F30-4083274948A2}" = Application Verifier
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{439FBD30-A650-432D-8EAD-F681D56D7216}" = Mathematik interaktiv S II
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B509F1E-BEA7-3D0E-BE94-3BBF85E8D698}" = Microsoft Windows SDK .NET Framework Tools (30514)
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4F30BC2B-5441-3149-91D7-FAA2332E2F5F}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{613900A0-F047-4FC0-9CA5-851EF54B5584}" = Manga Studio Debut 4.0
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{699C970F-1E17-3CD8-A2EA-87AB9EDEDFF4}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{718666FC-C0A7-4DE7-9120-8F1746A90588}" = Trust R-Series Mouse
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7AFFE35D-047A-3D27-B204-1CD849933C02}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{7C11154F-3539-4CB5-979D-EF7913473E53}" = Prince of Persia
"{7DCBC3D8-8954-491D-A1B9-8C61C563B004}" = 5600_Help
"{85C977FB-2A5B-3223-8AC5-828558EAF7D9}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{928D2FB1-291A-362B-89A4-7075A9D904A4}" = Microsoft Windows SDK for Windows 7 (7.1)
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9C11FA-AE85-3B48-86BE-5FA83D0384B3}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Acer PlayMovie
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A71000000002}" = Adobe Reader 7.1.0 - Deutsch
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{B7072091-4582-396F-87E2-412C85AC7095}" = Microsoft Windows SDK MSHelp (30514)
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"{C617EC41-9E21-3915-AA7E-F156B74F7D07}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{C9DC3EE4-7A92-F473-510D-48A5EAD52845}" = ATI Catalyst Install Manager
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D09605BE-5587-4B0C-86C8-69B5092CB80F}" = Debugging Tools for Windows (x86)
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}" = Black & White® 2
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = Impulse
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1CBC6F7-D82D-4DC5-B81C-9A14F418593A}_is1" = WC3Banlist
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"1bitpaint" = 1bitpaint 0.25a
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Mythology Expansion Pack 1.0" = Age of Mythology Gold
"Ask Toolbar_is1" = Ask Toolbar
"ATI Uninstaller" = ATI Uninstaller
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"CSI-Mord in 3 Dimensionen" = CSI-Mord in 3 Dimensionen 1.0
"Demigod" = Demigod
"Digitale Bibliothek 4" = Digitale Bibliothek 4
"Elsword_DE_is1" = Elsword_DE
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FLV Player" = FLV Player 2.0 (build 25)
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 4.0.2.727
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722
"Glest_is1" = Glest 3.2.2
"GrabProGrabPro" = GrabPro - Toolbar
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"hon" = Heroes of Newerth
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"ICQToolbar" = ICQ Toolbar
"Impulse" = Impulse
"Inkscape" = Inkscape 0.48.0
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"InstallShield_{718666FC-C0A7-4DE7-9120-8F1746A90588}" = Trust R-Series Mouse
"InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"Lilith Will of Demon : Battles of Jalavia v1.0_is1" = Lilith Will of Demon : Battles of Jalavia v1.0
"LinCity-NG_is1" = LinCity-NG 2.0
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Manga Studio EX Demo 3.0" = Manga Studio EX Demo 3.0
"MegaTrainer XL_is1" = MegaTrainer XL V1.5.8.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Mozilla Firefox 6.0 (x86 de)" = Mozilla Firefox 6.0 (x86 de)
"Mp3tag" = Mp3tag v2.43
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Orbit_is1" = Orbit Downloader
"Pen Tablet Driver" = Bamboo
"Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"RealAlt_is1" = Real Alternative 1.9.0
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"SUPER ©" = SUPER © Version 2008.bld.30 (Mar 22, 2008)
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"Tomb Raider: Legend" = Tomb Raider: Legend 1.2
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.0
"Two Worlds" = Two Worlds
"UltraStar Deluxe" = UltraStar Deluxe
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"Urban Terror_is1" = Urban Terror 4.1
"VLC media player" = VideoLAN VLC media player 0.8.6d
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"Warcraft III" = Warcraft III
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1 beta4
"WinRAR archiver" = WinRAR
"X-Chat 2_is1" = X-Chat 2.8.6-2
"Yahoo! Companion" = Yahoo! Toolbar mit Pop-Up-Blocker
"Yahoo! Toolbar" = Yahoo! Toolbar
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\***_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products
 
< End of report >
Code:
OTL logfile created on: 8/24/2011 4:23:16 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium  (Version = 6.0.6000) - Type = System
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228.13 Gb Total Space | 4.10 Gb Free Space | 1.80% Space Free | Partition Type: NTFS
Drive H: | 3.73 Gb Total Space | 2.42 Gb Free Space | 65.02% Space Free | Partition Type: FAT32
Drive I: | 227.87 Gb Total Space | 135.26 Gb Free Space | 59.36% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Auto] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto] --  -- (CLTNetCnService)
SRV - [2010/04/03 10:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009/11/23 20:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009/11/23 20:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2009/08/31 16:00:28 | 001,821,184 | ---- | M] (UASSOFT.COM) [Auto] -- C:\Program Files\Mouse Driver\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2009/08/05 08:55:18 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/05/13 10:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008/01/29 11:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007/12/14 22:26:05 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/26 05:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/09/26 05:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007/04/04 12:54:08 | 000,266,343 | ---- | M] (CyberLink) [Auto] -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)
SRV - [2007/02/06 18:04:26 | 000,457,512 | ---- | M] (HiTRSUT) [Auto] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/01/31 13:18:42 | 000,053,248 | ---- | M] (Acer Inc.) [Auto] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/12/29 11:51:56 | 000,028,672 | ---- | M] () [Auto] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand] --  -- (EagleXNt)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - File not found [Kernel | On_Demand] --  -- (catchme)
DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/04/03 18:55:31 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/01/17 08:41:38 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/11/08 10:05:22 | 000,278,984 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/08/27 19:06:32 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2009/05/20 15:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/05/11 04:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/04/29 17:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009/04/29 17:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFilter)
DRV - [2009/04/19 06:10:19 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/03/30 04:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/01/18 16:39:09 | 000,005,632 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008/05/21 19:57:38 | 000,034,576 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2008/03/13 09:14:30 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2007/08/31 10:24:26 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto] -- C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2007/05/02 06:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007/05/02 06:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007/05/02 06:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007/03/14 10:04:28 | 002,427,392 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007/02/16 15:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2006/12/07 13:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/10/29 23:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2005/08/17 18:00:00 | 000,007,168 | ---- | M] () [Kernel | On_Demand] -- C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt -- (EverestDriver)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\***_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\***_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\***_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\***_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\***_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\***_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\***_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\***_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\***_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\Browser\Plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\Browser\Plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: 
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/22 13:25:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/28 15:55:06 | 000,000,000 | ---D | M]
 
[2009/04/01 05:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\Mozilla\Extensions
[2008/12/26 17:51:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions
[2008/12/26 17:51:05 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2011/08/18 14:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions
[2010/10/18 13:03:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/01 18:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/14 12:08:04 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010/06/20 13:10:47 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/08/18 14:21:58 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011/05/29 15:29:40 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\engine@conduit.com
[2010/08/15 06:24:45 | 000,000,000 | ---D | M] ("PennerBar") -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\pennerbar3@pennergame.de
[2011/04/30 22:00:17 | 000,000,000 | ---D | M] (Personas) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\personas@christopher.beard
[2011/08/18 14:21:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\trash
[2011/08/21 14:35:23 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin-1.xml
[2011/08/22 07:19:18 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin-2.xml
[2011/08/14 12:06:42 | 000,001,056 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin.xml
[2011/08/21 12:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/08/21 12:29:14 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/05/13 05:17:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PX87AZT0.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2011/08/22 13:25:41 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/04/12 11:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/05/28 15:55:01 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/28 15:55:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/28 15:55:01 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/28 15:55:01 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/05/28 15:55:01 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/05/28 15:55:01 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\***_ON_C\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\***_ON_C\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\***_ON_C\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\***_ON_C..\Run: [{A1E29B9C-B581-367D-32B4-BAEF5C48BCF7}]  File not found
O4 - HKU\***_ON_C..\Run: [4E3E0230AEBB4E96]  File not found
O4 - HKU\***_ON_C..\Run: [Acer Tour Reminder]  File not found
O4 - HKU\***_ON_C..\Run: [avupdate] C:\Users\***\AppData\Roaming\mahmud.exe ()
O4 - HKU\***_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKU\***_ON_C..\Run: [GameShadow]  File not found
O4 - HKU\***_ON_C..\Run: [monjx]  File not found
O4 - HKU\***_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\***_ON_C..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe (Stardock Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\***_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\***_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.237.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/11/22 14:08:16 | 000,000,110 | -H-- | M] () - H:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5b27f525-a57e-11e0-8cd2-001c255399df}\Shell\AutoRun\command - "" = K:\Menu.exe
O33 - MountPoints2\{c88cd6a7-aae8-11e0-8a92-001c255399df}\Shell\AutoRun\command - "" = K:\RunClubSanDisk.exe
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/21 12:28:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/08/16 06:33:40 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/07/30 18:29:54 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\Story File01
[2011/07/28 12:39:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011/07/27 14:26:59 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\LolClient
[2011/07/27 13:04:11 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011/07/27 09:36:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\PMB Files
[2011/07/27 09:36:04 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011/07/27 09:34:54 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2011/07/26 10:22:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2007/12/14 22:46:01 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007/05/06 19:07:10 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/24 07:20:04 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/24 07:19:33 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/08/24 07:19:31 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/24 07:19:31 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/24 07:19:26 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/22 17:02:36 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/08/22 16:34:52 | 000,227,240 | ---- | M] () -- C:\Users\***\AppData\Roaming\mahmud.exe
[2011/08/22 13:28:21 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
[2011/08/21 12:28:59 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/08/21 12:28:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/08/20 07:09:33 | 000,693,536 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/08/20 07:09:33 | 000,654,402 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/20 07:09:33 | 000,137,922 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/08/20 07:09:33 | 000,120,738 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/16 06:33:40 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/08/14 18:48:14 | 000,203,776 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/14 11:36:57 | 000,015,504 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2011/08/07 19:28:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011/08/01 17:08:55 | 000,141,501 | ---- | M] () -- C:\Users\***\Documents\london.jpg
[2011/07/28 12:47:59 | 000,000,467 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011/07/28 12:39:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011/07/26 20:43:04 | 000,002,697 | ---- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2007.lnk
[2011/07/26 12:09:07 | 000,000,963 | ---- | M] () -- C:\Users\***\Desktop\Elsword.lnk
[2011/07/26 10:22:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2011/07/25 22:32:12 | 000,001,195 | ---- | M] () -- C:\Users\***\Desktop\Free YouTube to MP3 Converter.lnk
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/08/22 16:34:52 | 000,227,240 | ---- | C] () -- C:\Users\***\AppData\Roaming\mahmud.exe
[2011/08/21 12:28:59 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/08/01 17:08:54 | 000,141,501 | ---- | C] () -- C:\Users\***\Documents\london.jpg
[2011/07/28 12:47:59 | 000,000,467 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011/07/26 12:09:07 | 000,000,963 | ---- | C] () -- C:\Users\***\Desktop\Elsword.lnk
[2010/08/03 11:07:09 | 000,003,120 | ---- | C] () -- C:\Windows\System32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
[2010/03/22 17:53:13 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010/03/22 17:53:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/03/22 17:53:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/03/22 17:53:13 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/03/22 17:53:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/02/08 01:33:04 | 000,359,320 | ---- | C] () -- C:\Windows\System32\vfprintpthelper.dll
[2009/09/29 11:23:00 | 000,000,292 | ---- | C] () -- C:\Windows\vtmb.ini
[2009/08/24 01:42:33 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/08/24 01:42:29 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/05/10 11:14:14 | 000,001,100 | ---- | C] () -- C:\Users\***\AppData\Local\d3d8caps.dat
[2008/12/27 13:54:06 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008/12/27 13:39:59 | 000,000,059 | ---- | C] () -- C:\Windows\wininit.ini
[2008/12/27 13:34:30 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2008/12/06 08:20:10 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/10/23 05:24:47 | 000,008,999 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008/09/30 14:28:22 | 000,697,862 | ---- | C] () -- C:\Windows\unins000.exe
[2008/09/30 14:28:22 | 000,002,449 | ---- | C] () -- C:\Windows\unins000.dat
[2008/08/04 07:32:45 | 000,164,351 | ---- | C] () -- C:\Windows\hpoins19.dat
[2008/07/01 08:22:01 | 000,218,256 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008/05/21 19:56:36 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2008/05/05 13:54:36 | 000,000,000 | ---- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat
[2008/04/30 11:44:24 | 000,027,648 | -HS- | C] () -- C:\Windows\System32\Smab0.dll
[2008/04/30 10:55:45 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008/04/30 10:55:45 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2008/04/30 10:55:45 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2008/04/30 10:55:45 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008/04/30 10:55:44 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2008/04/30 10:55:44 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2008/03/15 13:06:04 | 000,023,580 | ---- | C] () -- C:\Users\***\AppData\Roaming\UserTile.png
[2008/03/13 09:14:31 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008/03/13 09:14:30 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008/02/13 14:44:31 | 000,203,776 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/02 17:36:52 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll
[2008/02/02 04:05:43 | 000,015,504 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2007/12/14 22:47:03 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2007/12/14 22:47:03 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2007/12/14 22:46:01 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007/05/07 04:41:16 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007/05/07 03:22:38 | 000,000,834 | ---- | C] () -- C:\Windows\generic.ini
[2007/05/07 03:22:38 | 000,000,130 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007/05/07 03:22:34 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007/05/07 03:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007/05/07 03:22:34 | 000,143,676 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007/05/06 19:07:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007/03/13 16:01:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2007/02/06 17:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007/02/06 17:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007/02/06 17:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007/02/06 17:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007/02/06 17:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 09:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/12 23:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 11:33:31 | 000,693,536 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006/11/02 11:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006/11/02 11:33:31 | 000,137,922 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006/11/02 11:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,307,088 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,654,402 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,120,738 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/11/02 03:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 03:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2001/12/26 09:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/09/03 16:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 09:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 15:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[1997/11/17 11:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
 
========== LOP Check ==========
 
[2010/09/25 18:35:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Artweaver
[2009/04/19 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools
[2009/04/19 06:15:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2009/04/19 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Pro
[2011/08/07 19:28:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2010/08/28 18:17:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/08/03 11:08:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\e frontier
[2008/02/02 15:46:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\eSobi
[2009/10/14 12:09:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FOG Downloader
[2008/10/23 16:46:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\GrabPro
[2011/05/04 19:55:57 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2011/06/10 06:50:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2008/02/23 06:34:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2011/01/05 15:17:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Image Zone Express
[2010/10/10 17:08:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\inkscape
[2011/07/27 14:26:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\LolClient
[2009/07/07 15:13:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Mp3tag
[2011/05/01 15:00:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Orbit
[2008/03/15 13:06:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\PeerNetworking
[2008/08/07 14:27:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Printer Info Cache
[2011/07/23 11:50:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\runic games
[2008/12/27 13:56:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Samsung
[2009/10/04 10:11:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sierra
[2010/12/08 14:56:18 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Smith Micro
[2009/01/04 16:57:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SPORE
[2010/07/04 13:18:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Stardock
[2010/07/19 18:13:19 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SYSTEMAX Software Development
[2008/05/05 13:54:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2010/05/28 17:03:46 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2010/11/01 17:03:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ultrastardx
[2010/08/04 10:42:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Vion
[2010/08/04 17:25:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Woix
[2010/08/02 14:42:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WTouch
[2011/08/02 10:14:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\X-Chat 2
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2010/08/02 14:42:24 | 000,000,000 | ---D | M] -- C:\ProgramData\AppData
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2010/09/25 18:35:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Artweaver
[2010/12/08 14:56:22 | 000,000,000 | ---D | M] -- C:\ProgramData\CELSYS
[2009/04/19 06:13:52 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2010/07/18 16:14:19 | 000,000,000 | ---D | M] -- C:\ProgramData\dbg
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2008/07/07 14:32:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2008/02/02 15:46:16 | 000,000,000 | ---D | M] -- C:\ProgramData\eSobi
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2008/10/12 12:25:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Firefly Studios
[2011/06/08 17:55:08 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/08/22 16:07:00 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2010/11/06 16:31:09 | 000,000,000 | ---D | M] -- C:\ProgramData\PopCap Games
[2011/01/08 12:13:37 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1986-12.com.adobe
[2010/07/04 13:20:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Stardock
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/07/19 18:13:19 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2007/05/06 19:01:29 | 000,000,000 | ---D | M] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010/06/28 13:31:47 | 000,000,000 | -H-D | M] -- C:\ProgramData\{67C33A62-5B1D-43D1-9600-16006F36EB2B}
[2010/06/28 13:32:26 | 000,000,000 | -H-D | M] -- C:\ProgramData\{EA77F737-0FEA-4800-BD99-D6AF1051C7A9}
[2011/08/24 07:19:44 | 000,032,524 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/08/22 13:28:21 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011/02/24 18:27:57 | 010,756,096 | ---- | M] ()(C:\Users\***\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011/02/24 18:27:34 | 010,756,096 | ---- | C] ()(C:\Users\***\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011/02/24 18:10:19 | 005,654,528 | ---- | M] ()(C:\Users\***\Documents\?????.mp3) -- C:\Users\***\Documents\黒の預言書.mp3
[2011/02/24 18:10:06 | 005,654,528 | ---- | C] ()(C:\Users\***\Documents\?????.mp3) -- C:\Users\***\Documents\黒の預言書.mp3
[2011/02/24 18:08:35 | 009,170,944 | ---- | M] ()(C:\Users\***\Documents\??????.mp3) -- C:\Users\***\Documents\呪われし宝石.mp3
[2011/02/24 18:08:12 | 009,170,944 | ---- | C] ()(C:\Users\***\Documents\??????.mp3) -- C:\Users\***\Documents\呪われし宝石.mp3
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\[BNFs]FairyTail_17_H264.mp4:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\[BNFs]FairyTail_16_H264.mp4:TOC.WMV
< End of report >

kira 24.08.2011 14:18
Zitat:
Achtung wichtig!:

Die mit Stern gekennzeichneten Teile, musst Du durch die Originalbezeichnung ersetzen (z.B DeinName) und so in Script einfügen! sonst funktioniert nicht!
1.
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
IE - HKU\***_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
[2008/12/26 17:51:05 | 000,000,000 | ---D | M] ("Ask Toolbar for Firefox") -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2011/05/29 15:29:40 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\engine@conduit.com
[2011/08/21 14:35:23 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin-1.xml
[2011/08/14 12:06:42 | 000,001,056 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin.xml
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKU\***_ON_C..\Run: [{A1E29B9C-B581-367D-32B4-BAEF5C48BCF7}]  File not found
O4 - HKU\***_ON_C..\Run: [4E3E0230AEBB4E96]  File not found
O4 - HKU\***_ON_C..\Run: [avupdate] C:\Users\***\AppData\Roaming\mahmud.exe ()
O4 - HKU\***_ON_C..\Run: [GameShadow]  File not found
O4 - HKU\***_ON_C..\Run: [monjx]  File not found
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\***_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/11/22 14:08:16 | 000,000,110 | -H-- | M] () - H:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5b27f525-a57e-11e0-8cd2-001c255399df}\Shell\AutoRun\command - "" = K:\Menu.exe
O33 - MountPoints2\{c88cd6a7-aae8-11e0-8a92-001c255399df}\Shell\AutoRun\command - "" = K:\RunClubSanDisk.exe
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe
[2011/08/22 16:34:52 | 000,227,240 | ---- | M] () -- C:\Users\***\AppData\Roaming\mahmud.exe
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\[BNFs]FairyTail_17_H264.mp4:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\[BNFs]FairyTail_16_H264.mp4:TOC.WMV

:Commands
[purity]
[emptytemp]

2.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

** kannst Du im normalen Modus starten?

Silvos 24.08.2011 14:37
also OTL.exe wieder wie gerade mit CD-boot starten (wie sonst auch anders :P)

Zitat:
** kannst Du im normalen Modus starten?
soll ich das danach auch überprüfen?

kira 24.08.2011 16:23
erstmal die Schritte abarbeiten, dann schauen, ob im normalen Modus starten kannst!

Silvos 24.08.2011 16:33
habe es gemacht, habe aber glaube ich OTPLEN statt OTL verwendet... suche jetzt ob es eine Textdatei gibt, ich musste einen Neustart erzwingen, er kam nicht automatisch

Silvos 24.08.2011 16:53
nach dem neustart (der nicht automatisch stattfand) habe ich keine textdatei gefunden.

Hier aber die erneuten Scans:
Code:
OTL Extras logfile created on: 8/24/2011 9:48:17 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium  (Version = 6.0.6000) - Type = System
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228.13 Gb Total Space | 4.10 Gb Free Space | 1.80% Space Free | Partition Type: NTFS
Drive D: | 3.73 Gb Total Space | 2.42 Gb Free Space | 65.00% Space Free | Partition Type: FAT32
Drive I: | 227.87 Gb Total Space | 135.26 Gb Free Space | 59.36% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01386D1F-ADE7-43B4-A4E9-312FC5BC726F}_is1" = SWF Opener
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{0166E190-92D7-482A-A220-DE8B7354383A}" = Demigod
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07100048-E9B4-4DF6-A845-CAAFD093E477}" = Microsoft Encarta 2007 - Standard
"{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0C88C4A1-A9D7-4C28-8F06-4C2048765193}" = Magic The Gathering - Battlegrounds
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0FAAA044-04CF-4766-84A2-A6A95CE196BD}" = Samsung PC Studio 3
"{0FE6B77F-54CD-45ED-BB64-A99477B0A8F1}" = 5600
"{132888AE-EF67-41C5-BCA2-7D5D2488AB63}" = Acer HomeMedia Connect
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{16D2C649-CBA8-44EE-B730-12584667D487}" = Stronghold 2 Deluxe
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2605461E-AB2E-49F5-8A16-64B7F3595030}" = 5600Trb
"{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 20
"{2E97F7E8-ABDE-4E0D-B0AD-B6B4BAD89E24}" = Rome - Total War
"{370187B9-6964-38D0-851F-6C4898B0C2B1}" = Microsoft Visual C++  Compilers 2010 Standard - enu - x86
"{37AC7F94-2C0C-3DFF-8039-4B6AB79150D0}" = Microsoft Windows SDK for Visual Studio .NET 4.0 Framework Tools
"{39556553-8C77-4C5E-8F30-4083274948A2}" = Application Verifier
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}" = Titan Quest
"{41581EF5-45A7-11DA-9D78-000129760D75}" = Acer SlideShow DVD
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{439FBD30-A650-432D-8EAD-F681D56D7216}" = Mathematik interaktiv S II
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B509F1E-BEA7-3D0E-BE94-3BBF85E8D698}" = Microsoft Windows SDK .NET Framework Tools (30514)
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{4F30BC2B-5441-3149-91D7-FAA2332E2F5F}" = Microsoft Windows SDK for Windows 7 Headers and Libraries (30514)
"{4F64A46D-67F7-4497-AEA2-313D4305A5F6}" = Torchlight
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{613900A0-F047-4FC0-9CA5-851EF54B5584}" = Manga Studio Debut 4.0
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{699C970F-1E17-3CD8-A2EA-87AB9EDEDFF4}" = Microsoft Windows SDK for Windows 7 Samples (30514)
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{718666FC-C0A7-4DE7-9120-8F1746A90588}" = Trust R-Series Mouse
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer
"{7AFFE35D-047A-3D27-B204-1CD849933C02}" = Microsoft Windows SDK for Windows 7 Common Utilities (30514)
"{7C11154F-3539-4CB5-979D-EF7913473E53}" = Prince of Persia
"{7DCBC3D8-8954-491D-A1B9-8C61C563B004}" = 5600_Help
"{85C977FB-2A5B-3223-8AC5-828558EAF7D9}" = Microsoft Windows SDK for Windows 7 Utilities for Win32 Development (30514)
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{928D2FB1-291A-362B-89A4-7075A9D904A4}" = Microsoft Windows SDK for Windows 7 (7.1)
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A9C11FA-AE85-3B48-86BE-5FA83D0384B3}" = Microsoft Windows SDK Intellisense and Reference Assemblies (30514)
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Acer PlayMovie
"{AA4BF92B-2AAF-11DA-9D78-000129760D75}" = Acer HomeMedia
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1031-7B44-A71000000002}" = Adobe Reader 7.1.0 - Deutsch
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B145EC69-66F5-11D8-9D75-000129760D75}" = Acer DVDivine
"{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}" = Titan Quest Immortal Throne
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Click to Call with Skype
"{B7072091-4582-396F-87E2-412C85AC7095}" = Microsoft Windows SDK MSHelp (30514)
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C4A4722E-79F9-417C-BD72-8D359A090C97}" = Samsung PC Studio 3
"{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"{C617EC41-9E21-3915-AA7E-F156B74F7D07}" = Microsoft Windows SDK Net Fx Interop Headers And Libraries (30514)
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{C9DC3EE4-7A92-F473-510D-48A5EAD52845}" = ATI Catalyst Install Manager
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D09605BE-5587-4B0C-86C8-69B5092CB80F}" = Debugging Tools for Windows (x86)
"{D462BF9E-0C35-4705-BF9B-3DF9F3816643}" = Acer ePerformance Management
"{D9E52CD1-9DF1-4A8A-9BDC-1E5E53982F2B}" = Black & White® 2
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DF315348-721C-40B8-BAE2-58C6C7D935A2}" = Empire Earth II
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E4197D6B-F046-33E7-ABDE-51FF373FDC76}" = Windows SDK IntellisenseNFX
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E7F9E526-2324-437B-A609-E8C5309465CB}" = Microsoft Windows Performance Toolkit
"{EA450D5D-95EA-4FD0-B8B0-6D8E68FBE2C7}" = Impulse
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Live Main Page
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1CBC6F7-D82D-4DC5-B81C-9A14F418593A}_is1" = WC3Banlist
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F6EFFB76-4A07-11DA-9D78-000129760D75}" = Acer DV Magician
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F79A208D-D929-11D9-9D77-000129760D75}" = Acer VideoMagician
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"1bitpaint" = 1bitpaint 0.25a
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Age of Mythology Expansion Pack 1.0" = Age of Mythology Gold
"Ask Toolbar_is1" = Ask Toolbar
"ATI Uninstaller" = ATI Uninstaller
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CCleaner" = CCleaner
"CSI-Mord in 3 Dimensionen" = CSI-Mord in 3 Dimensionen 1.0
"Demigod" = Demigod
"Digitale Bibliothek 4" = Digitale Bibliothek 4
"Elsword_DE_is1" = Elsword_DE
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"FLV Player" = FLV Player 2.0 (build 25)
"Free 3GP Video Converter_is1" = Free 3GP Video Converter version 4.0.2.727
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722
"Glest_is1" = Glest 3.2.2
"GrabProGrabPro" = GrabPro - Toolbar
"HijackThis" = HijackThis 2.0.2
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"hon" = Heroes of Newerth
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"ICQToolbar" = ICQ Toolbar
"Impulse" = Impulse
"Inkscape" = Inkscape 0.48.0
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{55BFC356-5A7B-482F-A213-9ACFDDFF6037}" = Mouse Driver
"InstallShield_{718666FC-C0A7-4DE7-9120-8F1746A90588}" = Trust R-Series Mouse
"InstallShield_{C4E2A4A7-B623-40CB-8EEA-72F577E49D56}" = Vampire - The Masquerade Bloodlines
"Lilith Will of Demon : Battles of Jalavia v1.0_is1" = Lilith Will of Demon : Battles of Jalavia v1.0
"LinCity-NG_is1" = LinCity-NG 2.0
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Manga Studio EX Demo 3.0" = Manga Studio EX Demo 3.0
"MegaTrainer XL_is1" = MegaTrainer XL V1.5.8.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Mozilla Firefox 6.0 (x86 de)" = Mozilla Firefox 6.0 (x86 de)
"Mp3tag" = Mp3tag v2.43
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Orbit_is1" = Orbit Downloader
"Pen Tablet Driver" = Bamboo
"Pflanzen gegen Zombies" = Pflanzen gegen Zombies
"RealAlt_is1" = Real Alternative 1.9.0
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SDKSetup_7.1.7600.0.30514" = Microsoft Windows SDK for Windows 7 (7.1)
"SUPER ©" = SUPER © Version 2008.bld.30 (Mar 22, 2008)
"SystemRequirementsLab" = System Requirements Lab
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Tomb Raider: Anniversary" = Tomb Raider: Anniversary 1.0
"Tomb Raider: Legend" = Tomb Raider: Legend 1.2
"Tomb Raider: Underworld" = Tomb Raider: Underworld 1.0
"Two Worlds" = Two Worlds
"UltraStar Deluxe" = UltraStar Deluxe
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"Urban Terror_is1" = Urban Terror 4.1
"VLC media player" = VideoLAN VLC media player 0.8.6d
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"Warcraft III" = Warcraft III
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1 beta4
"WinRAR archiver" = WinRAR
"X-Chat 2_is1" = X-Chat 2.8.6-2
"Yahoo! Companion" = Yahoo! Toolbar mit Pop-Up-Blocker
"Yahoo! Toolbar" = Yahoo! Toolbar
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\***p_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Warcraft III" = Warcraft III: All Products
 
< End of report >
Code:
OTL logfile created on: 8/24/2011 9:48:17 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium  (Version = 6.0.6000) - Type = System
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228.13 Gb Total Space | 4.10 Gb Free Space | 1.80% Space Free | Partition Type: NTFS
Drive D: | 3.73 Gb Total Space | 2.42 Gb Free Space | 65.00% Space Free | Partition Type: FAT32
Drive I: | 227.87 Gb Total Space | 135.26 Gb Free Space | 59.36% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Auto] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto] --  -- (CLTNetCnService)
SRV - [2010/04/03 10:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009/11/23 20:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009/11/23 20:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2009/08/31 16:00:28 | 001,821,184 | ---- | M] (UASSOFT.COM) [Auto] -- C:\Program Files\Mouse Driver\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2009/08/05 08:55:18 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/05/13 10:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008/01/29 11:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007/12/14 22:26:05 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/26 05:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007/09/26 05:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007/04/04 12:54:08 | 000,266,343 | ---- | M] (CyberLink) [Auto] -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)
SRV - [2007/02/06 18:04:26 | 000,457,512 | ---- | M] (HiTRSUT) [Auto] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007/01/31 13:18:42 | 000,053,248 | ---- | M] (Acer Inc.) [Auto] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006/12/29 11:51:56 | 000,028,672 | ---- | M] () [Auto] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand] --  -- (EagleXNt)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - File not found [Kernel | On_Demand] --  -- (catchme)
DRV - [2010/07/04 15:51:26 | 000,004,096 | ---- | M] () [Kernel | Unavailable] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV - [2010/04/03 18:55:31 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/01/17 08:41:38 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/11/08 10:05:22 | 000,278,984 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009/08/27 19:06:32 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2009/05/20 15:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009/05/11 04:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/04/29 17:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009/04/29 17:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFilter)
DRV - [2009/04/19 06:10:19 | 000,717,296 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/03/30 04:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009/01/18 16:39:09 | 000,005,632 | ---- | M] () [File_System | System] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008/05/21 19:57:38 | 000,034,576 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2008/03/13 09:14:30 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2007/08/31 10:24:26 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto] -- C:\Program Files\Acer Arcade Live\Acer PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2007/05/02 06:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007/05/02 06:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007/05/02 06:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007/03/14 10:04:28 | 002,427,392 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007/02/16 15:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2006/12/07 13:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006/10/29 23:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2005/08/17 18:00:00 | 000,007,168 | ---- | M] () [Kernel | On_Demand] -- C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt -- (EverestDriver)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\***p_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKU\***p_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKU\***p_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKU\***p_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\***p_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\***p_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\***p_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\***p_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\***p_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\Browser\Plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\Browser\Plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: 
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/08/22 13:25:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/28 15:55:06 | 000,000,000 | ---D | M]
 
[2009/04/01 05:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\Mozilla\Extensions
[2008/12/26 17:51:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\extensions
[2011/08/18 14:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions
[2010/10/18 13:03:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/01 18:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/08/14 12:08:04 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010/06/20 13:10:47 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/08/18 14:21:58 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010/08/15 06:24:45 | 000,000,000 | ---D | M] ("PennerBar") -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\pennerbar3@pennergame.de
[2011/04/30 22:00:17 | 000,000,000 | ---D | M] (Personas) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\personas@christopher.beard
[2011/08/18 14:21:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\trash
[2011/08/22 07:19:18 | 000,000,950 | ---- | M] () -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin-2.xml
[2011/08/21 12:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/08/21 12:29:14 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010/05/13 05:17:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\JAN-PHILIPP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PX87AZT0.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2011/08/22 13:25:41 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/04/12 11:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/05/28 15:55:01 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/05/28 15:55:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/05/28 15:55:01 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/28 15:55:01 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/05/28 15:55:01 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/05/28 15:55:01 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} -  File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} -  File not found
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\***p_ON_C\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKU\***p_ON_C\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKU\***p_ON_C\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\***p_ON_C..\Run: [{A1E29B9C-B581-367D-32B4-BAEF5C48BCF7}]  File not found
O4 - HKU\***p_ON_C..\Run: [4E3E0230AEBB4E96]  File not found
O4 - HKU\***p_ON_C..\Run: [Acer Tour Reminder]  File not found
O4 - HKU\***p_ON_C..\Run: [avupdate]  File not found
O4 - HKU\***p_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKU\***p_ON_C..\Run: [GameShadow]  File not found
O4 - HKU\***p_ON_C..\Run: [monjx]  File not found
O4 - HKU\***p_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\***p_ON_C..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Users\***p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk = C:\Program Files\Stardock\Impulse\Now\ImpulseNow.exe (Stardock Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\***p_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\***p_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.237.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010/11/22 14:08:16 | 000,000,110 | -H-- | M] () - D:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{5b27f525-a57e-11e0-8cd2-001c255399df}\Shell\AutoRun\command - "" = K:\Menu.exe
O33 - MountPoints2\{c88cd6a7-aae8-11e0-8a92-001c255399df}\Shell\AutoRun\command - "" = K:\RunClubSanDisk.exe
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/24 20:10:14 | 002,237,440 | R--- | C] (OldTimer Tools) -- C:\OTLPE.exe
[2011/08/24 20:10:05 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/08/21 12:28:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/08/16 06:33:40 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/07/30 18:29:54 | 000,000,000 | ---D | C] -- C:\Users\***p\Documents\Story File01
[2011/07/28 12:39:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011/07/27 14:26:59 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Roaming\LolClient
[2011/07/27 13:04:11 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011/07/27 09:36:04 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\PMB Files
[2011/07/27 09:36:04 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011/07/27 09:34:54 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2011/07/26 10:22:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2007/12/14 22:46:01 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007/05/06 19:07:10 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/24 12:39:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/24 12:39:23 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/08/24 12:39:21 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/24 12:39:21 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/24 12:39:15 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/22 17:02:36 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/08/22 13:28:21 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
[2011/08/21 12:28:59 | 000,001,878 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/08/21 12:28:59 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/08/20 07:09:33 | 000,693,536 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/08/20 07:09:33 | 000,654,402 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/20 07:09:33 | 000,137,922 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/08/20 07:09:33 | 000,120,738 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/16 06:33:40 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/08/14 18:48:14 | 000,203,776 | ---- | M] () -- C:\Users\***p\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/14 11:36:57 | 000,015,504 | ---- | M] () -- C:\Users\***p\AppData\Local\d3d9caps.dat
[2011/08/07 19:28:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011/08/01 17:08:55 | 000,141,501 | ---- | M] () -- C:\Users\***p\Documents\london.jpg
[2011/07/28 12:47:59 | 000,000,467 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011/07/28 12:39:12 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011/07/26 20:43:04 | 000,002,697 | ---- | M] () -- C:\Users\***p\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Office PowerPoint 2007.lnk
[2011/07/26 12:09:07 | 000,000,963 | ---- | M] () -- C:\Users\***p\Desktop\Elsword.lnk
[2011/07/26 10:22:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2011/07/25 22:32:12 | 000,001,195 | ---- | M] () -- C:\Users\***p\Desktop\Free YouTube to MP3 Converter.lnk
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/08/21 12:28:59 | 000,001,878 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2011/08/01 17:08:54 | 000,141,501 | ---- | C] () -- C:\Users\***p\Documents\london.jpg
[2011/07/28 12:47:59 | 000,000,467 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends spielen .lnk
[2011/07/26 12:09:07 | 000,000,963 | ---- | C] () -- C:\Users\***p\Desktop\Elsword.lnk
[2010/08/03 11:07:09 | 000,003,120 | ---- | C] () -- C:\Windows\System32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
[2010/03/22 17:53:13 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010/03/22 17:53:13 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/03/22 17:53:13 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/03/22 17:53:13 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/03/22 17:53:13 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/02/08 01:33:04 | 000,359,320 | ---- | C] () -- C:\Windows\System32\vfprintpthelper.dll
[2009/09/29 11:23:00 | 000,000,292 | ---- | C] () -- C:\Windows\vtmb.ini
[2009/08/24 01:42:33 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/08/24 01:42:29 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/05/10 11:14:14 | 000,001,100 | ---- | C] () -- C:\Users\***p\AppData\Local\d3d8caps.dat
[2008/12/27 13:54:06 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008/12/27 13:39:59 | 000,000,059 | ---- | C] () -- C:\Windows\wininit.ini
[2008/12/27 13:34:30 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2008/12/06 08:20:10 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008/10/23 05:24:47 | 000,008,999 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008/09/30 14:28:22 | 000,697,862 | ---- | C] () -- C:\Windows\unins000.exe
[2008/09/30 14:28:22 | 000,002,449 | ---- | C] () -- C:\Windows\unins000.dat
[2008/08/04 07:32:45 | 000,164,351 | ---- | C] () -- C:\Windows\hpoins19.dat
[2008/07/01 08:22:01 | 000,218,256 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008/05/21 19:56:36 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2008/05/05 13:54:36 | 000,000,000 | ---- | C] () -- C:\Users\***p\AppData\Roaming\wklnhst.dat
[2008/04/30 11:44:24 | 000,027,648 | -HS- | C] () -- C:\Windows\System32\Smab0.dll
[2008/04/30 10:55:45 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008/04/30 10:55:45 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2008/04/30 10:55:45 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2008/04/30 10:55:45 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008/04/30 10:55:44 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2008/04/30 10:55:44 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2008/03/15 13:06:04 | 000,023,580 | ---- | C] () -- C:\Users\***p\AppData\Roaming\UserTile.png
[2008/03/13 09:14:31 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008/03/13 09:14:30 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008/02/13 14:44:31 | 000,203,776 | ---- | C] () -- C:\Users\***p\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/02/02 17:36:52 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll
[2008/02/02 04:05:43 | 000,015,504 | ---- | C] () -- C:\Users\***p\AppData\Local\d3d9caps.dat
[2007/12/14 22:47:03 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2007/12/14 22:47:03 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2007/12/14 22:46:01 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007/05/07 04:41:16 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007/05/07 03:22:38 | 000,000,834 | ---- | C] () -- C:\Windows\generic.ini
[2007/05/07 03:22:38 | 000,000,130 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007/05/07 03:22:34 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007/05/07 03:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007/05/07 03:22:34 | 000,143,676 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007/05/06 19:07:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007/03/13 16:01:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2007/02/06 17:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007/02/06 17:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007/02/06 17:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007/02/06 17:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007/02/06 17:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 09:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006/11/12 23:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 11:33:31 | 000,693,536 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006/11/02 11:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006/11/02 11:33:31 | 000,137,922 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006/11/02 11:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,307,088 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,654,402 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,120,738 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/11/02 03:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006/11/02 03:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2001/12/26 09:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001/09/03 16:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001/07/30 09:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 15:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[1997/11/17 11:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
 
========== LOP Check ==========
 
[2010/09/25 18:35:39 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Artweaver
[2009/04/19 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools
[2009/04/19 06:15:05 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools Lite
[2009/04/19 06:14:36 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools Pro
[2011/08/07 19:28:21 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DVDVideoSoft
[2010/08/28 18:17:01 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/08/03 11:08:44 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\e frontier
[2008/02/02 15:46:38 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\eSobi
[2009/10/14 12:09:24 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\FOG Downloader
[2008/10/23 16:46:39 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\GrabPro
[2011/05/04 19:55:57 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\gtk-2.0
[2011/06/10 06:50:00 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ICQ
[2008/02/23 06:34:05 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ICQ Toolbar
[2011/01/05 15:17:01 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Image Zone Express
[2010/10/10 17:08:30 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\inkscape
[2011/07/27 14:26:59 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\LolClient
[2009/07/07 15:13:29 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Mp3tag
[2011/05/01 15:00:50 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Orbit
[2008/03/15 13:06:04 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\PeerNetworking
[2008/08/07 14:27:33 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Printer Info Cache
[2011/07/23 11:50:25 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\runic games
[2008/12/27 13:56:07 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Samsung
[2009/10/04 10:11:44 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Sierra
[2010/12/08 14:56:18 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Smith Micro
[2009/01/04 16:57:03 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\SPORE
[2010/07/04 13:18:47 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Stardock
[2010/07/19 18:13:19 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\SYSTEMAX Software Development
[2008/05/05 13:54:43 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Template
[2010/05/28 17:03:46 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\TS3Client
[2010/11/01 17:03:26 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ultrastardx
[2010/08/04 10:42:32 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Vion
[2010/08/04 17:25:08 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Woix
[2010/08/02 14:42:51 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\WTouch
[2011/08/02 10:14:21 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\X-Chat 2
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2010/08/02 14:42:24 | 000,000,000 | ---D | M] -- C:\ProgramData\AppData
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2010/09/25 18:35:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Artweaver
[2010/12/08 14:56:22 | 000,000,000 | ---D | M] -- C:\ProgramData\CELSYS
[2009/04/19 06:13:52 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2010/07/18 16:14:19 | 000,000,000 | ---D | M] -- C:\ProgramData\dbg
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2008/07/07 14:32:45 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2008/02/02 15:46:16 | 000,000,000 | ---D | M] -- C:\ProgramData\eSobi
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2008/10/12 12:25:42 | 000,000,000 | ---D | M] -- C:\ProgramData\Firefly Studios
[2011/06/08 17:55:08 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/08/22 16:07:00 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2010/11/06 16:31:09 | 000,000,000 | ---D | M] -- C:\ProgramData\PopCap Games
[2011/01/08 12:13:37 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1986-12.com.adobe
[2010/07/04 13:20:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Stardock
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2010/07/19 18:13:19 | 000,000,000 | ---D | M] -- C:\ProgramData\SYSTEMAX Software Development
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/02/02 04:01:35 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2007/05/06 19:01:29 | 000,000,000 | ---D | M] -- C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
[2010/06/28 13:31:47 | 000,000,000 | -H-D | M] -- C:\ProgramData\{67C33A62-5B1D-43D1-9600-16006F36EB2B}
[2010/06/28 13:32:26 | 000,000,000 | -H-D | M] -- C:\ProgramData\{EA77F737-0FEA-4800-BD99-D6AF1051C7A9}
[2011/08/24 12:39:38 | 000,032,524 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/08/22 13:28:21 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011/02/24 18:27:57 | 010,756,096 | ---- | M] ()(C:\Users\***p\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***p\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011/02/24 18:27:34 | 010,756,096 | ---- | C] ()(C:\Users\***p\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***p\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011/02/24 18:10:19 | 005,654,528 | ---- | M] ()(C:\Users\***p\Documents\?????.mp3) -- C:\Users\***p\Documents\黒の預言書.mp3
[2011/02/24 18:10:06 | 005,654,528 | ---- | C] ()(C:\Users\***p\Documents\?????.mp3) -- C:\Users\***p\Documents\黒の預言書.mp3
[2011/02/24 18:08:35 | 009,170,944 | ---- | M] ()(C:\Users\***p\Documents\??????.mp3) -- C:\Users\***p\Documents\呪われし宝石.mp3
[2011/02/24 18:08:12 | 009,170,944 | ---- | C] ()(C:\Users\***p\Documents\??????.mp3) -- C:\Users\***p\Documents\呪われし宝石.mp3
< End of report >
EDIT:
Danke Kira, es scheint alles wieder zu laufen, zumindest läuft der PC jetzt schon seit 4 Min ohne diesen blöden Trojaner ;)
Als nächstes Malewarebytes (neues manuelles Update, kannst du mir dafür den Link geben?) zum untersuchen des PCs?

kira 24.08.2011 17:08
damit wir nicht durcheinander kommen:

1.
Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
  • Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
  • Speichere es auf Deinem Desktop.
  • Doppelklick auf OTL.exe um das Programm auszuführen.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Klicke auf den Button "Bereinigung"
  • OTL fragt eventuell nach einem Neustart.
    Sollte es dies tun, so lasse dies bitte zu.
Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

2.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!
Anleitung:-> GMER - Rootkit Scanner

3.
Kontrolle mit MBR -t, ob Master Boot Record in Ordnung ist (MBR-Rootkit)

Mit dem folgenden Tool prüfen wir, ob sich etwas Schädliches im Master Boot Record eingenistet hat.
  • Downloade die MBR.exe von Gmer und
    kopiere die Datei mbr.exe in den Ordner C:\Windows\system32.
    Falls Du den Ordner nicht sehen kannst, diese Einstellungen in den Ordneroptionen vornehmen.
  • Start => ausführen => cmd (da reinschreiben) => OK
    es öffnet sich eine Eingabeaufforderung.

    Vista- und Windows 7-User: Start => Alle Programme => Zubehör => Rechtsklick auf Eingabeaufforderung und wähle Als Administrator ausführen.
  • Nach dem Prompt (>_) folgenden

    aus der Codebox manuell eingeben oder alternativ den mit STRG + C ins Clipboard kopieren und einfügen.
    Einfügen in der Eingabeaufforderung: in der Titelleiste einen Rechtsklick machen => Bearbeiten => einfügen.

    Code:
    mbr.exe -t > C:\mbr.log & C:\mbr.log
    (Enter drücken)
  • Nach kurzer Zeit wird sich Dein Editor öffnen und die Datei C:\mbr.log beinhalten.
    Bitte kopiere den Inhalt hier in Deinen Thread.

4.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung/virus-protect.org

5.
Systemscan mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.

    http://image.hijackthis.eu/upload/otl_screen_neu.jpg
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

6.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool Ccleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ falls nötig - unter Options settings-> "german" einstellen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

Silvos 24.08.2011 17:31
Antivir meldet beim herunterladen von OTL beim angegeben Link den befall der Datei durch den Trojaner TR/Swisyn.bsgf/1.
Runterladen oder gibt es einen anderes Download-Portal?:wtf:

kira 24.08.2011 18:49
der Link ist nicht Schuld daran, Meldung ignorieren
-> Avira deaktivieren:
in der Taskleiste ist der kleine Kontrollschirm von Antivir. Den mit der rechten Maustaste anklicken und Antivir aktivieren Häkchen weg
dananch bitte nicht vergessen wieder aktivieren!!

Silvos 24.08.2011 20:22
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit quick scan 2011-08-24 21:01:46
Windows 6.0.6000  Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDT725050VLA380 rev.V56OA73A
Running: rgnvtyv7.exe; Driver: C:\Users\JAN-PH~1\AppData\Local\Temp\kxlyrkow.sys


---- Devices - GMER 1.0.15 ----

Device  \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                  853FB1F8
Device  \Driver\atapi \Device\Ide\IdePort0                            853FB1F8
Device  \Driver\atapi \Device\Ide\IdePort1                            853FB1F8
Device  \Driver\atapi \Device\Ide\IdePort2                            853FB1F8
Device  \Driver\atapi \Device\Ide\IdePort3                            853FB1F8
Device  \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1                  853FB1F8
Device  \Driver\a8zcbz4z \Device\Scsi\a8zcbz4z1                      864F11F8
Device  \Driver\a8zcbz4z \Device\Scsi\a8zcbz4z1Port5Path0Target0Lun0  864F11F8
Device  \FileSystem\Ntfs \Ntfs                                        853FC1F8

---- EOF - GMER 1.0.15 ----
das war GMER.

3.)
Code:
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net
Windows 6.0.6000 Disk: Hitachi_HDT725050VLA380 rev.V56OA73A -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll >>UNKNOWN [0x853FB1F8]<<
1 ntkrnlpa!IofCallDriver[0x82427F8E] -> \Device\Harddisk0\DR0[0x855810E0]
3 nt[0x824B0D35] -> ntkrnlpa!IofCallDriver[0x82427F8E] -> [0x8547AF18]
5 acpi[0x8066932A] -> ntkrnlpa!IofCallDriver[0x82427F8E] -> \Device\Ide\IdeDeviceP0T0L0-0[0x8542B4E8]
\Driver\atapi[0x8542FB58] -> IRP_MJ_CREATE -> 0x853FB1F8
kernel: MBR read successfully
detected disk devices:
detected hooks:
\Driver\atapi -> 0x853fb1f8
user & kernel MBR OK
Warning: possible MBR rootkit infection !

kira 25.08.2011 12:59
Der Prüfung ergeben (zumindest vermutlich), dass das bösartige MBR-Rootkit hat sich im MBR festgesetzt...
Der Master Boot Record (MBR) der ersten Festplatte wird beim Start des Rechners geladen, noch vor dem Betriebssystem. Code, der Dort residiert, kann im Prinzip das Betriebssystem kontrollieren.
wenn Du statt Format C:\ für Systemreinigung entscheidest, dann so geht`s weiter:

1.
TDSSKiller von Kaspersky
  • Lade den TDSSKiller und entpacke das Archiv auf Deinen Desktop.
  • Vergewissere Dich, dass die TDSSKiller.exe direkt auf dem Desktop liegt (nicht in einem Ordner auf dem Desktop).
  • deaktiviere vorübergehend dein AntiVirus-Programm
  • Starte die TDSSKiller.exe durch Doppelklick.
  • Nach Beendigung der Arbeit schlägt das Tool vor, das System neu zu starten.
    Bestätige das ggfs. mit Y(es).
    Beim Hochfahren des Systems führt der Treiber alle geplanten Operationen aus löscht sich danach.
  • Poste mir den Inhalt von C:\TDSSKiller<random>.txt hier in den Thread.
Hier findest Du eine ausführlichere Anleitung.

2.
Dann die mir noch fehlenden Schritte noch bitte (4., 5., und 6.,)

Silvos 25.08.2011 14:55
habe das programm drüberlaufen lassen, es hat aber nur eine verdächtige datei gefunden und schlägt mir laut anleitung deswegen Skip vor? Was soll ich tun? Skippen, Delete oder Copy to quarantain
Service name: sptd
Service type: Kernel Driver (0x1)
Service start: Boot (0x0)
File: c:\windows\system32\drivers\sptd.sys
MD5: 71e276f6d189413266ea2217806597b

ich fahre erstmal mit den anderen Punkten 4-6 weiter:
hier die Logfiles des Malewarebytes nach dem löschen der gefundenen Maleware:
Code:
Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Datenbank Version: 7556

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

25.08.2011 15:29:28
mbam-log-2011-08-25 (15-29-28).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|L:\|)
Durchsuchte Objekte: 472743
Laufzeit: 2 Stunde(n), 23 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 1
Infizierte Dateien: 5

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{A1E29B9C-B581-367D-32B4-BAEF5C48BCF7} (Trojan.ZbotR.Gen) -> Value: {A1E29B9C-B581-367D-32B4-BAEF5C48BCF7} -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4E3E0230AEBB4E96 (Trojan.SpyEyes) -> Value: 4E3E0230AEBB4E96 -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
c:\Recycle.Bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\program files\MegaDev\md-trainers\megatrainer xl\megatrainerxl.exe (Trojan.AVKiller.Gen) -> Quarantined and deleted successfully.
c:\Users\jan-philipp\AppData\Local\temp\jar_cache6807391986305008110.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\jan-philipp\AppData\Local\temp\jar_cache8706192288361086517.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\Users\jan-philipp\AppData\Local\temp\jar_cache8865297215183761472.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Recycle.Bin\config.bin (Trojan.Spyeyes) -> Quarantined and deleted successfully.

Silvos 25.08.2011 15:17
Code:
OTL logfile created on: 25.08.2011 15:52:56 - Run 1
OTL by OldTimer - Version 3.2.26.5    Folder = C:\Users\***p\Downloads\Neuer Ordner (2)
Windows Vista Home Premium Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.17037)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 57,12% Memory free
6,20 Gb Paging File | 4,76 Gb Available in Paging File | 76,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 228,13 Gb Total Space | 3,48 Gb Free Space | 1,52% Space Free | Partition Type: NTFS
Drive D: | 227,87 Gb Total Space | 135,26 Gb Free Space | 59,36% Space Free | Partition Type: NTFS
 
Computer Name: JAN-PHILIPP-PC | User Name: ***p | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.25 15:51:18 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***p\Downloads\Neuer Ordner (2)\OTL.exe
PRC - [2011.08.22 19:25:41 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2011.07.27 15:36:00 | 003,077,528 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
PRC - [2010.07.07 12:29:06 | 000,471,040 | ---- | M] (Stardock Corporation) -- C:\Programme\Stardock\Impulse\Now\ImpulseNow.exe
PRC - [2010.07.04 21:51:26 | 000,017,408 | ---- | M] () -- C:\Programme\Unlocker\UnlockerAssistant.exe
PRC - [2010.04.03 16:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2009.11.24 02:53:58 | 004,781,352 | ---- | M] (Wacom Technology, Corp.) -- C:\Programme\WTouch\WTouchUser.exe
PRC - [2009.11.24 02:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) -- C:\Programme\WTouch\WTouchService.exe
PRC - [2009.11.24 02:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\Pen_Tablet.exe
PRC - [2009.11.24 02:53:56 | 001,823,528 | ---- | M] (Wacom Technology, Corp.) -- C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2009.08.31 22:46:04 | 000,339,456 | ---- | M] (UASSOFT.COM) -- C:\Programme\Mouse Driver\KMProcess.exe
PRC - [2009.08.31 22:00:28 | 001,821,184 | ---- | M] (UASSOFT.COM) -- C:\Programme\Mouse Driver\KMWDSrv.exe
PRC - [2009.08.05 14:55:18 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2009.03.02 13:08:43 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2009.02.26 15:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2008.12.10 11:02:30 | 000,216,520 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\daemon.exe
PRC - [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.06.14 01:02:04 | 000,397,312 | ---- | M] (UASSOFT.COM) -- C:\Programme\Mouse Driver\KMCONFIG.exe
PRC - [2008.05.30 01:22:32 | 000,212,992 | ---- | M] (UASSOFT.COM) -- C:\Programme\Mouse Driver\StartAutorun.exe
PRC - [2008.02.03 10:55:26 | 001,232,896 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) -- C:\Programme\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
PRC - [2007.12.15 04:26:06 | 001,006,264 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) -- C:\Programme\Symantec\LiveUpdate\AluSchedulerSvc.exe
PRC - [2007.07.13 23:24:16 | 000,178,280 | ---- | M] (CyberLink Corp.) -- C:\Programme\Acer Arcade Live\Acer PlayMovie\PMVService.exe
PRC - [2007.07.06 13:06:52 | 004,669,440 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.04.04 18:54:58 | 000,200,812 | ---- | M] () -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
PRC - [2007.04.04 18:54:08 | 000,266,343 | ---- | M] (CyberLink) -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
PRC - [2007.02.09 07:35:54 | 000,397,312 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
PRC - [2007.02.07 00:04:26 | 000,457,512 | ---- | M] (HiTRSUT) -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
PRC - [2007.02.07 00:04:16 | 000,464,168 | ---- | M] (HiTRUST) -- C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
PRC - [2007.01.31 19:18:42 | 000,053,248 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
PRC - [2007.01.24 10:27:50 | 000,319,488 | ---- | M] () -- C:\Acer\Empowering Technology\SysMonitor.exe
PRC - [2006.12.29 17:51:56 | 000,028,672 | ---- | M] () -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
PRC - [2006.11.02 14:36:04 | 000,895,488 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2006.11.02 14:36:04 | 000,201,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2006.11.02 14:35:47 | 000,197,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\InputPersonalization.exe
PRC - [2006.11.02 14:35:46 | 000,299,520 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\ink\TabTip.exe
PRC - [2006.11.02 11:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.08.22 19:25:40 | 001,846,232 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.07.31 15:49:50 | 000,077,312 | ---- | M] () -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\components\RadioWMPCoreGecko6.dll
MOD - [2011.07.27 15:36:00 | 003,077,528 | ---- | M] () -- C:\Programme\Pando Networks\Media Booster\PMB.exe
MOD - [2010.07.07 12:29:06 | 000,024,576 | ---- | M] () -- C:\Programme\Stardock\Impulse\Now\SDSecurity.dll
MOD - [2010.07.04 23:32:36 | 000,004,608 | ---- | M] () -- C:\Programme\Unlocker\UnlockerHook.dll
MOD - [2010.07.04 21:51:26 | 000,017,408 | ---- | M] () -- C:\Programme\Unlocker\UnlockerAssistant.exe
MOD - [2010.06.28 19:33:29 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\cccf9e783368088a6d357cc45f446478\Accessibility.ni.dll
MOD - [2010.06.28 19:33:03 | 001,712,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\bce81bf63e63ec436b4bc274c08f842d\Microsoft.VisualBasic.ni.dll
MOD - [2009.10.18 01:11:08 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1941d7639299344ae28fb6b23da65247\System.Windows.Forms.ni.dll
MOD - [2009.10.18 01:10:56 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6312464f64727a2a50d5ce3fd73ad1bb\System.Drawing.ni.dll
MOD - [2009.10.18 01:09:24 | 007,868,416 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\52e1ea3c7491e05cda766d7b3ce3d559\System.ni.dll
MOD - [2009.10.18 01:09:13 | 011,486,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\17f572b09facdc5fda9431558eb7a26e\mscorlib.ni.dll
MOD - [2008.12.10 11:02:30 | 000,593,352 | ---- | M] () -- C:\Programme\DAEMON Tools Lite\DaemonPlugin.dll
MOD - [2008.06.16 09:06:10 | 000,053,248 | ---- | M] () -- C:\Programme\Mouse Driver\MouseHook.dll
MOD - [2007.04.04 18:54:58 | 000,200,812 | ---- | M] () -- C:\Programme\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
MOD - [2007.03.29 12:17:42 | 000,106,496 | ---- | M] () -- C:\Programme\Mouse Driver\keydll.dll
MOD - [2007.02.06 23:56:30 | 000,028,672 | ---- | M] () -- C:\Windows\System32\BatchCrypto.dll
MOD - [2007.02.06 23:52:08 | 000,063,488 | ---- | M] () -- C:\Windows\System32\ShowErrMsg.dll
MOD - [2007.01.24 10:27:50 | 000,319,488 | ---- | M] () -- C:\Acer\Empowering Technology\SysMonitor.exe
MOD - [2006.12.10 21:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006.12.10 21:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (LiveUpdate Notice Ex)
SRV - File not found [Auto | Stopped] --  -- (CLTNetCnService)
SRV - [2010.04.03 16:59:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009.11.24 02:53:58 | 000,113,448 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\WTouch\WTouchService.exe -- (WTouchService)
SRV - [2009.11.24 02:53:56 | 004,497,704 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Windows\System32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2009.08.31 22:00:28 | 001,821,184 | ---- | M] (UASSOFT.COM) [Auto | Running] -- C:\Programme\Mouse Driver\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2009.08.24 14:47:07 | 000,378,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- winhttp.dll -- (WinHttpAutoProxySvc)
SRV - [2009.08.05 14:55:18 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.05.13 16:48:18 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008.05.22 01:57:50 | 000,092,792 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - [2008.01.29 17:38:32 | 000,583,048 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe -- (LiveUpdate Notice Service)
SRV - [2007.12.15 04:26:05 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.09.26 11:53:56 | 002,999,664 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_2.EXE -- (LiveUpdate)
SRV - [2007.09.26 11:53:56 | 000,554,352 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe -- (Automatisches LiveUpdate - Scheduler)
SRV - [2007.04.04 18:54:08 | 000,266,343 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe -- (Acer HomeMedia Connect Service)
SRV - [2007.02.07 00:04:26 | 000,457,512 | ---- | M] (HiTRSUT) [Auto | Running] -- C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe -- (eDataSecurity Service)
SRV - [2007.01.31 19:18:42 | 000,053,248 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe -- (eRecoveryService)
SRV - [2006.12.29 17:51:56 | 000,028,672 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.07.06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2010.04.04 00:55:31 | 011,573,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.01.17 14:41:38 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.11.08 16:05:22 | 000,278,984 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2009.08.28 01:06:32 | 000,016,168 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2009.05.20 21:54:06 | 000,013,736 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2009.05.11 10:12:20 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.04.29 23:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009.04.29 23:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFilter)
DRV - [2009.04.19 12:10:19 | 000,717,296 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.03.30 10:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009.02.13 12:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2009.01.18 22:39:09 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.05.22 01:57:38 | 000,034,576 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)
DRV - [2008.03.13 15:14:30 | 000,018,048 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2007.08.31 16:24:26 | 000,039,408 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Programme\Acer Arcade Live\Acer PlayMovie\000.fcl -- ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796})
DRV - [2007.05.02 12:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007.05.02 12:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007.05.02 12:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007.03.14 16:04:28 | 002,427,392 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007.02.16 21:12:36 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2006.12.07 19:12:02 | 000,076,584 | ---- | M] () [Kernel | Auto | Running] -- C:\Acer\Empowering Technology\eRecovery\int15.sys -- (int15)
DRV - [2006.10.30 05:22:26 | 000,008,192 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2005.08.18 00:00:00 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavalys\EVEREST Home Edition\kerneld.wnt -- (EverestDriver)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.1
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:1.1.10
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.2.9&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.3: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.08.22 19:25:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.28 21:55:06 | 000,000,000 | ---D | M]
 
[2009.04.01 11:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Extensions
[2008.12.26 23:51:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\extensions
[2011.08.18 20:21:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions
[2010.10.18 19:03:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.08.02 00:34:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.08.14 18:08:04 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.06.20 19:10:47 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.08.18 20:21:58 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.08.15 12:24:45 | 000,000,000 | ---D | M] ("PennerBar") -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\pennerbar3@pennergame.de
[2011.05.01 04:00:17 | 000,000,000 | ---D | M] (Personas) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\personas@christopher.beard
[2011.08.18 20:21:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***p\AppData\Roaming\mozilla\Firefox\Profiles\px87azt0.default\extensions\trash
[2011.08.22 13:19:18 | 000,000,950 | ---- | M] () -- C:\Users\***p\AppData\Roaming\Mozilla\Firefox\Profiles\px87azt0.default\searchplugins\icqplugin-2.xml
[2011.08.21 18:29:13 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.08.21 18:29:14 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.05.13 11:17:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\USERS\JAN-PHILIPP\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PX87AZT0.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2011.08.22 19:25:41 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010.04.12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.05.28 21:55:01 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.05.28 21:55:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.05.28 21:55:01 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.05.28 21:55:01 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.05.28 21:55:01 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.05.28 21:55:01 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Programme\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} -  File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\System32\ActiveToolBand.dll (HiTRUST)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} -  File not found
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar mit Pop-Up-Blocker) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKCU\..\Toolbar\WebBrowser: (Grab Pro) - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Programme\Orbitdownloader\GrabPro.dll ()
O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe ()
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Live\Acer PlayMovie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Symantec PIF AlertEng] C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe (Symantec Corporation)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe (Acer Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Acer Tour Reminder]  File not found
O4 - HKCU..\Run: [avupdate]  File not found
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd)
O4 - HKCU..\Run: [GameShadow]  File not found
O4 - HKCU..\Run: [monjx]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - Startup: C:\Users\***p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Impulse Now.lnk = C:\Programme\Stardock\Impulse\Now\ImpulseNow.exe (Stardock Corporation)
O4 - Startup: C:\Users\***p\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Encarta Suchleiste - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Programme\Common Files\microsoft shared\Encarta Search Bar\ENCSBAR.DLL (Microsoft Corporation)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.237.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\***p\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\***p\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O29 - HKLM SecurityProviders - (credssp.dll) - credssp.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{5b27f525-a57e-11e0-8cd2-001c255399df}\Shell\AutoRun\command - "" = K:\Menu.exe
O33 - MountPoints2\{c88cd6a7-aae8-11e0-8a92-001c255399df}\Shell\AutoRun\command - "" = K:\RunClubSanDisk.exe
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.25 15:41:30 | 001,406,768 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\***p\Desktop\TDSSKiller.exe
[2011.08.24 21:01:00 | 000,000,000 | ---D | C] -- C:\Users\***p\Neuer Ordner (2)
[2011.08.21 18:28:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.08.16 12:33:40 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.08.14 00:32:21 | 000,000,000 | ---D | C] -- C:\Users\***p\Neuer Ordner (1)
[2011.07.31 00:29:54 | 000,000,000 | ---D | C] -- C:\Users\***p\Documents\Story File01
[2011.07.28 18:39:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Riot Games
[2011.07.28 16:53:35 | 000,000,000 | ---D | C] -- C:\Users\***p\riotsGamesLogs
[2011.07.27 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Roaming\LolClient
[2011.07.27 19:04:11 | 000,000,000 | ---D | C] -- C:\Riot Games
[2011.07.27 15:36:04 | 000,000,000 | ---D | C] -- C:\Users\***p\AppData\Local\PMB Files
[2011.07.27 15:36:04 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011.07.27 15:34:54 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2011.07.26 16:22:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2007.12.15 04:46:01 | 000,016,384 | ---- | C] ( ) -- C:\Windows\System32\ClearEvent.exe
[2007.05.07 01:07:10 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\Interop.Shell32.dll
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.25 15:32:27 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.08.25 15:32:26 | 000,053,605 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.08.25 15:32:00 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 15:32:00 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.08.25 15:31:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.08.25 15:31:50 | 3220,692,992 | -HS- | M] () -- C:\hiberfil.sys
[2011.08.24 22:20:40 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
[2011.08.24 21:40:17 | 000,693,536 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.08.24 21:40:17 | 000,654,402 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.08.24 21:40:17 | 000,137,922 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.08.24 21:40:17 | 000,120,738 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.08.24 21:06:59 | 000,089,088 | ---- | M] () -- C:\Windows\System32\mbr.exe
[2011.08.24 20:53:37 | 000,307,088 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.08.22 15:48:36 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\***p\Desktop\TDSSKiller.exe
[2011.08.22 14:34:17 | 138,799,729 | ---- | M] () -- C:\Users\***p\Durarara_GerSub_Episode_17_-_Anime_Proxer_Me.flv
[2011.08.21 20:39:05 | 031,942,512 | ---- | M] () -- C:\Users\***p\_Was liest Du_ mit Cordula Stratmann (21.11.09) 1_2 _Entschu.flv
[2011.08.19 00:21:35 | 245,744,474 | ---- | M] () -- C:\Users\***p\Durarara_GerSub_Episode_15_-_Anime_Proxer_Me.flv
[2011.08.16 12:33:40 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011.08.15 00:48:14 | 000,203,776 | ---- | M] () -- C:\Users\***p\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.08.14 17:36:57 | 000,015,504 | ---- | M] () -- C:\Users\***p\AppData\Local\d3d9caps.dat
[2011.08.12 23:09:57 | 020,851,234 | ---- | M] () -- C:\Users\***p\How to Play _Chasing Cars_ by Snow Patrol on Guitar.flv
[2011.08.12 18:36:20 | 014,764,663 | ---- | M] () -- C:\Users\***p\4d25e3a11693e.flv
[2011.08.12 18:30:56 | 023,498,941 | ---- | M] () -- C:\Users\***p\1_640x480.mp4
[2011.08.11 23:54:38 | 000,801,127 | ---- | M] () -- C:\Users\***p\sample_6a5858b8439c7d4c6a05b54482cda4e9.png
[2011.08.11 23:54:25 | 000,336,536 | ---- | M] () -- C:\Users\***p\36e7d5a79137ffacd4e5898981f1622c.jpeg
[2011.08.11 23:54:19 | 000,464,095 | ---- | M] () -- C:\Users\***p\844a43a8c2b1a961b37a592d1db24464.jpeg
[2011.08.11 23:53:26 | 000,072,251 | ---- | M] () -- C:\Users\***p\9a9e3969cc5677c84de34d6b7127fced.jpeg
[2011.08.11 03:38:30 | 003,894,828 | ---- | M] () -- C:\Users\***p\Set-Fire-to-the-Rain-1.mp3
[2011.08.08 12:26:18 | 051,459,535 | ---- | M] () -- C:\Users\***p\480_739_3NjtZ-C156-.flv
[2011.08.08 12:26:07 | 020,461,291 | ---- | M] () -- C:\Users\***p\480_742_XUFkV-C256-.flv
[2011.08.08 12:13:54 | 023,757,157 | ---- | M] () -- C:\Users\***p\70489.flv
[2011.08.05 23:42:43 | 046,450,903 | ---- | M] () -- C:\Users\***p\4d9d748dbfa83.flv
[2011.08.05 02:26:42 | 000,099,077 | ---- | M] () -- C:\Users\***p\317h5ic.jpg
[2011.08.05 02:25:18 | 001,071,721 | ---- | M] () -- C:\Users\***p\76rt6785r6zugzhujgzui.pdf
[2011.08.04 13:33:39 | 102,367,382 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_12_-_Anime_Proxer_Me.flv
[2011.08.04 12:45:44 | 109,130,445 | ---- | M] () -- C:\Users\***p\» Cute Boy Destruction «.flv
[2011.08.04 12:36:11 | 017,122,649 | ---- | M] () -- C:\Users\***p\vdo313212634323609780059810.mp4.regular.mp4
[2011.08.04 12:23:55 | 096,012,856 | ---- | M] () -- C:\Users\***p\Sekai-ichi Hatsukoi - 11.avi
[2011.08.04 12:09:13 | 062,819,728 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_10_-_Anime_Proxer_Me.flv
[2011.08.04 12:01:16 | 022,847,322 | ---- | M] () -- C:\Users\***p\vdo333903634220122017656250.wmv.flv
[2011.08.04 12:00:28 | 008,271,031 | ---- | M] () -- C:\Users\***p\69935.flv
[2011.08.03 23:26:54 | 062,815,816 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_9_-_Anime_Proxer_Me.flv
[2011.08.03 02:25:51 | 005,223,316 | ---- | M] () -- C:\Users\***p\44a178a7d3198340.flv
[2011.08.01 23:08:55 | 000,141,501 | ---- | M] () -- C:\Users\***p\Documents\london.jpg
[2011.08.01 23:02:05 | 000,071,873 | ---- | M] () -- C:\Users\***p\74625_186147704735919_100000220713856_739459_3251895_n.jpg
[2011.08.01 23:02:00 | 000,071,887 | ---- | M] () -- C:\Users\***p\183335_206771379340218_100000220713856_924929_4473542_n.jpg
[2011.07.28 05:25:33 | 000,002,103 | ---- | M] () -- C:\Users\***p\.recently-used.xbel
[2011.07.26 18:09:07 | 000,000,963 | ---- | M] () -- C:\Users\***p\Desktop\Elsword.lnk
[7 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.24 21:06:59 | 000,089,088 | ---- | C] () -- C:\Windows\System32\mbr.exe
[2011.08.21 23:00:10 | 138,799,729 | ---- | C] () -- C:\Users\***p\Durarara_GerSub_Episode_17_-_Anime_Proxer_Me.flv
[2011.08.21 19:30:27 | 031,942,512 | ---- | C] () -- C:\Users\***p\_Was liest Du_ mit Cordula Stratmann (21.11.09) 1_2 _Entschu.flv
[2011.08.18 23:26:23 | 245,744,474 | ---- | C] () -- C:\Users\***p\Durarara_GerSub_Episode_15_-_Anime_Proxer_Me.flv
[2011.08.12 23:04:56 | 020,851,234 | ---- | C] () -- C:\Users\***p\How to Play _Chasing Cars_ by Snow Patrol on Guitar.flv
[2011.08.12 18:30:00 | 014,764,663 | ---- | C] () -- C:\Users\***p\4d25e3a11693e.flv
[2011.08.12 18:23:01 | 023,498,941 | ---- | C] () -- C:\Users\***p\1_640x480.mp4
[2011.08.11 23:54:37 | 000,801,127 | ---- | C] () -- C:\Users\***p\sample_6a5858b8439c7d4c6a05b54482cda4e9.png
[2011.08.11 23:54:24 | 000,336,536 | ---- | C] () -- C:\Users\***p\36e7d5a79137ffacd4e5898981f1622c.jpeg
[2011.08.11 23:54:18 | 000,464,095 | ---- | C] () -- C:\Users\***p\844a43a8c2b1a961b37a592d1db24464.jpeg
[2011.08.11 23:53:22 | 000,072,251 | ---- | C] () -- C:\Users\***p\9a9e3969cc5677c84de34d6b7127fced.jpeg
[2011.08.11 03:36:47 | 003,894,828 | ---- | C] () -- C:\Users\***p\Set-Fire-to-the-Rain-1.mp3
[2011.08.08 12:20:13 | 020,461,291 | ---- | C] () -- C:\Users\***p\480_742_XUFkV-C256-.flv
[2011.08.08 12:14:31 | 051,459,535 | ---- | C] () -- C:\Users\***p\480_739_3NjtZ-C156-.flv
[2011.08.08 12:08:41 | 023,757,157 | ---- | C] () -- C:\Users\***p\70489.flv
[2011.08.05 23:28:47 | 046,450,903 | ---- | C] () -- C:\Users\***p\4d9d748dbfa83.flv
[2011.08.05 02:26:28 | 000,099,077 | ---- | C] () -- C:\Users\***p\317h5ic.jpg
[2011.08.05 02:24:28 | 001,071,721 | ---- | C] () -- C:\Users\***p\76rt6785r6zugzhujgzui.pdf
[2011.08.04 13:16:08 | 102,367,382 | ---- | C] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_12_-_Anime_Proxer_Me.flv
[2011.08.04 12:28:40 | 017,122,649 | ---- | C] () -- C:\Users\***p\vdo313212634323609780059810.mp4.regular.mp4
[2011.08.04 12:26:44 | 109,130,445 | ---- | C] () -- C:\Users\***p\» Cute Boy Destruction «.flv
[2011.08.04 11:54:25 | 022,847,322 | ---- | C] () -- C:\Users\***p\vdo333903634220122017656250.wmv.flv
[2011.08.04 11:53:00 | 008,271,031 | ---- | C] () -- C:\Users\***p\69935.flv
[2011.08.04 11:37:38 | 096,012,856 | ---- | C] () -- C:\Users\***p\Sekai-ichi Hatsukoi - 11.avi
[2011.08.04 11:36:35 | 062,819,728 | ---- | C] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_10_-_Anime_Proxer_Me.flv
[2011.08.03 23:08:31 | 062,815,816 | ---- | C] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_9_-_Anime_Proxer_Me.flv
[2011.08.03 15:20:14 | 467,298,304 | ---- | C] () -- C:\Users\***p\gran-s07e16.avi
[2011.08.03 02:07:50 | 005,223,316 | ---- | C] () -- C:\Users\***p\44a178a7d3198340.flv
[2011.08.01 23:08:54 | 000,141,501 | ---- | C] () -- C:\Users\***p\Documents\london.jpg
[2011.08.01 23:02:04 | 000,071,873 | ---- | C] () -- C:\Users\***p\74625_186147704735919_100000220713856_739459_3251895_n.jpg
[2011.08.01 23:01:58 | 000,071,887 | ---- | C] () -- C:\Users\***p\183335_206771379340218_100000220713856_924929_4473542_n.jpg
[2011.07.28 05:25:33 | 000,002,103 | ---- | C] () -- C:\Users\***p\.recently-used.xbel
[2011.07.26 18:09:07 | 000,000,963 | ---- | C] () -- C:\Users\***p\Desktop\Elsword.lnk
[2010.08.03 17:07:09 | 000,003,120 | ---- | C] () -- C:\Windows\System32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
[2010.02.08 07:33:04 | 000,359,320 | ---- | C] () -- C:\Windows\System32\vfprintpthelper.dll
[2009.09.29 17:23:00 | 000,000,292 | ---- | C] () -- C:\Windows\vtmb.ini
[2009.08.24 07:42:33 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.08.24 07:42:29 | 000,053,605 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.05.10 17:14:14 | 000,001,100 | ---- | C] () -- C:\Users\***p\AppData\Local\d3d8caps.dat
[2008.12.27 19:54:06 | 000,000,000 | ---- | C] () -- C:\ProgramData\LauncherAccess.dt
[2008.12.27 19:39:59 | 000,000,059 | ---- | C] () -- C:\Windows\wininit.ini
[2008.12.27 19:34:30 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2008.12.06 14:20:10 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.10.23 11:24:47 | 000,008,999 | ---- | C] () -- C:\ProgramData\LUUnInstall.LiveUpdate
[2008.09.30 20:28:22 | 000,697,862 | ---- | C] () -- C:\Windows\unins000.exe
[2008.09.30 20:28:22 | 000,002,449 | ---- | C] () -- C:\Windows\unins000.dat
[2008.08.04 13:32:45 | 000,164,351 | ---- | C] () -- C:\Windows\hpoins19.dat
[2008.07.01 14:22:01 | 000,218,256 | ---- | C] () -- C:\Windows\War3Unin.dat
[2008.05.22 01:56:36 | 000,053,299 | ---- | C] () -- C:\Windows\System32\pthreadVC.dll
[2008.05.05 19:54:36 | 000,000,000 | ---- | C] () -- C:\Users\***p\AppData\Roaming\wklnhst.dat
[2008.04.30 17:44:24 | 000,027,648 | -HS- | C] () -- C:\Windows\System32\Smab0.dll
[2008.04.30 16:55:45 | 000,408,576 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2008.04.30 16:55:45 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2008.04.30 16:55:45 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2008.04.30 16:55:45 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2008.04.30 16:55:44 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2008.04.30 16:55:44 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2008.03.15 19:06:04 | 000,023,580 | ---- | C] () -- C:\Users\***p\AppData\Roaming\UserTile.png
[2008.03.13 15:14:31 | 000,278,984 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2008.03.13 15:14:30 | 000,018,048 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2008.02.13 20:44:31 | 000,203,776 | ---- | C] () -- C:\Users\***p\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.02.02 23:36:52 | 000,040,960 | R--- | C] () -- C:\Windows\System32\psfind.dll
[2008.02.02 10:05:43 | 000,015,504 | ---- | C] () -- C:\Users\***p\AppData\Local\d3d9caps.dat
[2007.12.15 04:47:03 | 000,000,044 | ---- | C] () -- C:\Windows\Acer(Normal).ini
[2007.12.15 04:47:03 | 000,000,042 | ---- | C] () -- C:\Windows\Acer(Wide).ini
[2007.12.15 04:46:01 | 000,016,384 | ---- | C] () -- C:\Windows\System32\LauncheRyAgentUser.exe
[2007.05.07 10:41:16 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN4.dll
[2007.05.07 09:22:38 | 000,000,834 | ---- | C] () -- C:\Windows\generic.ini
[2007.05.07 09:22:38 | 000,000,130 | ---- | C] () -- C:\Windows\Alaunch.ini
[2007.05.07 09:22:34 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007.05.07 09:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.05.07 09:22:34 | 000,143,676 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007.05.07 01:07:10 | 000,331,776 | ---- | C] () -- C:\Windows\System32\ScrollBarLib.dll
[2007.03.13 22:01:59 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2007.02.06 23:58:10 | 000,204,800 | ---- | C] () -- C:\Windows\System32\NotesActnMenu.dll
[2007.02.06 23:57:58 | 000,266,240 | ---- | C] () -- C:\Windows\System32\NotesExtmngr.dll
[2007.02.06 23:57:20 | 000,086,016 | ---- | C] () -- C:\Windows\System32\MSNSpook.dll
[2007.02.06 23:56:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\BatchCrypto.dll
[2007.02.06 23:52:08 | 000,063,488 | ---- | C] () -- C:\Windows\System32\ShowErrMsg.dll
[2006.12.25 15:44:48 | 000,022,016 | ---- | C] () -- C:\Windows\System32\MailFormat_U.dll
[2006.11.13 05:50:06 | 000,071,680 | ---- | C] () -- C:\Windows\System32\HTCA_SelfExtract.bin
[2006.11.02 17:33:31 | 000,693,536 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,137,922 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,307,088 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,654,402 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,120,738 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 09:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 09:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2001.12.26 15:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll
[2001.09.03 22:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll
[2001.07.30 15:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll
[2001.07.23 21:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll
[1997.11.17 17:13:16 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
 
========== LOP Check ==========
 
[2010.09.26 00:35:39 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Artweaver
[2009.04.19 12:14:36 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools
[2009.04.19 12:15:05 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools Lite
[2009.04.19 12:14:36 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DAEMON Tools Pro
[2011.08.08 01:28:21 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DVDVideoSoft
[2010.08.29 00:17:01 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.03 17:08:44 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\e frontier
[2008.02.02 21:46:38 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\eSobi
[2009.10.14 18:09:24 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\FOG Downloader
[2008.10.23 22:46:39 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\GrabPro
[2011.05.05 01:55:57 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\gtk-2.0
[2011.06.10 12:50:00 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ICQ
[2008.02.23 12:34:05 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ICQ Toolbar
[2011.01.05 21:17:01 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Image Zone Express
[2010.10.10 23:08:30 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\inkscape
[2011.07.27 20:26:59 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\LolClient
[2009.07.07 21:13:29 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Mp3tag
[2011.05.01 21:00:50 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Orbit
[2008.03.15 19:06:04 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\PeerNetworking
[2008.08.07 20:27:33 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Printer Info Cache
[2011.07.23 17:50:25 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\runic games
[2008.12.27 19:56:07 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Samsung
[2009.10.04 16:11:44 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Sierra
[2010.12.08 20:56:18 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Smith Micro
[2009.01.04 22:57:03 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\SPORE
[2010.07.04 19:18:47 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Stardock
[2010.07.20 00:13:19 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\SYSTEMAX Software Development
[2008.05.05 19:54:43 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Template
[2010.05.28 23:03:46 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\TS3Client
[2010.11.01 23:03:26 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\ultrastardx
[2010.08.04 16:42:32 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Vion
[2010.08.04 23:25:08 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\Woix
[2010.08.02 20:42:51 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\WTouch
[2011.08.02 16:14:21 | 000,000,000 | ---D | M] -- C:\Users\***p\AppData\Roaming\X-Chat 2
[2011.08.25 15:30:41 | 000,032,524 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.08.24 22:20:40 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{370CB0A2-32DD-42F6-A071-83FBF2BE3D73}.job
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011.02.25 00:27:57 | 010,756,096 | ---- | M] ()(C:\Users\***p\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***p\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011.02.25 00:27:34 | 010,756,096 | ---- | C] ()(C:\Users\***p\Documents\Sound Horizon - ?????? [????].mp3) -- C:\Users\***p\Documents\Sound Horizon - 朝と夜の物語 [中文字幕].mp3
[2011.02.25 00:10:19 | 005,654,528 | ---- | M] ()(C:\Users\***p\Documents\?????.mp3) -- C:\Users\***p\Documents\黒の預言書.mp3
[2011.02.25 00:10:06 | 005,654,528 | ---- | C] ()(C:\Users\***p\Documents\?????.mp3) -- C:\Users\***p\Documents\黒の預言書.mp3
[2011.02.25 00:08:35 | 009,170,944 | ---- | M] ()(C:\Users\***p\Documents\??????.mp3) -- C:\Users\***p\Documents\呪われし宝石.mp3
[2011.02.25 00:08:12 | 009,170,944 | ---- | C] ()(C:\Users\***p\Documents\??????.mp3) -- C:\Users\***p\Documents\呪われし宝石.mp3
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\***p\pt-ncis.s02e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\Navy CIS S02E12 - Doppeltes Spiel(Doppelgänger).avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\Junjou Romantica - 01.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e14.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e13.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e12.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e11.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e10.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e09.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e08.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gwl-garden_state.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e13.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e11.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e10.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e08.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s06e21.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\fme-tpp.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\48895fc123f5fcuteyoungtwinks.mp4:TOC.WMV

< End of report >

kira 25.08.2011 19:26
Schau Dir bitte nochmal diese Anleitung an:-> http://www.trojaner-board.de/82358-t...tml#post640150

Silvos 26.08.2011 22:31
ich habs mir durchgelesen, und da steht "bei verdächtiger Maleware ist Skip standart". Aber sie ist ja eben nicht bloss verdächtig. Also Cure oder Delete (hab Angst das bei Delete später was wichtiges fehlt).

kira 27.08.2011 05:44
dein System hochgradigverseucht, so oder so...entweder installierst es neu, oder alle von mir empfohlenen Maßnahmen abarbeitest
Du musst dich entscheiden!
-> Backdoor-Trojaner + vermutlich dein MBR auch durch ein Rootkit unter Kontrolle gebracht worden

Silvos 27.08.2011 11:59
Entschuldigung, ich will mich ja nicht so blöd anstellen, aber ich weiß immer noch nicht ob ich das gefundene Rootkit jetzt löschen oder die Datei Wiederherstellen (Cure) soll... :/ das war doch bloss meine Frage... und die anderen Schritte habe ich ja abgearbeitet.
Zitat:
-> Backdoor-Trojaner + vermutlich dein MBR auch durch ein Rootkit unter Kontrolle gebracht worden
also kann es sein das dieses Rootkit auch so manches anstellt, gut, aber wie verfahre ich jetzt weiter. In der Anleitung stand auch nix spezifisches.

kira 27.08.2011 20:16
Zitat:
Zitat von Silvos (Beitrag 697064)
...ob ich das gefundene Rootkit jetzt löschen
ja, löschen lassen!

Silvos 27.08.2011 23:18
so gelöscht. Scheint wohl mit dem vor Jahren installierten Demon Tools zusammen gehangen zu habenm, dieses meldet jetzt andauert Keneldebugging deaktivieren -> sofort gelöscht, braucht ich sowiso nicht.

Noch etwas was ich machen soll? Irgendwelche Tipps?

kira 28.08.2011 08:45
1.
Deinstalliere unter `Start→ Systemsteuereung→ Ändern/Entfernen...`
Code:
Ask Toolbar - Adware -Toolbar
Bestandteile der Standardinstallation vieler Freeware-Programme und teilweise sogar von kostenpflichtigen Programmen. Daher:
Immer die benutzerdefinierte Installation wählen, nicht die Standardinstallation, weil dann oft Sachen mitinstalliert werden, die man nicht braucht oder nicht möchte.
Bei Installation die Lizenzbestimmungen immer lesen, und nicht sofort überall den Haken setzen, weil damit stimmt man nämlich zu, dass Adware (Werbe-Pop-ups) durch Partnerprogrammen, Sponsoren etc - mitinstalliert wird, weil sich Freeware damit finanziert.
in diese Kategorie gehören noch einige, wie z.B: -> Unerwünschte Toolbars deinstallieren

2.
ALTE VERSION!!!:
Code:
Logfile of HijackThis 2.0.2
Die neue Version gibt es hier:
also lösche/deinstalliere HijackThis "2.0.2." und lade Dir erneut von hier TrendMicro™ HijackThis™/Version 2.0.4 herunter
nur installieren, kein Logfiles erstellen!

3.
Zitat:
Yahoo! Toolbar
wenn nicht benötigst, kannst deinstallieren
meiste Toolbars bzw Browserhelper wollen sich doch nur wichtig machen;)

4.
Zitat:
Symantec/Norton
verwendest Du nicht mehr oder?
Deinstallationshinweise hier->AV Deinstallations Hinweise

5.
Deine Javaversion ist nicht aktuell!
Da aufgrund alter Sicherheitslücken ist Java sehr anfällig, deinstalliere zunächst alle vorhandenen Java-Versionen:
→ Systemsteuerung → Software → deinstallieren...
→ Rechner neu aufstarten
→ Downloade nun die Offline-Version von Java Version 6 Update 26 von Oracle herunter
Achte darauf, eventuell angebotene Toolbars abwählen (den Haken bei der Toolbar entfernen)!

6.
Adobe Reader aktualisieren :
- Bei Installation aufpassen/mitlesen!: Wenn irgendeine Software, Toolbar etc angeboten wird, bitte abwählen! - (z.B "McAfee Security Scan Plus")
Adobe Reader
Oder: Adobe starten-> gehe auf "Hilfe"-> "Nach Update suchen..."

7.
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
O4 - HKLM..\Run: [KMCONFIG]  File not found
O4 - HKCU..\Run: [avupdate]  File not found
O4 - HKCU..\Run: [GameShadow]  File not found
O4 - HKCU..\Run: [monjx]  File not found
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{5b27f525-a57e-11e0-8cd2-001c255399df}\Shell\AutoRun\command - "" = K:\Menu.exe
O33 - MountPoints2\{c88cd6a7-aae8-11e0-8a92-001c255399df}\Shell\AutoRun\command - "" = K:\RunClubSanDisk.exe
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fe623350-d0fc-11dc-b028-806e6f6e6963}\Shell\AutoRun\command - "" = E:\0data\cbs.exe
[2010.08.03 17:07:09 | 000,003,120 | ---- | C] () -- C:\Windows\System32\6ffdbcaf-f6c1-42d3-a4a9-c7957224a70b.dll
@Alternate Data Stream - 64 bytes -> C:\Users\***p\pt-ncis.s02e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\Navy CIS S02E12 - Doppeltes Spiel(Doppelgänger).avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\Junjou Romantica - 01.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e14.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e13.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e12.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e11.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e10.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e09.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e08.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\himym-satws-s01e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gwl-garden_state.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e13.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e11.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e10.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e08.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s07e07.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\gran-s06e21.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\fme-tpp.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***p\48895fc123f5fcuteyoungtwinks.mp4:TOC.WMV

:Commands
[purity]
[emptytemp]

8.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

9.
Dir bekannte Einträge?:
Code:
[2011.08.22 14:34:17 | 138,799,729 | ---- | M] () -- C:\Users\***p\Durarara_GerSub_Episode_17_-_Anime_Proxer_Me.flv
[2011.08.21 20:39:05 | 031,942,512 | ---- | M] () -- C:\Users\***p\_Was liest Du_ mit Cordula Stratmann (21.11.09) 1_2 _Entschu.flv
[2011.08.19 00:21:35 | 245,744,474 | ---- | M] () -- C:\Users\***p\Durarara_GerSub_Episode_15_-_Anime_Proxer_Me.flv
[2011.08.12 23:09:57 | 020,851,234 | ---- | M] () -- C:\Users\***p\How to Play _Chasing Cars_ by Snow Patrol on Guitar.flv
[2011.08.12 18:36:20 | 014,764,663 | ---- | M] () -- C:\Users\***p\4d25e3a11693e.flv
[2011.08.12 18:30:56 | 023,498,941 | ---- | M] () -- C:\Users\***p\1_640x480.mp4
[2011.08.11 23:54:38 | 000,801,127 | ---- | M] () -- C:\Users\***p\sample_6a5858b8439c7d4c6a05b54482cda4e9.png
[2011.08.11 23:54:25 | 000,336,536 | ---- | M] () -- C:\Users\***p\36e7d5a79137ffacd4e5898981f1622c.jpeg
[2011.08.11 23:54:19 | 000,464,095 | ---- | M] () -- C:\Users\***p\844a43a8c2b1a961b37a592d1db24464.jpeg
[2011.08.11 23:53:26 | 000,072,251 | ---- | M] () -- C:\Users\***p\9a9e3969cc5677c84de34d6b7127fced.jpeg
[2011.08.11 03:38:30 | 003,894,828 | ---- | M] () -- C:\Users\***p\Set-Fire-to-the-Rain-1.mp3
[2011.08.08 12:26:18 | 051,459,535 | ---- | M] () -- C:\Users\***p\480_739_3NjtZ-C156-.flv
[2011.08.08 12:26:07 | 020,461,291 | ---- | M] () -- C:\Users\***p\480_742_XUFkV-C256-.flv
[2011.08.08 12:13:54 | 023,757,157 | ---- | M] () -- C:\Users\***p\70489.flv
[2011.08.05 23:42:43 | 046,450,903 | ---- | M] () -- C:\Users\***p\4d9d748dbfa83.flv
[2011.08.05 02:26:42 | 000,099,077 | ---- | M] () -- C:\Users\***p\317h5ic.jpg
[2011.08.05 02:25:18 | 001,071,721 | ---- | M] () -- C:\Users\***p\76rt6785r6zugzhujgzui.pdf
[2011.08.04 13:33:39 | 102,367,382 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_12_-_Anime_Proxer_Me.flv
[2011.08.04 12:45:44 | 109,130,445 | ---- | M] () -- C:\Users\***p\» Cute Boy Destruction «.flv
[2011.08.04 12:36:11 | 017,122,649 | ---- | M] () -- C:\Users\***p\vdo313212634323609780059810.mp4.regular.mp4
[2011.08.04 12:23:55 | 096,012,856 | ---- | M] () -- C:\Users\***p\Sekai-ichi Hatsukoi - 11.avi
[2011.08.04 12:09:13 | 062,819,728 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_10_-_Anime_Proxer_Me.flv
[2011.08.04 12:01:16 | 022,847,322 | ---- | M] () -- C:\Users\***p\vdo333903634220122017656250.wmv.flv
[2011.08.04 12:00:28 | 008,271,031 | ---- | M] () -- C:\Users\***p\69935.flv
[2011.08.03 23:26:54 | 062,815,816 | ---- | M] () -- C:\Users\***p\Sekai_Ichi_Hatsukoi_EngSub_Episode_9_-_Anime_Proxer_Me.flv
[2011.08.03 02:25:51 | 005,223,316 | ---- | M] () -- C:\Users\***p\44a178a7d3198340.flv
[2011.08.01 23:08:55 | 000,141,501 | ---- | M] () -- C:\Users\***p\Documents\london.jpg
[2011.08.01 23:02:05 | 000,071,873 | ---- | M] () -- C:\Users\***p\74625_186147704735919_100000220713856_739459_3251895_n.jpg
[2011.08.01 23:02:00 | 000,071,887 | ---- | M] () -- C:\Users\***p\183335_206771379340218_100000220713856_924929_4473542_n.jpg
Zitat:
► Berichte mir kurz über alle Umsetzungsschritte, die Du erledigt hast!

Silvos 28.08.2011 20:17
wie sehe ich welche Version von Norton ich habe? das war schon von anfang an auf dem Pc drauf. btw zu den Einträgen, das meiste was in meinem Ordner war (benutzername hab ich vergessen zu ***) hab ich in die externe Verfrachtet, mein PC hat jetzt viel mehr Platz.

Sehe aber seit neustem unsichtbare Ordner wie kann ich das ändern?

kira 29.08.2011 06:53
Rechtsklick drauf-> Eigenschaften...

Zitat:
Zitat von Silvos (Beitrag 697419)
Sehe aber seit neustem unsichtbare Ordner wie kann ich das ändern?
was meinst genau?

Silvos 29.08.2011 16:54
ich sehe unsichtbare (also mit der Eigenschaft versteckt) Dateien und Ordner. Das war doch irgendwie unter Einstellungen von Ordnern und dann ein Häkechen bei "versteckte Ordner sehen" oder?

kira 30.08.2011 06:27
meinst:
Versteckte - und Systemdateien
System-Dateien und -Ordner unter XP und Vista sichtbar machen
kannst wieder rückgängig machen!


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:35 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131