Trojaner-Board
Seite 1 von 4 1 23 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Backdoorprogramm BDS/Cycbot.176128.56 (https://www.trojaner-board.de/106254-backdoorprogramm-bds-cycbot-176128-56-a.html)

Rheingold 15.12.2011 08:23
Backdoorprogramm BDS/Cycbot.176128.56
 
Hallo,
avira hat heute den Virus BDS/Cycbot.176128.56 bei mir gefunden. Ist jetzt noch in der Quarantäne.
Außerdem habe ich seit gestern das Problem, dass ich wenn ich bei google auf einen link klicke auf eine völlig andere Seite geführt werde.

Wer kann mir helfen?

Habe Windows 7, 64bit. Weitere Angaben folgen noch.

Viele Grüße
Rheingold

kira 15.12.2011 08:51
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde - falls MBAM meldet in C:\System Volume Information - den Haken bitte entfernen - markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung

2.
Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

3.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

4.
Mache bitte ein Rechtsklick auf den AntiVir-Schirm in der Taskleiste → AntiVir starten → Übersicht → Ereignisse
jeden Fund markieren → Rechtsklick auf Funde → Ereignis(se) exportieren
und als Ereignisse.txt auf dem Desktop speichern und den Inhalt hier posten.

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

Rheingold 15.12.2011 10:38
Liebe Kira, vielen Dank für deine Antwort.
1. defogger hat, glaube ich, nicht funktioniert. Hier der defogger disable log:

Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 08:41 on 15/12/2011 (Jasmina)
Rest folgt.

Viele Grüße
Jasmina

Malwarebytes im Anhang
OTL muss ich noch mal laufen lassen, logfilge ist nicht mehr lesbar.


Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-

2. OTL

Rheingold 15.12.2011 11:59
sorry, muss zum job. bis später, jasmina

Rheingold 16.12.2011 09:38
Code:
Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8377

Windows 6.1.7601 Service Pack 1
Internet Explorer 8.0.7601.17514

15.12.2011 21:45:19
mbam-log-2011-12-15 (21-45-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 479185
Laufzeit: 1 Stunde(n), 2 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 3
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 11

Infizierte Speicherprozesse:
c:\Users\administrator\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> 4112 -> Unloaded process successfully.
c:\program files (x86)\LP\A7CB\737.exe (Trojan.Dropper.PE4) -> 4652 -> Unloaded process successfully.
c:\program files (x86)\57168\lvvm.exe (Trojan.Dropper.PE4) -> 5224 -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\737.exe (Trojan.Dropper.PE4) -> Value: 737.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig (Windows.Tool.Disabled) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
c:\Users\nico.dell-pc.000\m-1-25-5432-6437-5685 (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

Infizierte Dateien:
c:\Users\administrator\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\program files (x86)\LP\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\program files (x86)\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\firefox.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\B8457\6D1A7.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\Jasmina\AppData\Roaming\microsoft\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\firefox.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\57168\lvvm.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\AppData\Roaming\microsoft\A7CB\737.exe (Trojan.Dropper.PE4) -> Quarantined and deleted successfully.
c:\Users\nico.dell-pc.000\m-1-25-5432-6437-5685\winmgr.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

Rheingold 16.12.2011 09:42
Code:
OTL logfile created on: 15.12.2011 19:58:30 - Run 8
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Administrator\Desktop\Virus\OTL
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 52,57% Memory free
7,79 Gb Paging File | 5,89 Gb Available in Paging File | 75,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 235,24 Gb Total Space | 112,40 Gb Free Space | 47,78% Space Free | Partition Type: NTFS
Drive D: | 215,77 Gb Total Space | 206,35 Gb Free Space | 95,63% Space Free | Partition Type: NTFS
 
Computer Name: DELL-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Administrator\Desktop\Virus\OTL\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\57168\lvvm.exe ()
PRC - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
PRC - C:\Program Files (x86)\LP\A7CB\737.exe ()
PRC - C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
PRC - C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
PRC - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
PRC - C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG)
PRC - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe ()
PRC - C:\Windows\tray\wintmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\ccsync.exe (Salfeld Computer)
PRC - C:\Windows\SysWOW64\cchservice.exe (Salfeld Computer)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\57168\lvvm.exe ()
MOD - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
MOD - C:\Program Files (x86)\LP\A7CB\737.exe ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\zlib1.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STPE.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STRegistry.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STFiles.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\STNLS.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\LibXml2.dll ()
MOD - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe ()
MOD - C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (TurboBoost) -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe (Intel(R) Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_b427739.dll ()
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (Kodak AiO Network Discovery Service) -- C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Secunia PSI Agent) -- C:\Program Files (x86)\Secunia\PSI\PSIA.exe (Secunia)
SRV - (Secunia Update Agent) -- C:\Program Files (x86)\Secunia\PSI\sua.exe (Secunia)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (Bluetooth OBEX Service) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation)
SRV - (Bluetooth Media Service) -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Intel Corporation)
SRV - (Bluetooth Device Monitor) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel Corporation)
SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) Intel(R) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (RoxWatch12) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe (Sonic Solutions)
SRV - (RoxMediaDB12OEM) -- C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe (Sonic Solutions)
SRV - (AdobeActiveFileMonitor9.0) -- C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated)
SRV - (sftvsa) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation)
SRV - (sftlist) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation)
SRV - (NOBU) -- C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe (Dell, Inc.)
SRV - (ksupmgr) -- C:\Windows\SysWOW64\ksupmgr.exe (Salfeld Computer)
SRV - (SftService) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (SoftThinks SAS)
SRV - (DBService) -- C:\Program Files (x86)\Common Files\DATA BECKER Shared\DBService.exe (DATA BECKER GmbH & Co KG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AERTFilters) -- C:\Programme\Realtek\Audio\HDA\AERTSr64.exe (Andrea Electronics Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NBVol) -- C:\Windows\SysNative\drivers\NBVol.sys (Nero AG)
DRV:64bit: - (NBVolUp) -- C:\Windows\SysNative\drivers\NBVolUp.sys (Nero AG)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (HPub4DE3) USB Mouse Low Filter Driver_4DE3 (WDF Version) -- C:\Windows\SysNative\drivers\HPub4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HPMo4DE3) Mouse Suite Driver_4DE3 (WDF Version) -- C:\Windows\SysNative\drivers\HPMo4DE3.sys (TPMX Electronics Ltd.)
DRV:64bit: - (nusb3xhc) -- C:\Windows\SysNative\drivers\nusb3xhc.sys (Renesas Electronics Corporation)
DRV:64bit: - (nusb3hub) -- C:\Windows\SysNative\drivers\nusb3hub.sys (Renesas Electronics Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (btmaux) -- C:\Windows\SysNative\drivers\btmaux.sys (Intel Corporation)
DRV:64bit: - (iBtFltCoex) -- C:\Windows\SysNative\drivers\iBtFltCoex.sys (Intel Corporation)
DRV:64bit: - (btmhsf) -- C:\Windows\SysNative\drivers\btmhsf.sys (Intel Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NETwNs64) ___ Intel(R) -- C:\Windows\SysNative\drivers\NETwNs64.sys (Intel Corporation)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (JMCR) -- C:\Windows\SysNative\drivers\jmcr.sys (JMicron Technology Corporation)
DRV:64bit: - (Acceler) -- C:\Windows\SysNative\drivers\Accelern.sys (ST Microelectronics)
DRV:64bit: - (NvStUSB) -- C:\Windows\SysNative\drivers\nvstusb.sys ()
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (TurboB) -- C:\Windows\SysNative\drivers\TurboB.sys (Intel(R) Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (IntcDAud) Intel(R) -- C:\Windows\SysNative\drivers\IntcDAud.sys (Intel(R) Corporation)
DRV:64bit: - (Sftvol) -- C:\Windows\SysNative\drivers\Sftvollh.sys (Microsoft Corporation)
DRV:64bit: - (Sftredir) -- C:\Windows\SysNative\drivers\Sftredirlh.sys (Microsoft Corporation)
DRV:64bit: - (Sftplay) -- C:\Windows\SysNative\drivers\Sftplaylh.sys (Microsoft Corporation)
DRV:64bit: - (Sftfs) -- C:\Windows\SysNative\drivers\Sftfslh.sys (Microsoft Corporation)
DRV:64bit: - (PSI) -- C:\Windows\SysNative\drivers\psi_mf.sys (Secunia)
DRV:64bit: - (stdcfltn) -- C:\Windows\SysNative\drivers\stdcfltn.sys (ST Microelectronics)
DRV:64bit: - (CtClsFlt) -- C:\Windows\SysNative\drivers\CtClsFlt.sys (Creative Technology Ltd.)
DRV:64bit: - (qicflt) -- C:\Windows\SysNative\drivers\qicflt.sys (Quanta Computer)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (acedrv11) -- C:\Windows\SysNative\drivers\acedrv11.sys (Protect Software GmbH)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (StillCam) -- C:\Windows\SysNative\drivers\serscan.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (WimFltr) -- C:\Windows\SysNative\drivers\WimFltr.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (PDNMp50) -- C:\Windows\SysWOW64\drivers\PDNMp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (PDNSp50) -- C:\Windows\SysWOW64\drivers\PDNSp50.sys (Printing Communications Assoc., Inc. (PCAUSA))
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50263
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50263
FF - prefs.js..network.proxy.type: 1
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF:64bit: - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll File not found
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.12.15 11:29:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.11 09:40:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.12.15 11:29:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2011.12.15 11:29:01 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Sunbird\plugins [2011.12.15 11:29:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.11.11 18:53:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 
[2011.05.19 12:42:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions
[2011.05.19 12:42:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011.09.12 11:27:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Administrator\AppData\Roaming\mozilla\Firefox\Profiles\3cers2zs.default\extensions
[2011.11.11 09:40:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.01 08:52:30 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.10.17 08:31:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}
[2011.10.29 10:21:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.12.15 11:29:03 | 000,000,000 | ---D | M] (RealPlayer Browser Record Plugin) -- C:\PROGRAMDATA\REAL\REALPLAYER\BROWSERRECORDPLUGIN\FIREFOX\EXT
[2011.11.11 09:40:26 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.29 10:21:40 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.16 21:59:18 | 000,170,064 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll
[2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.09.12 21:31:56 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [BTMTrayAgent] C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll (Intel Corporation)
O4:64bit: - HKLM..\Run: [DellStage] C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe ()
O4:64bit: - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\SysNative\spool\drivers\x64\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4:64bit: - HKLM..\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe ()
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4:64bit: - HKLM..\Run: [NVHotkey] C:\Windows\SysNative\nvHotkey.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [737.exe] C:\Program Files (x86)\LP\A7CB\737.exe ()
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ChicoSys] C:\Windows\SysWOW64\cc32\webtmr.exe (Salfeld Computer)
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe (Dell, Inc.)
O4 - HKLM..\Run: [Dell Webcam Central] C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [Desktop Disc Tool] C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe ()
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NBAgent] C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe (Sonic Solutions)
O4 - HKLM..\Run: [SMSTray] C:\Program Files (x86)\Samsung\EmoDio\SMSTray.exe (SAMSUNG ELECTRONICS)
O4 - HKLM..\Run: [TkBellExe] C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKU\.DEFAULT..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-18..\Run: [CCWinTray] C:\Windows\tray\wintmr.exe (Salfeld Computer)
O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-500..\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background File not found
O4 - HKLM..\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe (Softthinks)
O4 - HKU\.DEFAULT..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-18..\RunOnce: [KodakHomeCenter] C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe (Eastman Kodak Company)
O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Jasmina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk =  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: RestrictRun = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableClock = 0
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to iPod Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetoipodconverter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Administrator\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000010 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C8601AA9-2FCA-424D-B13E-12984594DCE3}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\S-1-5-21-3230886925-126132133-2629391164-500 Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\S-1-5-21-3230886925-126132133-2629391164-500 Winlogon: Shell - (C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe) -C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - Unable to read "AutoRun" value or value not present!
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.15 11:50:27 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Local\SoftGrid Client
[2011.12.15 11:50:25 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\SoftGrid Client
[2011.12.15 11:47:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.15 11:47:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.12.15 11:35:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.12.15 11:34:51 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.12.15 11:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.12.15 11:34:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2011.12.15 11:29:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\xing shared
[2011.12.15 11:29:01 | 000,198,832 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\rmoc3260.dll
[2011.12.15 11:28:57 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5016.dll
[2011.12.15 11:28:57 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5032.dll
[2011.12.15 11:28:56 | 000,272,896 | ---- | C] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2011.12.15 11:28:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Real
[2011.12.15 11:25:22 | 000,713,472 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe
[2011.12.15 11:22:52 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\4d0d2e25
[2011.12.15 11:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\57168
[2011.12.15 11:19:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\B8457
[2011.12.15 11:14:51 | 009,852,544 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe
[2011.12.15 10:41:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.15 10:41:55 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.15 10:39:52 | 003,552,208 | ---- | C] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe
[2011.12.15 08:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Virus
[2011.12.14 23:09:17 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.14 23:09:17 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.14 23:09:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.14 08:33:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LP
[2011.12.02 16:28:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon
[2011.12.02 16:25:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexon
[2011.12.02 16:22:22 | 000,000,000 | ---D | C] -- C:\ProgramData\NexonEU
[2011.12.02 15:45:54 | 000,000,000 | ---D | C] -- C:\Download
[2011.12.02 15:45:20 | 000,000,000 | ---D | C] -- C:\Nexon
[2011.12.02 15:45:19 | 000,446,464 | ---- | C] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe
[2011.11.24 09:38:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kodak
[2011.11.24 09:36:02 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\spool
[2011.11.24 09:23:29 | 012,713,136 | ---- | C] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe
[2011.11.18 13:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.18 10:33:58 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\Temp
[2011.10.29 11:49:39 | 039,401,336 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2011.10.29 11:04:38 | 010,311,496 | ---- | C] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1152_int_Setup.exe
[2011.10.29 10:10:18 | 000,910,624 | ---- | C] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\jxpiinstall.exe
[2011.10.25 12:17:18 | 009,756,672 | ---- | C] ((c) Phoenix Technologies Ltd. ) -- C:\Program Files\L502X_A__06.exe
[2011.10.17 08:29:10 | 001,739,400 | ---- | C] (Secunia) -- C:\Program Files (x86)\PSISetup2003.exe
[2011.10.17 08:05:48 | 013,885,360 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 7.0.1.exe
[2011.09.29 09:11:38 | 022,482,384 | ---- | C] (Salfeld Computer GmbH                                      ) -- C:\Program Files (x86)\kisi2011.exe
[2011.09.24 17:12:36 | 001,291,624 | ---- | C] (Microsoft Corporation) -- C:\Program Files\wlsetup-web__1_.exe
[2011.09.23 14:09:00 | 000,676,624 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer_1406666_de.exe
[2011.09.22 10:34:36 | 003,089,056 | ---- | C] (Adobe Systems, Inc.) -- C:\Program Files (x86)\install_flash_player.exe
[2011.08.28 11:11:15 | 051,975,388 | ---- | C] (Acresso Software Inc.) -- C:\Program Files (x86)\VSX4_Pro_TBYB.exe.part
[2011.08.27 11:56:04 | 001,228,384 | ---- | C] (Adobe Systems Incorporated) -- C:\Program Files (x86)\PremiereElements_9_LS15.exe
[2011.08.25 17:58:21 | 006,716,353 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Sunbird_Setup_1.0_Beta_1.exe
[2011.07.18 15:59:52 | 013,522,064 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 5.0.1.exe
[2011.05.28 13:13:41 | 014,212,584 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter.exe
[2011.05.28 13:11:38 | 014,563,768 | ---- | C] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToMP3Converter.exe
[2011.05.22 09:35:05 | 021,255,560 | ---- | C] (Skype Technologies S.A.) -- C:\Program Files (x86)\SkypeSetupFull.exe
[2011.05.19 14:37:24 | 081,797,928 | ---- | C] (Apple Inc.) -- C:\Program Files (x86)\iTunes64Setup.exe
[2011.05.19 14:17:51 | 020,240,744 | ---- | C] (The GIMP Team                                              ) -- C:\Program Files (x86)\gimp-2.6.11-i686-setup.exe
[2011.05.19 14:17:11 | 019,735,256 | ---- | C] (                                                            ) -- C:\Program Files (x86)\gimp-2.6.8-x64-setup.exe
[2011.05.19 14:06:00 | 000,767,064 | ---- | C] (NCH Software) -- C:\Program Files (x86)\wpsetup4.57.exe
[2011.05.19 12:34:44 | 000,568,648 | ---- | C] (Google Inc.) -- C:\Program Files (x86)\GoogleEarthSetup.exe
[2011.05.19 12:26:57 | 009,559,320 | ---- | C] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1111_int_Setup.exe
[2011.05.19 12:26:00 | 009,326,056 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Thunderbird Setup 3.1.10.exe
[2011.05.19 12:25:04 | 012,362,480 | ---- | C] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 4.0.1.exe
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.15 19:59:33 | 000,055,163 | ---- | M] () -- C:\Windows\SysWow64\ccsync.err
[2011.12.15 19:57:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job
[2011.12.15 19:45:09 | 000,005,142 | ---- | M] () -- C:\Windows\SysWow64\cchservice.err
[2011.12.15 19:40:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.15 19:40:42 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.15 19:30:21 | 000,001,207 | ---- | M] () -- C:\Windows\SysWow64\excltmp~.dat
[2011.12.15 19:30:16 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.15 19:28:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.15 19:28:47 | 3137,994,752 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.15 19:06:12 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.15 11:47:50 | 000,001,162 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.15 11:35:17 | 000,001,836 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.15 11:29:09 | 000,001,308 | ---- | M] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011.12.15 11:29:01 | 000,198,832 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\rmoc3260.dll
[2011.12.15 11:28:57 | 000,006,656 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5016.dll
[2011.12.15 11:28:57 | 000,005,632 | ---- | M] (RealNetworks, Inc.) -- C:\Windows\SysWow64\pndx5032.dll
[2011.12.15 11:28:56 | 000,272,896 | ---- | M] (Progressive Networks) -- C:\Windows\SysWow64\pncrt.dll
[2011.12.15 11:27:59 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025UA.job
[2011.12.15 11:25:23 | 000,713,472 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe
[2011.12.15 11:22:41 | 001,500,062 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.15 11:22:41 | 000,654,798 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.15 11:22:41 | 000,616,640 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.15 11:22:41 | 000,130,380 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.15 11:22:41 | 000,106,762 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.15 11:18:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job
[2011.12.15 11:14:56 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe
[2011.12.15 10:41:56 | 000,000,824 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.15 10:39:52 | 003,552,208 | ---- | M] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe
[2011.12.15 08:25:41 | 000,353,408 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.15 08:02:34 | 000,000,118 | ---- | M] () -- C:\Windows\SysNative\MRT.INI
[2011.12.14 21:33:43 | 000,000,348 | ---- | M] () -- C:\NET.INI
[2011.12.14 20:28:00 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job
[2011.12.14 20:18:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job
[2011.12.14 08:38:37 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2011.12.14 08:38:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\At2.job
[2011.12.14 08:34:00 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\At1.job
[2011.12.12 16:57:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job
[2011.12.02 16:25:10 | 000,001,632 | ---- | M] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk
[2011.12.02 15:45:20 | 000,000,235 | ---- | M] () -- C:\Windows\SysWow64\nxEuUninstall.bat
[2011.12.02 15:45:19 | 000,446,464 | ---- | M] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe
[2011.11.24 09:39:41 | 000,002,209 | ---- | M] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011.11.24 09:23:39 | 012,713,136 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe
[2011.11.18 13:07:22 | 000,002,265 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[10 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.15 18:48:38 | 000,054,813 | ---- | C] () -- C:\Windows\SysWow64\ccsync.err
[2011.12.15 11:47:50 | 000,001,162 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.12.15 11:35:17 | 000,001,836 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2011.12.15 11:29:09 | 000,001,308 | ---- | C] () -- C:\Users\Public\Desktop\RealPlayer.lnk
[2011.12.15 10:41:56 | 000,000,824 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.15 08:02:34 | 000,000,118 | ---- | C] () -- C:\Windows\SysNative\MRT.INI
[2011.12.14 08:37:13 | 000,000,390 | ---- | C] () -- C:\Windows\tasks\At2.job
[2011.12.14 08:33:19 | 000,000,408 | ---- | C] () -- C:\Windows\tasks\At1.job
[2011.12.02 16:25:10 | 000,001,632 | ---- | C] () -- C:\Users\Public\Desktop\Combat Arms EU.lnk
[2011.12.02 15:45:20 | 000,000,235 | ---- | C] () -- C:\Windows\SysWow64\nxEuUninstall.bat
[2011.11.24 09:39:41 | 000,002,209 | ---- | C] () -- C:\Users\Public\Desktop\KODAK AiO Home Center.lnk
[2011.11.18 13:07:22 | 000,002,265 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2011.11.11 07:32:42 | 001,527,140 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.10.29 09:54:07 | 001,019,816 | ---- | C] () -- C:\Program Files\DELL_DELL-DIGITAL-DELIVERY_A05_R313622.exe
[2011.10.10 16:51:50 | 000,155,536 | ---- | C] () -- C:\Windows\SysWow64\dllcinx.exe
[2011.10.10 16:51:48 | 000,000,600 | ---- | C] () -- C:\Windows\SysWow64\nochook.ini
[2011.10.03 13:41:52 | 000,247,053 | ---- | C] () -- C:\Program Files (x86)\mp3DC213.exe
[2011.09.29 09:19:37 | 000,001,207 | ---- | C] () -- C:\Windows\SysWow64\excltmp~.dat
[2011.09.29 09:18:42 | 000,000,141 | -H-- | C] () -- C:\Windows\SysWow64\ctlsw.ini
[2011.09.29 09:18:42 | 000,000,102 | ---- | C] () -- C:\Windows\SysWow64\SWCTL.DLL
[2011.09.29 09:18:40 | 000,009,368 | ---- | C] () -- C:\Windows\SysWow64\drivers\mchccinj.sys
[2011.09.29 08:11:44 | 000,124,416 | ---- | C] () -- C:\Windows\SysWow64\dXCtrls.dll
[2011.09.29 08:11:43 | 000,544,256 | ---- | C] () -- C:\Windows\SysWow64\janGraphics.dll
[2011.09.29 07:55:01 | 003,103,511 | ---- | C] () -- C:\Program Files (x86)\kcsetup8.exe
[2011.09.23 14:05:53 | 021,073,936 | ---- | C] () -- C:\Program Files (x86)\vlc-1.1.11-win32.exe
[2011.09.23 12:51:28 | 000,003,027 | ---- | C] () -- C:\Program Files (x86)\Français.lng
[2011.09.23 12:51:28 | 000,002,946 | ---- | C] () -- C:\Program Files (x86)\Español.lng
[2011.09.23 12:51:28 | 000,002,920 | ---- | C] () -- C:\Program Files (x86)\Italiano.lng
[2011.09.23 12:51:28 | 000,002,699 | ---- | C] () -- C:\Program Files (x86)\Deutsch.lng
[2011.09.23 12:51:28 | 000,002,553 | ---- | C] () -- C:\Program Files (x86)\Suomi.lng
[2011.09.23 12:40:52 | 023,773,184 | ---- | C] () -- C:\Program Files (x86)\PXCViewer98_x64.msi
[2011.09.23 12:27:47 | 001,376,768 | ---- | C] () -- C:\Program Files (x86)\7z920-x64.msi
[2011.09.16 06:44:01 | 168,166,968 | ---- | C] () -- C:\Program Files (x86)\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.08.28 09:55:59 | 002,466,704 | ---- | C] () -- C:\Program Files (x86)\AdobeDownloadAssistant.exe
[2011.08.27 11:27:07 | 1316,066,539 | ---- | C] () -- C:\Program Files (x86)\PremiereElements_9_LS15.7z
[2011.08.27 11:23:03 | 008,353,800 | ---- | C] () -- C:\Program Files (x86)\Adobe_Premiere_Elements_9-AkamaiDLM.exe
[2011.05.19 14:44:09 | 001,663,693 | ---- | C] () -- C:\Program Files (x86)\winrar-x64-400d.exe
[2011.05.19 14:10:20 | 014,166,016 | ---- | C] () -- C:\Program Files (x86)\wz150gev.msi
[2011.05.19 14:09:07 | 006,088,218 | ---- | C] () -- C:\Program Files (x86)\flash_player.zip
[2011.05.19 13:52:49 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.05.19 12:39:40 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011.05.19 12:28:56 | 052,718,176 | ---- | C] () -- C:\Program Files (x86)\avira_antivir_personal_de.exe
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_89001461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_49001461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_33011461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_ca.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2B071461_8a.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A0F1461_ca.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_ca.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_2A071461_8a.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_14001461_61.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_13011461_aa.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_ca.bin
[2011.05.15 06:48:49 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_110F1461_8a.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_ca.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_aa.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_A3031461_8a.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_ca.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_aa.bin
[2011.05.15 06:48:49 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_83231461_8a.bin
[2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_890F1461_ca.bin
[2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_2B0f1461_ca.bin
[2011.05.15 06:48:49 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_29001461_ca.bin
[2011.05.15 06:48:49 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_180F1461_ca.bin
[2011.05.15 06:48:49 | 000,000,412 | ---- | C] () -- C:\Windows\11317231_18071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_11071461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0B071461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A0F1461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A071461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A031461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_0A011461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_09001461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_08071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_060F1461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_06071461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_03011461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_02011461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_ca.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_010F1461_8a.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_aa.bin
[2011.05.15 06:48:48 | 000,000,502 | ---- | C] () -- C:\Windows\11317231_01071461_8a.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_07031461_aa.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_ca.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_aa.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03231461_8a.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03131461_8a.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_03031461_aa.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_ca.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_aa.bin
[2011.05.15 06:48:48 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_02031461_8a.bin
[2011.05.15 06:48:48 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_0B0f1461_ca.bin
[2011.05.15 06:48:48 | 000,000,434 | ---- | C] () -- C:\Windows\11317231_090F1461_ca.bin
[2011.05.15 06:48:48 | 000,000,376 | ---- | C] () -- C:\Windows\11317231_03131461_aa.bin
[2011.05.15 06:48:47 | 000,000,461 | ---- | C] () -- C:\Windows\11317231_00000000_aa.bin
[2011.05.15 06:48:11 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2011.05.15 06:47:21 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011.05.15 06:47:19 | 000,213,332 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011.05.15 06:47:17 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011.01.19 12:34:42 | 003,003,392 | ---- | C] () -- C:\Program Files (x86)\openofficeorg33.msi
[2011.01.19 12:33:04 | 000,475,016 | ---- | C] () -- C:\Program Files (x86)\setup.exe
[2011.01.19 12:30:10 | 142,700,671 | ---- | C] () -- C:\Program Files (x86)\openofficeorg1.cab
[2011.01.19 11:15:26 | 000,000,290 | ---- | C] () -- C:\Program Files (x86)\setup.ini
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2009.04.16 12:24:14 | 000,921,600 | ---- | C] () -- C:\Windows\SysWow64\vorbisenc.dll
[2009.04.16 12:24:14 | 000,237,568 | ---- | C] () -- C:\Windows\SysWow64\OggDS.dll
[2009.04.16 12:24:14 | 000,188,416 | ---- | C] () -- C:\Windows\SysWow64\vorbis.dll
[2009.04.16 12:24:14 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\Ogg.dll
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.09.29 10:09:32 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2011.12.15 11:35:27 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2011.10.29 09:58:05 | 000,000,000 | ---D | M] -- C:\dell
[2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.05.18 15:28:48 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.12.02 16:22:22 | 000,000,000 | ---D | M] -- C:\Download
[2011.05.20 16:39:10 | 000,000,000 | ---D | M] -- C:\Drivers
[2011.05.14 21:10:05 | 000,000,000 | ---D | M] -- C:\Intel
[2011.06.21 20:48:05 | 000,000,000 | ---D | M] -- C:\Manual-PCProgram
[2011.05.19 11:18:55 | 000,000,000 | ---D | M] -- C:\Netgear
[2011.12.02 16:22:32 | 000,000,000 | ---D | M] -- C:\Nexon
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.12.15 11:34:51 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.15 11:47:46 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2011.12.02 16:28:28 | 000,000,000 | ---D | M] -- C:\ProgramData
[2011.05.18 15:28:48 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.05.18 15:33:52 | 000,000,000 | -HSD | M] -- C:\System Recovery
[2011.12.15 11:54:14 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.12.15 11:25:57 | 000,000,000 | ---D | M] -- C:\Temp
[2011.09.29 10:09:30 | 000,000,000 | R--D | M] -- C:\Users
[2011.12.02 15:45:19 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
[2011.08.28 09:56:00 | 002,466,704 | ---- | M] () -- C:\Program Files (x86)\AdobeDownloadAssistant.exe
[2011.08.27 11:23:09 | 008,353,800 | ---- | M] () -- C:\Program Files (x86)\Adobe_Premiere_Elements_9-AkamaiDLM.exe
[2011.11.24 09:23:39 | 012,713,136 | ---- | M] (Eastman Kodak Company) -- C:\Program Files (x86)\aio_install.exe
[2011.05.19 12:28:56 | 052,718,176 | ---- | M] () -- C:\Program Files (x86)\avira_antivir_personal_de.exe
[2011.12.15 10:39:52 | 003,552,208 | ---- | M] (Piriform Ltd) -- C:\Program Files (x86)\ccsetup313.exe
[2011.05.19 12:25:09 | 012,362,480 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 4.0.1.exe
[2011.07.18 15:59:52 | 013,522,064 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 5.0.1.exe
[2011.10.17 08:05:48 | 013,885,360 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Firefox Setup 7.0.1.exe
[2011.08.30 15:04:45 | 014,212,584 | ---- | M] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToiPodConverter.exe
[2011.08.30 15:06:04 | 014,563,768 | ---- | M] (DVDVideoSoft Ltd.                                          ) -- C:\Program Files (x86)\FreeYouTubeToMP3Converter.exe
[2011.05.19 14:18:22 | 020,240,744 | ---- | M] (The GIMP Team                                              ) -- C:\Program Files (x86)\gimp-2.6.11-i686-setup.exe
[2011.05.19 14:17:51 | 019,735,256 | ---- | M] (                                                            ) -- C:\Program Files (x86)\gimp-2.6.8-x64-setup.exe
[2011.05.19 12:34:45 | 000,568,648 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\GoogleEarthSetup.exe
[2011.09.23 12:31:50 | 003,089,056 | ---- | M] (Adobe Systems, Inc.) -- C:\Program Files (x86)\install_flash_player.exe
[2011.05.19 14:39:47 | 081,797,928 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\iTunes64Setup.exe
[2011.10.29 10:17:09 | 000,910,624 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\jxpiinstall.exe
[2011.09.29 07:55:01 | 003,103,511 | ---- | M] () -- C:\Program Files (x86)\kcsetup8.exe
[2011.09.29 09:12:13 | 022,482,384 | ---- | M] (Salfeld Computer GmbH                                      ) -- C:\Program Files (x86)\kisi2011.exe
[2011.12.15 11:14:56 | 009,852,544 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Program Files (x86)\mbam-setup-1.51.2.1300.exe
[2011.10.03 13:40:45 | 000,247,053 | ---- | M] () -- C:\Program Files (x86)\mp3DC213.exe
[2011.09.16 06:47:25 | 168,166,968 | ---- | M] () -- C:\Program Files (x86)\OOo_3.3.0_Win_x86_install-wJRE_de.exe
[2011.05.19 12:27:00 | 009,559,320 | ---- | M] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1111_int_Setup.exe
[2011.10.29 11:04:38 | 010,311,496 | ---- | M] (Opera Software ASA) -- C:\Program Files (x86)\Opera_1152_int_Setup.exe
[2011.08.27 11:56:06 | 001,228,384 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\PremiereElements_9_LS15.exe
[2011.10.17 08:29:10 | 001,739,400 | ---- | M] (Secunia) -- C:\Program Files (x86)\PSISetup2003.exe
[2011.10.29 11:50:28 | 039,401,336 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\QuickTimeInstaller.exe
[2011.12.15 11:25:23 | 000,713,472 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer.exe
[2011.09.23 14:09:00 | 000,676,624 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files (x86)\RealPlayer_1406666_de.exe
[2011.01.19 12:33:04 | 000,475,016 | ---- | M] () -- C:\Program Files (x86)\setup.exe
[2011.05.22 09:35:19 | 021,255,560 | ---- | M] (Skype Technologies S.A.) -- C:\Program Files (x86)\SkypeSetupFull.exe
[2011.08.25 17:58:22 | 006,716,353 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Sunbird_Setup_1.0_Beta_1.exe
[2011.05.19 12:26:19 | 009,326,056 | ---- | M] (Mozilla) -- C:\Program Files (x86)\Thunderbird Setup 3.1.10.exe
[2011.09.23 14:06:06 | 021,073,936 | ---- | M] () -- C:\Program Files (x86)\vlc-1.1.11-win32.exe
[2011.05.19 14:44:11 | 001,663,693 | ---- | M] () -- C:\Program Files (x86)\winrar-x64-400d.exe
[2011.05.19 14:06:01 | 000,767,064 | ---- | M] (NCH Software) -- C:\Program Files (x86)\wpsetup4.57.exe
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
[10 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
 
< MD5 for: AFD.SYS  >
[2011.04.25 03:44:02 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=6EF20DDF3172E97D69F596FB90602F29 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16802_none_3430bc3977dfec2d\afd.sys
[2009.07.14 00:21:42 | 000,500,224 | ---- | M] (Microsoft Corporation) MD5=B9384E03479D2506BC924C16A3DB87BC -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.16385_none_33dd3439781e25f7\afd.sys
[2010.11.20 10:23:34 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=D31DC7A16DEA4A9BAF179F3D6FBDB38C -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\SysNative\drivers\afd.sys
[2011.04.25 03:34:03 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=D5B031C308A409A0A576BFF4CF083D30 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_3618198975057170\afd.sys
[2011.04.25 04:09:35 | 000,499,200 | ---- | M] (Microsoft Corporation) MD5=F4AD06143EAC303F55D0E86C40802976 -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_3695e61e8e2c13d4\afd.sys
[2011.04.25 03:44:27 | 000,499,712 | ---- | M] (Microsoft Corporation) MD5=FBFF8B7C9D116229E9208A0D1CAEB49B -- C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7600.20951_none_3483491e9126fe55\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2011.05.15 07:01:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=00B0358734CAA32C39D181FE6916B178 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_b8b0208ee0ce1889\explorer.exe
[2011.02.26 07:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011.05.15 07:01:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\ERDNT\cache86\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 07:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 07:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011.05.15 07:01:23 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=6D4F9E4B640B413C6F73414327484C80 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_addea9f19345cd81\explorer.exe
[2011.05.15 07:01:29 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2011.05.15 07:01:33 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2011.05.15 07:01:29 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2011.05.15 07:01:33 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2011.05.15 07:01:29 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011.05.15 07:01:33 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.05.15 07:01:23 | 002,868,736 | ---- | M] (Microsoft Corporation) MD5=CA17F8620815267DC838E30B68CB5052 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20542_none_ae5b763cac6d568e\explorer.exe
[2011.02.26 07:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2011.05.15 07:01:29 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
[2011.05.15 07:01:23 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=FC89FACA0473641CB625EDA9277D0885 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16434_none_b8335443c7a68f7c\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\ERDNT\cache86\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe
[2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe
[2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache86\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\ERDNT\cache64\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\ERDNT\cache64\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\ERDNT\cache86\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\ERDNT\cache64\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2011.05.15 07:01:33 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2011.05.15 07:01:33 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

Rheingold 16.12.2011 09:43
Code:
OTL Extras logfile created on: 15.12.2011 19:58:30 - Run 8
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Administrator\Desktop\Virus\OTL
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,90 Gb Total Physical Memory | 2,05 Gb Available Physical Memory | 52,57% Memory free
7,79 Gb Paging File | 5,89 Gb Available in Paging File | 75,64% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 235,24 Gb Total Space | 112,40 Gb Free Space | 47,78% Space Free | Partition Type: NTFS
Drive D: | 215,77 Gb Total Space | 206,35 Gb Free Space | 95,63% Space Free | Partition Type: NTFS
 
Computer Name: DELL-PC | User Name: Administrator | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files (x86)\Opera\Opera.exe (Opera Software)
 
[HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
htmlfile [print] -- "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- Reg Error: Key error.
htmlfile [opennew] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files (x86)\Opera\Opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- Reg Error: Key error.
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Key error.
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== System Restore Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
"DisableSR" = 1
"DisableConfig" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
"C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes]
"C:\Nexon\Combat Arms EU\CombatArms.exe" = C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe -- (Nexon)
"C:\Nexon\Combat Arms EU\Engine.exe" = C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe -- (Nexon)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}" = Intel(R) PROSet/Wireless WiFi-Software
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{75104836-CAC7-444E-A39E-3F54151942F5}" = Apple Mobile Device Support
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{9ED333F8-3E6C-4A38-BAFA-728454121CDA}" = PDF-XChange Viewer
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 265.94
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Überwachungstool für die Intel® Turbo-Boost-Technik 2.0
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{BE930E38-7BB3-45B6-85B2-5251F374F844}" = 64 Bit HP CIO Components Installer
"{C7B40C35-85AE-4303-9EEA-1A1EA779664D}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D600D357-5CB9-4DE9-8FD4-14E208BD1970}" = Nero Backup Drivers
"{D66F0C3C-24F2-4463-9E2F-4381E5C40A26}" = iTunes
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"CCleaner" = CCleaner
"Dell Support Center" = Dell Support Center
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"ProInst" = Intel PROSet Wireless
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinRAR archiver" = WinRAR 4.00 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11
"{0713D1F9-DD77-42C1-8C7D-54D479E2E743}" = Nero SoundTrax 11
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D7A4289-99CF-4B8D-B812-86BE50A54552}" = Nero Video 11
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11
"{1D4EE8FE-F31C-4258-9360-5B8B8309B14B}" = Adobe Premiere Elements 9 Content
"{1D7CE340-70C3-4848-BCCF-215950328A4C}" = Facebook Video Calling 1.0.0.8953
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{27107EAA-34E0-43BF-B537-7F8EF6880F5A}" = Facebook Video Calling 1.0.0.8177
"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2CA7225D-CB12-462A-9DD1-50319E158BA5}" = Nero 11 PiP Effects Basic
"{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{3443D416-9DAD-4362-BEB1-C213AD9062CD}" = Dell MusicStage
"{376348C2-E372-48BC-A138-E896757BD86A}" = aioscnnr
"{37AB0223-AF54-49C5-92AA-BFC9648CD323}" = Adobe Premiere Elements 9 HD Content 3
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{390757AA-8830-43DC-AEE0-4E5B6F8439EB}" = Nero SoundTrax 11 Help (CHM)
"{3CBBE028-978B-4876-ABC1-EF9ED6C20C4E}" = Adobe Premiere Elements 9 Content 2
"{3EE2F527-F306-49E9-0086-662C337ADD3B}" = FUSSBALL MANAGER 07
"{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50D90C59-4F5C-48BC-AFB2-38475412F0CA}" = Adobe Premiere Elements 9 Content 1
"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)
"{55C2143E-FBA5-442F-9AFA-726FF068F39D}" = Nero CoverDesigner 11 Help (CHM)
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{57F80ECF-E27C-4EEE-AB58-E971BACE2639}" = Nero Recode 11 Help (CHM)
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{5A212B2D-140D-46F4-B625-2D1CA5A00594}" = Nero 11 Kwik Themes Basic
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5F9AAF4A-B9B0-489D-AE67-73470A4714FE}" = Adobe Premiere Elements 9 HD Content 1
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AB2427E-A18F-4809-9A12-29F5EBABBB3A}" = Nero BackItUp 11 Help (CHM)
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{7DDC3624-C631-49D1-B281-82EC3A27AA7C}" = Adobe Premiere Elements 9 Content 3
"{7EC66A95-AC2D-4127-940B-0445A526AB2F}" = Dell DataSafe Online
"{8014FACB-1D1D-48C2-94AA-E29EE2E6B9CE}" = Nero WaveEditor 11
"{81DD0597-29EB-4FA0-8223-4F41362B2E72}" = NBA 2K11
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{87434D51-51DB-4109-B68F-A829ECDCF380}" = AccelerometerP11
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{9193490D-5229-4FC4-9BB9-A6D63C09574A}" = High-Definition Video Playback
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7A0BF2E-31CC-49E3-9913-52C503EB969D}" = Nero Audio Pack 1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB2BBC64-8AC8-4E66-BBF3-E22D5EACEECA}" = Nero BackItUp 11
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E01095-8BAA-456E-8AED-504C3CCADBA0}" = Nero 11
"{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"{B9B1BA7F-7E07-49DD-A713-5B397A5BB66B}" = Nero Kwik Media Help (CHM)
"{BE814218-3919-4EA3-868A-2F60BC135CB4}" = Nero Kwik Media
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C19BE821-89B1-4A96-AC7C-873810C0CB5F}" = ContentSAFER for Wizmax
"{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = EmoDio
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CCE210DF-7EEF-4A76-A63C-3EB091FDB992}" = welcome
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D2CBEFA4-F2D3-4E97-A171-8BFD6A31A5EC}" = Nero Express 11 Help (CHM)
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DC0C5A78-6DBF-3444-0120-0FE8F0134FCD}" = Adobe Download Assistant
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK All-in-One Software
"{E10AAE4A-98B8-420A-BD93-E0520C23D624}" = Nero Express 11
"{E240C78D-8F35-456A-8876-15FF6901B7E0}" = Adobe Premiere Elements 9 HD Content 2
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E51BC4B0-EA5E-49CC-AF3B-93B5C627EC22}" = Nero 11 Effects Basic
"{E9F59205-F128-49A7-9039-4BDFB60EE4A3}" = Dell Stage
"{EB8DED20-A887-4A9C-BB5A-F3E7523DFB44}" = Nero WaveEditor 11 Help (CHM)
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{EC7FE03D-239A-4E36-9907-0E327922D2A2}" = bpd_scan
"{EF53BFAB-4C10-40DB-A82D-9B07111715C6}" = aioscnnr
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F3743A2C-5D5F-4456-8F98-5DF36A954C50}" = Nero 11 Image Samples
"{F49EF443-B2BD-4F10-8A46-87AFCDB90EDD}" = Nero 11 Disc Menus Basic
"{F69FB940-5031-4FE8-AFAD-085802D0BF63}" = Nero Recode 11
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FAC3C37E-EDAB-4F3A-A173-A7C70CC88F09}" = Nero Video 11 Help (CHM)
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF44BCE5-5A18-4051-85F0-BC172D7B4695}" = Nero CoverDesigner 11
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Premiere Elements 9 Content" = Adobe Premiere Elements 9 Content
"Adobe Premiere Elements 9 Content 1" = Adobe Premiere Elements 9 Content 1
"Adobe Premiere Elements 9 Content 2" = Adobe Premiere Elements 9 Content 2
"Adobe Premiere Elements 9 Content 3" = Adobe Premiere Elements 9 Content 3
"Adobe Premiere Elements 9 HD Content 1" = Adobe Premiere Elements 9 HD Content 1
"Adobe Premiere Elements 9 HD Content 2" = Adobe Premiere Elements 9 HD Content 2
"Adobe Premiere Elements 9 HD Content 3" = Adobe Premiere Elements 9 HD Content 3
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Akamai" = Akamai NetSession Interface Service
"AVerMedia H339 Hybrid TV Tuner" = AVerMedia H339 Hybrid TV Tuner 2.2.64.64
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BewerbungsGenie 7_is1" = DATA BECKER BewerbungsGenie 7
"BurningWheels" = Cobra 11 - Burning Wheels (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"Combat Arms EU" = Combat Arms EU
"Dell Webcam Central" = Dell Webcam Central
"ExpressBurn" = Express Burn Disc Burning Software
"ExpressRip" = Express Rip
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 3.10.8.815
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815
"InstallShield_{2F8BA3FD-1FA9-4279-B696-712ABB12F09F}" = SmartSound Quicktracks 5
"InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"InstallShield_{B8A2869E-30CA-40C5-9CF8-BD7354E57EF8}" = SmartSound Common Data
"InstallShield_{C20CE592-B0F8-4D20-BF31-0151CA6331A6}" = EmoDio
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Kindersicherung_is1" = Kindersicherung 2011
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"MixPad" = MixPad Audio Mixer
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"Opera 11.52.1100" = Opera 11.52
"PremElem90" = Adobe Premiere Elements 9
"Prism" = Prism Video File Converter
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"RealPlayer 15.0" = RealPlayer
"Secunia PSI" = Secunia PSI (2.0.0.3003)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.11
"WavePad" = WavePad Sound Editor
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinLiveSuite" = Windows Live Essentials
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

Rheingold 16.12.2011 09:45
Hier nun die Ergebnisse von CCleaner:
7-Zip 9.20 (x64 edition) Igor Pavlov 22.09.2011 4,53MB 9.20.00.0
AccelerometerP11 STMicroelectronics 13.05.2011 2.00.11.22
Adobe AIR Adobe Systems Incorporated 11.11.2011 3.1.0.4880
Adobe Community Help Adobe Systems Incorporated 11.09.2011 3.2.1.650
Adobe Download Assistant Adobe Systems Incorporated 30.09.2011 1.0.5
Adobe Flash Player 11 ActiveX Adobe Systems Incorporated 13.12.2011 6,00MB 11.1.102.55
Adobe Flash Player 11 Plugin 64-bit Adobe Systems Incorporated 11.11.2011 6,00MB 11.1.102.55
Adobe Premiere Elements 9 Adobe Systems Incorporated 28.10.2011 1.264MB 9.0
Adobe Premiere Elements 9 Content Adobe Systems Incorporated 28.10.2011 1.264MB 9.0
Advanced Audio FX Engine Creative Technology Ltd 11.09.2011 1.12.05
Akamai NetSession Interface 09.11.2011
Akamai NetSession Interface Service 09.11.2011
Apple Application Support Apple Inc. 17.10.2011 61,1MB 2.1.5
Apple Mobile Device Support Apple Inc. 17.10.2011 24,4MB 4.0.0.96
Apple Software Update Apple Inc. 22.09.2011 2,38MB 2.1.3.127
AVerMedia H339 Hybrid TV Tuner 2.2.64.64 AVerMedia TECHNOLOGIES, Inc. 11.09.2011 2.2.64.64
Avira AntiVir Personal - Free Antivirus Avira GmbH 13.10.2011 70,6MB 10.2.0.704
Bonjour Apple Inc. 17.10.2011 2,00MB 3.0.0.10
CCleaner Piriform 14.12.2011 3.13
Cobra 11 - Burning Wheels (remove only) 11.09.2011
Combat Arms EU 01.12.2011
ContentSAFER for Wizmax 13.05.2011
DATA BECKER BewerbungsGenie 7 DATA BECKER GmbH & Co. KG 30.05.2011 1.130MB 6.0.10.49
Dell DataSafe Local Backup Dell 13.05.2011 9.4.47
Dell DataSafe Local Backup - Support Software Dell 13.05.2011
Dell DataSafe Online Dell 13.05.2011 6,46MB 2.1.19634
Dell Getting Started Guide Dell Inc. 13.05.2011 1.00.0000
Dell MusicStage Fingertapps 11.07.2011 88,7MB 1.5.402.0
Dell PhotoStage ArcSoft 13.05.2011 101,8MB 1.5.0.30
Dell Stage Fingertapps 29.06.2011 82,6MB 1.5.420.0
Dell Support Center Dell Inc. 14.05.2011 3.0.5621.01
Dell VideoStage CyberLink Corp. 13.05.2011 1.1.1.1408
Dell Webcam Central Creative Technology Ltd 11.09.2011 2.00.35
EmoDio SAMSUNG 20.06.2011 7,69MB 1.0
Express Burn Disc Burning Software NCH Software 11.09.2011
Express Rip NCH Software 11.09.2011
Facebook Video Calling 1.0.0.8953 Skype Limited 14.11.2011 7,86MB 1.0.8953
FIFA 11 Electronic Arts 06.11.2011 6.262MB 1.0.0.0
Free YouTube to iPod Converter version 3.10.8.815 DVDVideoSoft Ltd. 30.09.2011 42,9MB
Free YouTube to MP3 Converter version 3.10.8.815 DVDVideoSoft Ltd. 30.09.2011 45,4MB
FUSSBALL MANAGER 07 11.09.2011
GIMP 2.6.8 18.05.2011
Google Earth Google 17.11.2011 92,7MB 6.1.0.5001
Intel(R) Management Engine Components Intel Corporation 15.05.2011 7.0.0.1144
Intel(R) Processor Graphics Intel Corporation 11.09.2011 74,2MB 8.15.10.2291
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology Intel Corporation 13.05.2011 88,6MB 1.0.2.0511
Intel(R) PROSet/Wireless WiFi-Software Intel Corporation 13.05.2011 142,9MB 14.00.1000
Internet-TV für Windows Media Center Microsoft Corporation 02.06.2011 13,7MB 4.2.2.0
iTunes Apple Inc. 17.10.2011 169,9MB 10.5.0.142
Java(TM) 6 Update 22 13.05.2011
Java(TM) 6 Update 29 Oracle 28.10.2011 95,0MB 6.0.290
Kindersicherung 2011 Salfeld Computer GmbH 09.10.2011 64,6MB
KODAK All-in-One Software Eastman Kodak Company 23.11.2011 7.1.6.30
Malwarebytes' Anti-Malware Version 1.51.2.1300 Malwarebytes Corporation 28.10.2011 13,8MB 1.51.2.1300
Microsoft .NET Framework 4 Client Profile Microsoft Corporation 19.05.2011 38,8MB 4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 19.05.2011 2,94MB 4.0.30319
Microsoft Office 2010 Microsoft Corporation 13.05.2011 6,31MB 14.0.4763.1000
Microsoft Office Klick-und-Los 2010 Microsoft Corporation 10.11.2011 14.0.4763.1000
Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 10.11.2011 14.0.4763.1000
Microsoft Silverlight Microsoft Corporation 13.10.2011 80,3MB 4.0.60831.0
Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 13.05.2011 1,70MB 3.1.0000
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 23.05.2011 0,25MB 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 15.06.2011 0,29MB 8.0.59193
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 Microsoft Corporation 18.05.2011 0,77MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 Microsoft Corporation 18.05.2011 0,77MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 Microsoft Corporation 15.06.2011 0,77MB 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 Microsoft Corporation 06.11.2011 0,23MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 18.05.2011 0,58MB 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 18.05.2011 0,57MB 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 15.06.2011 0,59MB 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Corporation 08.10.2011 13,8MB 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Corporation 08.10.2011 15,0MB 10.0.40219
MixPad Audio Mixer NCH Software 11.09.2011
Mozilla Firefox 8.0 (x86 de) Mozilla 10.11.2011 41,3MB 8.0
Mozilla Thunderbird (8.0) Mozilla 10.11.2011 8.0 (de)
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 18.05.2011 1,28MB 4.20.9870.0
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 18.05.2011 1,33MB 4.20.9876.0
NBA 2K11 2K Sports 17.09.2011 1.0.0
Nero 11 Nero AG 06.10.2011 1.760MB 11.0.10700
Nero Backup Drivers Nero AG 06.10.2011 94,00KB 1.0.10000.1.0
Nexon Game Manager 01.12.2011
NVIDIA 3D Vision Treiber 265.94 NVIDIA Corporation 13.05.2011 265.94
NVIDIA Grafiktreiber 265.94 NVIDIA Corporation 13.05.2011 265.94
OpenOffice.org 3.3 OpenOffice.org 15.09.2011 415MB 3.3.9567
Opera 11.52 Opera Software ASA 28.10.2011 11.52.1100
PDF-XChange Viewer Tracker Software Products Ltd. 22.09.2011 44,7MB 2.5.198.0
PlayReady PC Runtime amd64 Microsoft Corporation 20.05.2011 2,06MB 1.3.0
Prism Video File Converter NCH Software 13.09.2011
Protect Disc License Helper 1.0.125 (IE) Protect Disc 30.05.2011 1.0.125
ProtectDisc Driver, Version 11 ProtectDisc Software GmbH 11.09.2011 11.0.0.14
Quickset64 Dell Inc. 13.05.2011 11.0.10
QuickTime Apple Inc. 28.10.2011 73,3MB 7.71.80.42
RealPlayer RealNetworks 20.10.2011
Realtek High Definition Audio Driver Realtek Semiconductor Corp. 11.09.2011 6.0.1.6267
Roxio Creator Starter Roxio 11.09.2011 1.673MB 12.1.77.0
Secunia PSI (2.0.0.3003) 16.10.2011
Skype Click to Call Skype Technologies S.A. 30.09.2011 14,5MB 5.6.8312
Skype™ 5.5 Skype Technologies S.A. 28.10.2011 17,1MB 5.5.124
SmartSound Common Data SmartSound Software Inc. 16.06.2011 13,5MB 1.1.0
SmartSound Quicktracks 5 SmartSound Software Inc. 16.06.2011 49,2MB 5.1.6
SmartSound Quicktracks for Premiere Elements 9.0 SmartSound Software Inc 26.08.2011 20,1MB 3.12.3090
Synaptics Pointing Device Driver Synaptics Incorporated 14.05.2011 46,4MB 15.2.6.0
Uninstall 1.0.0.1 27.05.2011 11,2MB
VLC media player 1.1.11 VideoLAN 22.09.2011 1.1.11
WavePad Sound Editor NCH Software 11.09.2011
Windows Live Essentials Microsoft Corporation 06.08.2011 15.4.3538.0513
Windows Live Mesh ActiveX control for remote connections Microsoft Corporation 13.05.2011 5,58MB 15.4.5722.2
Windows Media Encoder 9 Series 11.09.2011
WinRAR 4.00 (64-Bit) win.rar GmbH 18.05.2011 4.00.0
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 Intel 13.05.2011 2.1.23.0

Rheingold 16.12.2011 10:05
Hier die Ereignisse von Avira:
Exportierte Ereignisse:

15.12.2011 18:46 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 18:46 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:25 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 11:25 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 11:22 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:22 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:22 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:22 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:22 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:19 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:19 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 11:19 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:35 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:35 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:35 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:31 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:31 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:28 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:28 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:28 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:28 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:28 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:04 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

15.12.2011 08:02 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:00 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:00 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

15.12.2011 08:00 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

14.12.2011 08:41 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

14.12.2011 08:38 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

14.12.2011 08:38 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

14.12.2011 08:38 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

13.12.2011 20:20 [Scanner] Malware gefunden
Die Datei '#PARAM2#'
enthielt einen Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#].
Durchgeführte Aktion(en):
#PARAM4#

13.12.2011 20:17 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

13.12.2011 20:17 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

13.12.2011 20:17 [Guard] Malware gefunden
In der Datei '#PARAM2#'
wurde ein Virus oder unerwünschtes Programm '#PARAM1#' [#PARAM3#] gefunden.
Ausgeführte Aktion: #PARAM4#

Rheingold 16.12.2011 10:08
P.s.: Heute früh ha avira auch noch was gefunden, ist aber nicht unter Ereignisse dokumentiert, aber in der Quarantäne. Die Quarantänte.txt, stelle ich mal mit rein. Viele Grüße, Jasmina

Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\jar_cache2940790001441072158.tmp
Status: Infiziert
Quarantäne-Objekt: 659a9f32.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Enthält Erkennungsmuster des Exploits EXP/CVE-2010-0840.GK
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\A7CB\737u.exe
Status: Infiziert
Quarantäne-Objekt: 491aa5ed.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Cycbot.G.196
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\A7CB\10F2.tmp
Status: Infiziert
Quarantäne-Objekt: 519e8a57.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Drop.Agent.104448.2
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9P12EUMN\bleh[1].exe
Status: Infiziert
Quarantäne-Objekt: 5f088066.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Enthält ein Erkennungsmuster des (gefährlichen) Backdoorprogrammes BDS/Cycbot.G.196
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\jar_cache3335764138695990157.tmp
Status: Infiziert
Quarantäne-Objekt: 03add0f0.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Enthält Erkennungsmuster des Exploits EXP/2010-0840.AW
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\4d0d2e25\X
Status: Infiziert
Quarantäne-Objekt: 6fd8ec26.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Downloader.Gen
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1WHIKJDB\b[1].exe
Status: Infiziert
Quarantäne-Objekt: 13fcac1d.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Offend.KD.474345
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9P12EUMN\f[1].exe
Status: Infiziert
Quarantäne-Objekt: 205fb236.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Kazy.48489
Datum/Uhrzeit: 16.12.2011, 09:57


Typ: Datei
Quelle: C:\Users\Nico.dell-PC.000\AppData\Local\temp\1951057.exe
Status: Infiziert
Quarantäne-Objekt: 4ada5911.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Kazy.48489
Datum/Uhrzeit: 16.12.2011, 09:49


Typ: Datei
Quelle: C:\Program Files (x86)\LP\A7CB\F180.tmp
Status: Infiziert
Quarantäne-Objekt: 499a5915.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows 2000/XP/VISTA Workstation
Suchengine: 8.02.08.02
Virendefinitionsdatei: 7.11.19.128
Meldung: Ist das Trojanische Pferd TR/Spy.Favic.A
Datum/Uhrzeit: 16.12.2011, 09:49

kira 17.12.2011 06:59
1.
Hast Du absichtlich die IP 127.0.0.1:50263 als Proxy eingestellt? Wenn ja, warum? Wenn nein:
wenn du keinen Proxyserver lokal installiert hast, nimm die Proxyeinstellungen aus den Interneteinstellungen raus
im Internet Explorer:
Extras => Internetoptionen => Verbindungen => Lan-Einstellungen
Haken bei Proxyserver für LAN verwenden und Proxyserver für lokale Adressen umgehen entfernen.

Zitat:
IE - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:50263
im Firefox:
Extras => Einstellungen => Erweitert => Netzwerk => Einstellungen.
Dort unter Verbindungs-Einstellungen => Kein Proxy anhaken.

Zitat:
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 50263
FF - prefs.js..network.proxy.type: 1
2.
Dir bekannte Einträge? (ggf unter "Eigenschaften" nachsehen):
Zitat:
[2011.12.15 08:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Virus
[2011.12.15 11:22:52 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\4d0d2e25
3.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
PRC - C:\Program Files (x86)\57168\lvvm.exe ()
PRC - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
PRC - C:\Program Files (x86)\LP\A7CB\737.exe ()
MOD - C:\Program Files (x86)\57168\lvvm.exe ()
MOD - C:\Users\Administrator\AppData\Roaming\B8457\6D1A7.exe ()
MOD - C:\Program Files (x86)\LP\A7CB\737.exe ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
[2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O4 - HKLM..\Run: [737.exe] C:\Program Files (x86)\LP\A7CB\737.exe ()
O4 - HKLM..\Run: [AccuWeatherWidget] C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe ()
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [Conime] %windir%\system32\conime.exe File not found
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe File not found
O4 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk =  File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel present
[2011.12.15 11:19:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\57168
[2011.12.15 11:19:19 | 000,000,000 | ---D | C] -- C:\Users\Administrator\AppData\Roaming\B8457
[2011.12.15 19:57:00 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job
[2011.12.15 19:30:16 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.15 19:06:12 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.15 11:18:00 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job
[2011.12.14 20:28:00 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job
[2011.12.14 20:18:00 | 000,000,914 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job
[2011.12.14 08:38:00 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\At2.job
[2011.12.14 08:34:00 | 000,000,408 | ---- | M] () -- C:\Windows\tasks\At1.job
[2011.12.12 16:57:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job

:Commands
[purity]
[emptytemp]

4.
reinige dein System mit CCleaner:
  • "Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
  • "Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
  • Starte dein System neu auf

5.
  • lade Dir SUPERAntiSpyware FREE Edition herunter.
  • installiere das Programm und update online.
  • starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
  • setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
  • anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
  • auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
  • um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
  • drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

6.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

7.
-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

8.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

Rheingold 18.12.2011 08:03
Hallo Kira,
1.
die IP 127.0.0.1:50263 habe ich nicht als Proxy eingestellt.? Ist mir aber aufgefallen und ich habe die Einstellung schon rausgenommen.


2.
Dir bekannte Einträge? (ggf unter "Eigenschaften" nachsehen):
Zitat:
[2011.12.15 08:29:11 | 000,000,000 | ---D | C] -- C:\Users\Administrator\Desktop\Virus Das ist ein Ordner, den ich angelegt habe.

[2011.12.15 11:22:52 | 000,000,000 | -HSD | C] -- C:\Users\Administrator\AppData\Local\4d0d2e25 Diesen Eintrag kenne ich nicht.


Den Rest stelle ich dann später rein.

Vielen, vielen Dank! :dankeschoen:

Rheingold 18.12.2011 08:25
:
Code:
All processes killed
========== OTL ==========
No active process named Program Files was found!
No active process named 6D1A7.exe was found!
No active process named Program Files was found!
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll not found.
C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\737.exe not found.
File C:\Program Files (x86)\LP\A7CB\737.exe not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\AccuWeatherWidget deleted successfully.
C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Adobe Reader Speed Launcher deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Conime deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\EKIJ5000StatusMonitor deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\Nico.dell-PC.000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Privacy\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-3230886925-126132133-2629391164-500\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
C:\Program Files (x86)\57168 folder moved successfully.
C:\Users\Administrator\AppData\Roaming\B8457 folder moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004UA.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003UA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1025Core.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1003Core.job moved successfully.
C:\Windows\Tasks\At2.job moved successfully.
C:\Windows\Tasks\At1.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3230886925-126132133-2629391164-1004Core.job moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 27038607 bytes
->Temporary Internet Files folder emptied: 49440123 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 73987108 bytes
->Opera cache emptied: 1191820 bytes
->Flash cache emptied: 58352 bytes
 
User: All Users
 
User: AppData
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Jasmina
->Temp folder emptied: 444971 bytes
->Temporary Internet Files folder emptied: 1508823 bytes
->Java cache emptied: 11680 bytes
->FireFox cache emptied: 37421722 bytes
->Flash cache emptied: 57120 bytes
 
User: Jasmina 2
 
User: Nico
 
User: Nico Spiele
 
User: Nico.dell-PC
 
User: Nico.dell-PC.000
->Temp folder emptied: 167157564 bytes
->Temporary Internet Files folder emptied: 16506810 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 43839688 bytes
->Flash cache emptied: 9097 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50635 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 668 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 399,00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 12182011_081200

Files\Folders moved on Reboot...
C:\Users\Administrator\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...
:

Rheingold 18.12.2011 13:36
:
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 12/17/2011 at 12:25 PM

Application Version : 5.0.1142

Core Rules Database Version : 8064
Trace Rules Database Version: 5876

Scan type      : Complete Scan
Total Scan Time : 02:31:32

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator

Memory items scanned      : 719
Memory threats detected  : 0
Registry items scanned    : 76927
Registry threats detected : 0
File items scanned        : 257414
File threats detected    : 220

Adware.Tracking Cookie
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\QM1OTRD9.txt [ /atdmt.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\F988I3Z6.txt [ /media6degrees.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\O1FN8N2S.txt [ /webmasterplan.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\EU6URGFJ.txt [ /perf.overture.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\5DJIVMO1.txt [ /www.usenext.de ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\NET4DBKT.txt [ /2o7.net ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\KKIFEF7R.txt [ /account.live.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\D3IYFCK0.txt [ /invitemedia.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\08H9M60T.txt [ /lucidmedia.com ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\8F6RXOS9.txt [ /doubleclick.net ]
        C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Cookies\MFYXIJ15.txt [ /ad.yieldmanager.com ]
        C:\USERS\ADMINISTRATOR\Cookies\QM1OTRD9.txt [ Cookie:administrator@atdmt.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\F988I3Z6.txt [ Cookie:administrator@media6degrees.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\O1FN8N2S.txt [ Cookie:administrator@webmasterplan.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\EU6URGFJ.txt [ Cookie:administrator@perf.overture.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\5DJIVMO1.txt [ Cookie:administrator@www.usenext.de/ ]
        C:\USERS\ADMINISTRATOR\Cookies\NET4DBKT.txt [ Cookie:administrator@2o7.net/ ]
        C:\USERS\ADMINISTRATOR\Cookies\KKIFEF7R.txt [ Cookie:administrator@account.live.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\08H9M60T.txt [ Cookie:administrator@lucidmedia.com/ ]
        C:\USERS\ADMINISTRATOR\Cookies\8F6RXOS9.txt [ Cookie:administrator@doubleclick.net/ ]
        C:\USERS\ADMINISTRATOR\Cookies\MFYXIJ15.txt [ Cookie:administrator@ad.yieldmanager.com/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\Q24G170D.txt [ Cookie:nico@2o7.net/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\XZAXDNQD.txt [ Cookie:nico@mediaplex.com/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\APQ3BI3N.txt [ Cookie:nico@adfarm1.adition.com/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\MZJHPRKM.txt [ Cookie:nico@imrworldwide.com/cgi-bin ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\BPXHXY40.txt [ Cookie:nico@ad2.adfarm1.adition.com/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\NF69XBY1.txt [ Cookie:nico@c.atdmt.com/ ]
        C:\USERS\NICO.DELL-PC.000\AppData\Roaming\Microsoft\Windows\Cookies\LFT0E2C5.txt [ Cookie:nico@fastclick.net/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\Q24G170D.txt [ Cookie:nico@2o7.net/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\XZAXDNQD.txt [ Cookie:nico@mediaplex.com/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\APQ3BI3N.txt [ Cookie:nico@adfarm1.adition.com/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\MZJHPRKM.txt [ Cookie:nico@imrworldwide.com/cgi-bin ]
        C:\USERS\NICO.DELL-PC.000\Cookies\BPXHXY40.txt [ Cookie:nico@ad2.adfarm1.adition.com/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\NF69XBY1.txt [ Cookie:nico@c.atdmt.com/ ]
        C:\USERS\NICO.DELL-PC.000\Cookies\LFT0E2C5.txt [ Cookie:nico@fastclick.net/ ]
        .invitemedia.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .accounts.google.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .smartadserver.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adtech.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .ads.quartermedia.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        adserver.trojaner-info.de [ C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3CERS2ZS.DEFAULT\COOKIES.SQLITE ]
        media.mtvnservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
        secure-uk.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
        secure-us.imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
        www.pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\ZDEJBDAE ]
        .questionmarket.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .findextrawork.co.uk [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        tracking.dc-storm.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        data.coremetrics.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        tracking.dc-storm.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .olympiaverlag.122.2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .clickaider.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .eaeacom.112.2o7.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.webcountdown.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        wstat.wibiya.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .www.tubsex.info [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .overture.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .histats.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .yadro.ru [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .pornxnx.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .invitemedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .lfstmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .media6degrees.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .ru4.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .lucidmedia.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adxvalue.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .traffictrack.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.yieldmanager.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        e2.emediate.se [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad1.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .atdmt.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .bs.serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .specificclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .im.banner.t-online.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adviva.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        tracking.mlsat02.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .zanox.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .apmebf.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        eas.apm.emediate.eu [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad3.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.zanox-affiliate.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad.zanox.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .doubleclick.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        www.googleadservices.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tradedoubler.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .webmasterplan.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        accounts.youtube.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        e2.emediate.se [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .mediaplex.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        statse.webtrendslive.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad4.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tracking.quisma.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        ad2.adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .adfarm1.adition.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .revsci.net [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        .tracking.3gnet.de [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]
        accounts.google.com [ C:\USERS\NICO.DELL-PC.000\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\JZT41MZM.DEFAULT\COOKIES.SQLITE ]:

Rheingold 18.12.2011 13:39
Hi Kira,
Antivir kann ich nicht mehr updaten, Windows update kann ich auch nicht ausführen und die Windows Firewall kann ich nicht mehr einstellen, angezeigt wird, dass sie nicht aktiv ist.

Okay, jetzt führe ich die restlichen Scans durch.

Viele Grüße
Jasmina


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:09 Uhr.
Seite 1 von 4 1 23 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131