| Harry-Hirsch | 19.01.2012 16:29 |
So, werde mich kurz und bündig fassen.
Hier die File:OTL Logfile: Code:
OTL logfile created on: 1/19/2012 4:24:36 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Ultimate (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.86 Mb Free Space | 75.87% Space Free | Partition Type: NTFS
Drive D: | 40.04 Gb Total Space | 8.74 Gb Free Space | 21.84% Space Free | Partition Type: NTFS
Drive E: | 192.75 Gb Total Space | 105.92 Gb Free Space | 54.95% Space Free | Partition Type: NTFS
Drive G: | 1.86 Gb Total Space | 0.83 Gb Free Space | 44.59% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet004
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2012/01/19 07:18:18 | 000,017,920 | ---- | M] () [Auto] -- D:\Windows\System32\rpcnetp.exe -- (rpcnetp)
SRV:64bit: - [2011/04/27 11:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011/04/27 11:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2010/09/07 18:05:34 | 000,271,360 | ---- | M] (IDT, Inc.) [Auto] -- D:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:64bit: - [2009/07/13 20:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/13 20:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\System32\appmgmts.dll -- (AppMgmt)
SRV:64bit: - [2009/03/01 18:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto] -- D:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV - [2012/01/19 07:18:18 | 000,017,920 | ---- | M] () [Auto] -- D:\Windows\SysWOW64\rpcnetp.exe -- (rpcnetp)
SRV - [2012/01/19 03:11:32 | 000,058,288 | ---- | M] (Absolute Software Corp.) [Auto] -- D:\Windows\SysWOW64\rpcnet.exe -- (rpcnet) Remote Procedure Call (RPC)
SRV - [2011/09/28 09:32:08 | 000,179,120 | -H-- | M] (Absolute Software Corp.) [Auto] -- D:\ProgramData\Rpcnet\Bin\rpcld.exe -- (rpcld) Remote Procedure Call (RPC)
SRV - [2011/06/06 06:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/05/23 05:45:58 | 001,098,296 | ---- | M] (Hewlett-Packard Development Company L.P.) [On_Demand] -- D:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe -- (hpCMSrv)
SRV - [2011/05/21 10:52:16 | 000,103,992 | ---- | M] (Hewlett-Packard Company) [Auto] -- D:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe -- (HPDrvMntSvc.exe)
SRV - [2011/04/29 10:44:14 | 001,687,360 | ---- | M] (QUALCOMM, Inc.) [Auto] -- D:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kHP.exe -- (QDLService2kHP) Qualcomm Gobi 2000 Download Service (HP)
SRV - [2010/09/21 13:43:43 | 000,094,208 | ---- | M] (Absolute Software Corp.) [Auto] -- D:\Windows\SysWow64\wctsys.exe -- (wctsys)
SRV - [2010/03/03 09:46:56 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010/03/03 09:46:54 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012/01/19 05:46:08 | 000,096,376 | ---- | M] (Symantec Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\SMR210.SYS -- (SMR210)
DRV:64bit: - [2011/06/03 07:34:10 | 010,628,800 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2011/05/13 07:58:16 | 000,030,008 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot] -- D:\Windows\System32\drivers\hpdskflt.sys -- (hpdskflt)
DRV:64bit: - [2011/05/13 07:57:58 | 000,043,320 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Accelerometer.sys -- (Accelerometer)
DRV:64bit: - [2011/04/29 09:18:08 | 000,444,416 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcusbnethp2k.sys -- (qcusbnethp2k) Gobi 2000 USB-NDIS miniport(03F0-251D)
DRV:64bit: - [2011/04/29 09:18:08 | 000,230,784 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcusbserhp2k.sys -- (qcusbserhp2k) Gobi 2000 USB Device for Legacy Serial Communication(03F0-251D)
DRV:64bit: - [2011/04/29 09:18:08 | 000,160,328 | ---- | M] (MCCI) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcombushp.sys -- (qcombushp) Gobi 2000 USB Composite Device Driver(03F0-251D)
DRV:64bit: - [2011/04/29 09:18:08 | 000,006,400 | ---- | M] (QUALCOMM Incorporated) [Kernel | On_Demand] -- D:\Windows\System32\drivers\qcfilterhp2k.sys -- (qcfilterhp2k)
DRV:64bit: - [2011/04/27 09:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2010/09/07 18:05:34 | 000,515,584 | ---- | M] (IDT, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\stwrt64.sys -- (STHDA)
DRV:64bit: - [2010/08/31 00:07:04 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/04/05 18:37:42 | 000,301,232 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\e1k62x64.sys -- (e1kexpress) Intel(R)
DRV:64bit: - [2010/02/26 10:32:14 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/25 09:18:58 | 000,018,432 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr)
DRV:64bit: - [2010/02/01 05:12:14 | 007,675,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009/09/17 07:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/07/20 09:05:50 | 000,059,008 | ---- | M] (RICOH Company, Ltd.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rismcx64.sys -- (rismcx64)
DRV:64bit: - [2009/07/13 18:31:10 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2009/07/13 18:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009/06/25 11:04:20 | 000,067,584 | ---- | M] (REDC) [Kernel | Auto] -- D:\Windows\System32\drivers\rimmpx64.sys -- (rimmptsk)
DRV:64bit: - [2009/06/10 16:01:06 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand] -- D:\Windows\System32\drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2009/06/10 15:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Legendary_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Legendary_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Hotmail und Messenger sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\Legendary_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Legendary_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 98 0D 91 CF 60 AE CC 01 [binary data]
IE - HKU\Legendary_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "google.de"
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_1_102.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/12/02 13:40:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Firefox\components [2011/11/30 06:53:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Firefox\plugins [2011/12/08 04:36:38 | 000,000,000 | ---D | M]
[2011/11/30 06:54:10 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Legendary\AppData\Roaming\Mozilla\Extensions
[2012/01/16 08:21:50 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Legendary\AppData\Roaming\Mozilla\Firefox\Profiles\928nvukr.default\extensions
[2011/12/10 13:49:22 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- D:\Users\Legendary\AppData\Roaming\Mozilla\Firefox\Profiles\928nvukr.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011/12/23 19:40:51 | 000,000,000 | ---D | M] (DownloadHelper) -- D:\Users\Legendary\AppData\Roaming\Mozilla\Firefox\Profiles\928nvukr.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
File not found (No name found) --
() (No name found) -- D:\USERS\LEGENDARY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\928NVUKR.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- D:\USERS\LEGENDARY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\928NVUKR.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
O1 HOSTS File: ([2009/06/10 16:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O4:64bit: - HKLM..\Run: [MSC] D:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [SysTrayApp] D:\Program Files\IDT\WDM\sttray64.exe (IDT, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [DivXUpdate] D:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [PDFPrint] D:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\Legendary_ON_D..\RunOnce: [*NMRUI] G:\NPE21.exe (Symantec Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin] File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\InfoDelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCMD = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ABTDisableCAD = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCMD = 1
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\Legendary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - D:\Users\Legendary\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{61ac969b-36f7-11e1-bb3c-88ae1dafcff4}\Shell - "" = AutoRun
O33 - MountPoints2\{61ac969b-36f7-11e1-bb3c-88ae1dafcff4}\Shell\AutoRun\command - "" = G:\launcher.exe
O33 - MountPoints2\{ae9be625-217b-11e1-8aed-88ae1dafcff4}\Shell - "" = AutoRun
O33 - MountPoints2\{ae9be625-217b-11e1-8aed-88ae1dafcff4}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
NetSvcs:64bit: AppMgmt - D:\Windows\System32\appmgmts.dll (Microsoft Corporation)
========== Files/Folders - Created Within 30 Days ==========
[2012/01/19 05:46:08 | 000,096,376 | ---- | C] (Symantec Corporation) -- D:\Windows\System32\drivers\SMR210.SYS
[2012/01/19 03:38:20 | 000,000,000 | ---D | C] -- D:\Users\Legendary\AppData\Local\NPE
[2012/01/19 03:38:20 | 000,000,000 | ---D | C] -- D:\ProgramData\Norton
[2012/01/19 02:54:02 | 000,005,632 | ---- | C] (Absolute Software Corp.) -- D:\Windows\SysWow64\ctrestrt.exe
[2012/01/16 13:58:20 | 000,000,000 | ---D | C] -- D:\Users\Legendary\AppData\Roaming\Canon
[2012/01/16 13:57:26 | 000,000,000 | -H-D | C] -- D:\Windows\System32\CanonIJ Uninstaller Information
[2012/01/16 13:57:26 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP460
[2012/01/16 13:57:09 | 000,235,520 | ---- | C] (CANON INC.) -- D:\Windows\System32\CNMLM81.DLL
[2012/01/16 13:57:06 | 000,017,408 | ---- | C] (Canon Inc.) -- D:\Windows\System32\cnco460.dll
[2012/01/16 13:57:05 | 001,338,368 | ---- | C] (CANON INC.) -- D:\Windows\System32\CNCC460.DLL
[2012/01/16 13:57:05 | 000,091,136 | ---- | C] (Canon Inc.) -- D:\Windows\System32\CNCL460.DLL
[2012/01/16 13:57:05 | 000,049,664 | ---- | C] (CANON INC.) -- D:\Windows\System32\CNCI460.DLL
[2012/01/16 13:56:54 | 000,000,000 | -H-D | C] -- D:\Program Files\CanonBJ
[2012/01/16 13:46:40 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
[2012/01/16 13:46:39 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Canon
[2012/01/16 10:30:24 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
[2012/01/16 10:30:21 | 000,000,000 | ---D | C] -- D:\Program Files\Defraggler
[2012/01/16 10:28:50 | 000,000,000 | ---D | C] -- D:\Users\Legendary\AppData\Local\Google
[2012/01/16 10:28:50 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Google
[2012/01/15 05:12:06 | 000,000,000 | ---D | C] -- D:\Users\Legendary\AppData\Roaming\ASCOMP Software
[2012/01/15 05:11:59 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\ASCOMP Software
[2012/01/13 11:26:09 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Akquise & Verkauf
[2012/01/10 12:41:08 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Amazon
[2012/01/10 12:39:31 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012/01/10 12:39:20 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\PDF24
[2012/01/10 12:38:19 | 010,245,808 | ---- | C] (Geek Software GmbH ) -- D:\Users\Legendary\Desktop\pdf24-creator.exe
[2012/01/10 10:00:53 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Stick
[2012/01/06 06:37:43 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Verkauf
[2012/01/06 05:34:00 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Partner
[2012/01/05 12:14:16 | 000,000,000 | ---D | C] -- D:\Users\Legendary\Desktop\Desktop
========== Files - Modified Within 30 Days ==========
[2012/01/19 07:26:17 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2012/01/19 07:18:27 | 372,842,495 | -HS- | M] () -- D:\hiberfil.sys
[2012/01/19 07:18:18 | 000,017,920 | ---- | M] () -- D:\Windows\SysWow64\rpcnetp.exe
[2012/01/19 07:18:18 | 000,017,920 | ---- | M] () -- D:\Windows\System32\rpcnetp.exe
[2012/01/19 07:15:01 | 000,013,584 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/01/19 07:15:01 | 000,013,584 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/01/19 07:14:29 | 000,017,920 | ---- | M] () -- D:\Windows\SysWow64\rpcnetp.dll
[2012/01/19 07:14:22 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- D:\Windows\SysWow64\rpcnet.dll
[2012/01/19 06:04:39 | 000,000,221 | RHS- | M] () -- D:\ProgramData\wcttemp.html
[2012/01/19 06:04:39 | 000,000,016 | RHS- | M] () -- D:\ProgramData\wctreqid.sys
[2012/01/19 06:01:30 | 000,000,776 | ---- | M] () -- D:\Users\Legendary\AppData\Roaming\SMRBackup210.dat
[2012/01/19 05:54:19 | 000,021,504 | ---- | M] () -- D:\Windows\System32\umstartup.etl
[2012/01/19 05:50:02 | 000,021,504 | ---- | M] () -- D:\Windows\System32\umstartup000.etl
[2012/01/19 05:46:08 | 000,096,376 | ---- | M] (Symantec Corporation) -- D:\Windows\System32\drivers\SMR210.SYS
[2012/01/19 03:41:59 | 000,645,728 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2012/01/19 03:41:59 | 000,609,092 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2012/01/19 03:41:59 | 000,127,188 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2012/01/19 03:41:59 | 000,104,370 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2012/01/19 03:12:10 | 000,000,309 | ---- | M] () -- D:\Windows\SysWow64\upgrd.bat
[2012/01/19 03:11:46 | 000,013,160 | ---- | M] (Absolute Software Corp.) -- D:\Windows\SysWow64\Upgrd.exe
[2012/01/19 03:11:32 | 000,058,288 | ---- | M] (Absolute Software Corp.) -- D:\Windows\SysWow64\rpcnet.exe
[2012/01/19 02:57:07 | 000,000,177 | ---- | M] () -- D:\Windows\SysWow64\ctrestrt.bat
[2012/01/19 02:54:07 | 000,005,632 | ---- | M] (Absolute Software Corp.) -- D:\Windows\SysWow64\ctrestrt.exe
[2012/01/17 18:10:46 | 000,035,328 | ---- | M] (Absolute Software Corporation) -- D:\Windows\SysWow64\identprv.dll
[2012/01/17 03:44:34 | 047,208,103 | ---- | M] () -- D:\Users\Legendary\Desktop\2beknown - Die 5 Fehler im Kontaktmanagement.flv
[2012/01/17 03:23:48 | 000,109,549 | ---- | M] () -- D:\Users\Legendary\Desktop\wechselbereitschaft_im_vertrieb.pdf
[2012/01/17 03:15:18 | 031,469,188 | ---- | M] () -- D:\Users\Legendary\Desktop\Rainer spricht über Marketingtricks aus den USA.flv
[2012/01/17 03:09:22 | 016,024,214 | ---- | M] () -- D:\Users\Legendary\Desktop\seedorf.mp4
[2012/01/17 03:04:47 | 000,104,236 | ---- | M] () -- D:\Users\Legendary\Desktop\GA-Gruendungszuschuss.pdf
[2012/01/17 03:01:21 | 004,779,634 | ---- | M] () -- D:\Users\Legendary\Desktop\5653602_mp4_h264_aac_ld.mp4
[2012/01/16 13:57:26 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP460
[2012/01/16 13:46:44 | 000,002,056 | ---- | M] () -- D:\Users\Public\Desktop\MP Navigator 3.0.lnk
[2012/01/16 13:46:40 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
[2012/01/16 11:03:34 | 000,000,857 | ---- | M] () -- D:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/01/16 10:30:24 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
[2012/01/10 12:39:32 | 000,001,872 | ---- | M] () -- D:\Users\Public\Desktop\PDF24 Editor.lnk
[2012/01/10 12:39:32 | 000,001,857 | ---- | M] () -- D:\Users\Public\Desktop\PDF24 Fax.lnk
[2012/01/10 12:39:31 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
[2012/01/10 12:38:47 | 010,245,808 | ---- | M] (Geek Software GmbH ) -- D:\Users\Legendary\Desktop\pdf24-creator.exe
[2012/01/10 06:35:51 | 000,041,833 | ---- | M] () -- D:\Users\Legendary\Desktop\TeckieKulturkessel.JPG
========== Files Created - No Company Name ==========
[2012/01/19 05:46:31 | 000,000,776 | ---- | C] () -- D:\Users\Legendary\AppData\Roaming\SMRBackup210.dat
[2012/01/19 03:12:10 | 000,000,309 | ---- | C] () -- D:\Windows\SysWow64\upgrd.bat
[2012/01/19 02:57:07 | 000,000,177 | ---- | C] () -- D:\Windows\SysWow64\ctrestrt.bat
[2012/01/18 05:34:43 | 000,000,221 | RHS- | C] () -- D:\ProgramData\wcttemp.html
[2012/01/18 05:34:43 | 000,000,016 | RHS- | C] () -- D:\ProgramData\wctreqid.sys
[2012/01/17 03:23:48 | 000,109,549 | ---- | C] () -- D:\Users\Legendary\Desktop\wechselbereitschaft_im_vertrieb.pdf
[2012/01/17 03:21:55 | 047,208,103 | ---- | C] () -- D:\Users\Legendary\Desktop\2beknown - Die 5 Fehler im Kontaktmanagement.flv
[2012/01/17 03:10:17 | 031,469,188 | ---- | C] () -- D:\Users\Legendary\Desktop\Rainer spricht über Marketingtricks aus den USA.flv
[2012/01/17 03:08:20 | 016,024,214 | ---- | C] () -- D:\Users\Legendary\Desktop\seedorf.mp4
[2012/01/17 03:04:47 | 000,104,236 | ---- | C] () -- D:\Users\Legendary\Desktop\GA-Gruendungszuschuss.pdf
[2012/01/17 03:01:17 | 004,779,634 | ---- | C] () -- D:\Users\Legendary\Desktop\5653602_mp4_h264_aac_ld.mp4
[2012/01/16 13:46:44 | 000,002,056 | ---- | C] () -- D:\Users\Public\Desktop\MP Navigator 3.0.lnk
[2012/01/16 11:03:33 | 000,000,857 | ---- | C] () -- D:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012/01/10 12:39:32 | 000,001,857 | ---- | C] () -- D:\Users\Public\Desktop\PDF24 Fax.lnk
[2012/01/10 12:39:31 | 000,001,872 | ---- | C] () -- D:\Users\Public\Desktop\PDF24 Editor.lnk
[2012/01/10 06:35:49 | 000,041,833 | ---- | C] () -- D:\Users\Legendary\Desktop\TeckieKulturkessel.JPG
[2011/11/29 16:22:01 | 001,500,444 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2011/11/28 17:41:50 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.dll
[2011/11/28 17:40:41 | 000,017,920 | ---- | C] () -- D:\Windows\SysWow64\rpcnetp.exe
[2011/06/03 07:32:40 | 000,874,048 | ---- | C] () -- D:\Windows\SysWow64\igkrng575.bin
[2011/06/03 07:32:40 | 000,127,868 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng575.bin
[2011/06/03 07:32:40 | 000,104,796 | ---- | C] () -- D:\Windows\SysWow64\igfcg575m.bin
[2009/07/14 00:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 21:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 21:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 19:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 19:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 18:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 17:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 16:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 16:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat
========== LOP Check ==========
[2011/11/28 17:47:30 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2011/11/29 05:10:30 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2011/11/28 17:47:30 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/11/28 17:47:30 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2011/12/08 04:54:21 | 000,000,000 | ---D | M] -- D:\ProgramData\InstallMate
[2011/11/29 01:47:25 | 000,000,000 | ---D | M] -- D:\ProgramData\QUALCOMM
[2012/01/14 17:19:29 | 000,000,000 | -H-D | M] -- D:\ProgramData\Rpcnet
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2011/11/28 17:47:30 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2009/07/14 00:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2011/11/29 01:33:51 | 000,000,000 | ---D | M] -- D:\ProgramData\Uninstall
[2011/11/28 17:47:30 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2012/01/14 17:21:06 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 23040 bytes -> D:\Windows\System32\autochk.exe:BAK
< End of report >
--- --- --- |
