Trojaner-Board - Probleme mit SMART HDD

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Probleme mit SMART HDD (https://www.trojaner-board.de/113690-probleme-smart-hdd.html)

Probleme mit SMART HDD

Hallo,
bin neu hier und kenne mich so gut wie gar nicht mit dem Thema aus.
Toll das es so ein Forum gibt!
Brauche bitte eure Hilfe.
Mein Desktop ist komplett schwarz, ich sehe nur meinen Papierkorb, es sind mehrere Sicherheitsfenster offen.
Sorry das anhängen der Dateien hier hat auch nicht geklappt..
Habe bereits OTL runtergeladen, und das sind die Ergebnisse die von OTL rausgekommen sind.
Hoffe ihr könnt mir helfen!
Vielen Dank!

OTL.Txt:

OTL logfile created on: 15.04.2012 19:08:27 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Sweta\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19222)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 51,80% Memory free
6,21 Gb Paging File | 4,58 Gb Available in Paging File | 73,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 583,19 Gb Total Space | 454,95 Gb Free Space | 78,01% Space Free | Partition Type: NTFS
Drive D: | 12,98 Gb Total Space | 1,78 Gb Free Space | 13,69% Space Free | Partition Type: NTFS

Computer Name: SWETA-PC | User Name: Sweta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.04.15 19:07:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sweta\Downloads\OTL.exe
PRC - [2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
PRC - [2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
PRC - [2012.03.13 11:26:29 | 000,250,528 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe
PRC - [2012.02.28 13:33:51 | 000,638,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2011.10.11 15:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.23 21:20:18 | 000,887,976 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2009.10.14 13:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009.10.14 13:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2009.10.07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.10.17 17:57:18 | 000,189,736 | ---- | M] (CyberLink) -- C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2008.10.17 17:56:54 | 001,152,296 | ---- | M] (CyberLink Corp.) -- C:\Programme\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
PRC - [2008.10.03 16:41:20 | 000,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvraidservice.exe
PRC - [2008.09.26 03:36:40 | 001,148,200 | ---- | M] (CyberLink Corp.) -- C:\Programme\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2008.09.23 12:03:38 | 000,912,688 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.04.18 17:01:34 | 000,065,536 | -H-- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

========== Modules (No Company Name) ==========

MOD - [2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
MOD - [2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
MOD - [2012.04.13 00:58:31 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\09b9cd1c630210237b5b46d9943e1946\System.Windows.Forms.ni.dll
MOD - [2012.04.13 00:58:21 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\61759b9905aed9a87347d04b5fad046b\System.Drawing.ni.dll
MOD - [2012.04.13 00:58:06 | 014,328,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a8100864c7dd9ecf5d9f07fdaf5ba246\PresentationFramework.ni.dll
MOD - [2012.04.13 00:57:24 | 012,216,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\89b3b18de5d2cc945c24c0333d78f665\PresentationCore.ni.dll
MOD - [2012.02.16 17:10:16 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll
MOD - [2012.02.16 17:07:37 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll
MOD - [2012.02.16 17:07:34 | 000,627,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.ni.dll
MOD - [2012.02.16 17:07:34 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0ef893bbf33d38a1f7a63b9cee2dabfe\System.Transactions.ni.dll
MOD - [2012.02.16 17:07:34 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.Wrapper.dll
MOD - [2012.02.16 17:07:24 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll
MOD - [2012.02.16 16:57:05 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll
MOD - [2012.02.16 16:56:21 | 006,621,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll
MOD - [2012.02.16 16:56:05 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll
MOD - [2012.02.16 16:55:31 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll
MOD - [2012.02.16 16:55:26 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll
MOD - [2011.10.14 10:32:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.10.14 13:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009.10.14 13:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
MOD - [2009.04.11 08:28:21 | 000,368,640 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2009.04.11 04:04:15 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
MOD - [2009.03.30 06:42:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009.03.30 06:42:17 | 002,933,760 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.03.30 06:42:13 | 000,659,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
MOD - [2009.03.30 06:42:12 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.03.30 06:42:11 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
MOD - [2009.02.25 03:16:56 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.02.25 03:16:56 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2008.11.10 00:33:28 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2008.10.17 17:57:20 | 000,881,960 | ---- | M] () -- C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2008.10.17 10:39:18 | 000,032,768 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll
MOD - [2008.10.17 10:32:58 | 000,007,168 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2008.10.17 10:32:54 | 000,057,344 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2008.10.17 10:32:48 | 000,118,784 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\ECLibrary.dll
MOD - [2008.10.17 10:32:46 | 000,010,240 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2008.10.17 10:32:26 | 000,040,960 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2008.10.17 10:32:26 | 000,028,672 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2008.10.17 10:32:26 | 000,005,632 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2006.12.10 21:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006.12.10 21:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 -- (Norton Internet Security)
SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.10.07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.02.03 13:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX)
DRV - File not found [File_System | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.02.15 20:06:45 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.10.07 01:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.11.10 04:08:24 | 004,017,152 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.09.26 03:36:34 | 000,059,376 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- c:\Programme\Hewlett-Packard\Media\DVD\000.fcl -- ({55662437-DA8C-40c0-AADA-2C816A897A49})
DRV - [2008.09.10 02:58:08 | 000,020,640 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- C:\Programme\PC-Doctor for Windows\pcd5srvc.pkms -- (PCD5SRVC{BD6912E3-AC9D80E8-05040000})
DRV - [2008.08.01 14:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.07.21 18:12:50 | 000,145,952 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2008.07.21 18:12:50 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2008.05.22 11:39:34 | 000,015,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.07.19 02:44:00 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007.07.19 02:39:15 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2005.12.12 19:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
IE - HKLM\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {99D31906-4B07-4CA5-9B7E-2032E112F800}
IE - HKCU\..\SearchScopes\{128D3E0A-3F1A-48D1-ADFD-59991F7A7CDF}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPB_de
IE - HKCU\..\SearchScopes\{83A34CBC-E79C-41B7-A0F1-C22B7046A60D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=B5BC9946-237B-4616-95B3-78C82F760E26&apn_sauid=9333CBDF-4E3E-464E-8637-A207B1EAB65D&
IE - HKCU\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
IE - HKCU\..\SearchScopes\{9D04F553-D9B9-42D0-B204-A6492677F5FC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{AC28C4EA-82C3-4BB2-857D-37856D737068}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\..\SearchScopes\{EB19C0FF-7226-4154-8E32-42BEE64A61F1}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========== Chrome ==========

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartMenu] C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TSMAgent] c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlSnqDidGxPete.exe] C:\ProgramData\AlSnqDidGxPete.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED515004-0C4A-4397-857C-CCB44C77AC01}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.04.15 17:51:45 | 000,000,000 | -H-D | C] -- C:\Users\Sweta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD
[2012.04.12 17:31:35 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.04.12 17:31:34 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.04.12 17:31:33 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.04.12 17:31:33 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2012.04.12 17:31:33 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.04.12 17:31:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.04.12 17:31:33 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.04.12 17:31:33 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.04.12 17:31:33 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.04.12 17:31:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.04.12 17:31:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.04.12 17:31:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.04.12 17:31:32 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.04.12 17:31:32 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.04.12 17:31:32 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.04.12 17:31:32 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.04.12 17:31:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.04.12 17:31:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

========== Files - Modified Within 30 Days ==========

[2012.04.15 18:27:16 | 011,400,724 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.15 18:27:16 | 003,856,622 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.15 18:27:16 | 003,595,128 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.15 18:27:16 | 003,236,102 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.15 18:20:31 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 18:20:29 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 18:20:28 | 000,000,680 | -H-- | M] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat
[2012.04.15 18:20:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.15 18:20:19 | 3220,332,544 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.15 17:51:45 | 000,000,601 | -H-- | M] () -- C:\Users\Sweta\Desktop\SMART_HDD.lnk
[2012.04.15 17:51:45 | 000,000,168 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708r
[2012.04.15 17:51:45 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708
[2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
[2012.04.15 17:51:32 | 000,000,256 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708
[2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
[2012.04.10 12:06:30 | 000,026,538 | -H-- | M] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

========== Files Created - No Company Name ==========

[2012.04.15 17:51:45 | 000,000,601 | -H-- | C] () -- C:\Users\Sweta\Desktop\SMART_HDD.lnk
[2012.04.15 17:51:45 | 000,000,168 | -H-- | C] () -- C:\ProgramData\-VOcdQnqbv4L708r
[2012.04.15 17:51:45 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-VOcdQnqbv4L708
[2012.04.15 17:51:32 | 000,221,696 | -H-- | C] () -- C:\ProgramData\VOcdQnqbv4L708.exe
[2012.04.15 17:51:32 | 000,000,256 | -H-- | C] () -- C:\ProgramData\VOcdQnqbv4L708
[2012.04.15 17:45:17 | 000,301,568 | -H-- | C] () -- C:\ProgramData\AlSnqDidGxPete.exe
[2012.03.03 00:22:56 | 000,000,680 | -H-- | C] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat
[2010.11.29 12:48:02 | 000,000,462 | ---- | C] () -- C:\Windows\{A67C4EF9-725D-4C83-A67A-BB7B7DE96CF4}_WiseFW.ini
[2010.07.02 07:49:11 | 000,009,728 | -H-- | C] () -- C:\Users\Sweta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.19 21:33:13 | 000,000,760 | -H-- | C] () -- C:\Users\Sweta\AppData\Roaming\setup_ldm.iss
[2010.05.11 16:55:00 | 000,058,163 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

========== Files - Unicode (All) ==========
[2010.03.25 16:19:53 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps
[2010.03.25 16:19:53 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps
[2010.03.25 16:19:21 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps
[2010.03.25 16:19:21 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps
[2009.12.13 19:51:26 | 000,080,896 | -H-- | M] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps
[2009.12.13 19:51:26 | 000,080,896 | -H-- | C] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps
[2009.11.17 23:26:42 | 000,027,136 | -H-- | M] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps
[2009.11.17 23:26:42 | 000,027,136 | -H-- | C] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps
[2009.11.05 19:36:51 | 000,019,968 | -H-- | M] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps
[2009.11.05 19:36:51 | 000,019,968 | -H-- | C] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps
[2009.11.05 19:34:16 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps
[2009.11.05 19:34:16 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps
[2009.11.05 19:33:06 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps
[2009.11.05 19:33:06 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps
[2009.11.05 19:28:54 | 000,016,896 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps
[2009.11.05 19:28:54 | 000,016,896 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps
[2009.11.05 19:25:07 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps
[2009.11.05 19:25:07 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps
[2009.11.05 19:18:20 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps
[2009.11.05 19:18:20 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps
[2009.11.05 01:10:33 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps
[2009.11.01 15:02:19 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps
[2009.10.26 15:55:38 | 000,025,600 | -H-- | M] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps
[2009.10.13 10:06:44 | 000,025,600 | -H-- | C] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps
[2009.10.12 22:06:39 | 000,015,872 | -H-- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps
[2009.10.12 22:06:39 | 000,015,872 | -H-- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps
[2009.10.10 21:24:37 | 000,015,872 | -H-- | M] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps
[2009.10.10 21:24:37 | 000,015,872 | -H-- | C] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps
[2009.10.10 19:18:29 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps
[2009.10.10 19:18:28 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps
[2009.10.04 13:00:20 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps
[2009.10.04 13:00:20 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps
[2009.09.17 23:08:26 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps
[2009.09.17 23:08:26 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps
[2009.09.15 23:21:27 | 000,016,896 | -H-- | M] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps
[2009.09.15 23:21:27 | 000,016,896 | -H-- | C] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps
[2009.09.15 22:34:29 | 000,021,504 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps
[2009.09.15 22:34:29 | 000,021,504 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps

< End of report >

Und hier Extras.Txt:

OTL logfile created on: 15.04.2012 19:08:27 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Sweta\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19222)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

3,00 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 51,80% Memory free
6,21 Gb Paging File | 4,58 Gb Available in Paging File | 73,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 583,19 Gb Total Space | 454,95 Gb Free Space | 78,01% Space Free | Partition Type: NTFS
Drive D: | 12,98 Gb Total Space | 1,78 Gb Free Space | 13,69% Space Free | Partition Type: NTFS

Computer Name: SWETA-PC | User Name: Sweta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012.04.15 19:07:56 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sweta\Downloads\OTL.exe
PRC - [2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
PRC - [2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
PRC - [2012.03.13 11:26:29 | 000,250,528 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe
PRC - [2012.02.28 13:33:51 | 000,638,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2011.10.11 15:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.08.23 21:20:18 | 000,887,976 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe
PRC - [2009.10.14 13:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
PRC - [2009.10.14 13:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
PRC - [2009.10.07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.10.17 17:57:18 | 000,189,736 | ---- | M] (CyberLink) -- C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe
PRC - [2008.10.17 17:56:54 | 001,152,296 | ---- | M] (CyberLink Corp.) -- C:\Programme\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe
PRC - [2008.10.03 16:41:20 | 000,203,296 | ---- | M] (NVIDIA Corporation) -- C:\Windows\System32\nvraidservice.exe
PRC - [2008.09.26 03:36:40 | 001,148,200 | ---- | M] (CyberLink Corp.) -- C:\Programme\Hewlett-Packard\Media\DVD\DVDAgent.exe
PRC - [2008.09.23 12:03:38 | 000,912,688 | ---- | M] (Hewlett-Packard) -- C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
PRC - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.21 04:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.04.18 17:01:34 | 000,065,536 | -H-- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

========== Modules (No Company Name) ==========

MOD - [2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
MOD - [2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
MOD - [2012.04.13 00:58:31 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\09b9cd1c630210237b5b46d9943e1946\System.Windows.Forms.ni.dll
MOD - [2012.04.13 00:58:21 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\61759b9905aed9a87347d04b5fad046b\System.Drawing.ni.dll
MOD - [2012.04.13 00:58:06 | 014,328,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a8100864c7dd9ecf5d9f07fdaf5ba246\PresentationFramework.ni.dll
MOD - [2012.04.13 00:57:24 | 012,216,832 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\89b3b18de5d2cc945c24c0333d78f665\PresentationCore.ni.dll
MOD - [2012.02.16 17:10:16 | 000,998,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll
MOD - [2012.02.16 17:07:37 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll
MOD - [2012.02.16 17:07:34 | 000,627,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.ni.dll
MOD - [2012.02.16 17:07:34 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0ef893bbf33d38a1f7a63b9cee2dabfe\System.Transactions.ni.dll
MOD - [2012.02.16 17:07:34 | 000,280,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.Wrapper.dll
MOD - [2012.02.16 17:07:24 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll
MOD - [2012.02.16 16:57:05 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll
MOD - [2012.02.16 16:56:21 | 006,621,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll
MOD - [2012.02.16 16:56:05 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll
MOD - [2012.02.16 16:55:31 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll
MOD - [2012.02.16 16:55:26 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll
MOD - [2011.10.14 10:32:08 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.10.14 13:36:56 | 002,793,304 | ---- | M] () -- C:\Programme\Logitech\Logitech WebCam Software\LWS.exe
MOD - [2009.10.14 13:34:18 | 000,560,472 | ---- | M] () -- C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe
MOD - [2009.04.11 08:28:21 | 000,368,640 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2009.04.11 04:04:15 | 000,113,664 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
MOD - [2009.03.30 06:42:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2009.03.30 06:42:17 | 002,933,760 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2009.03.30 06:42:13 | 000,659,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
MOD - [2009.03.30 06:42:12 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2009.03.30 06:42:11 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll
MOD - [2009.02.25 03:16:56 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll
MOD - [2009.02.25 03:16:56 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2008.11.10 00:33:28 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2008.10.17 17:57:20 | 000,881,960 | ---- | M] () -- C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll
MOD - [2008.10.17 10:39:18 | 000,032,768 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll
MOD - [2008.10.17 10:32:58 | 000,007,168 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\RemotingClient.dll
MOD - [2008.10.17 10:32:54 | 000,057,344 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll
MOD - [2008.10.17 10:32:48 | 000,118,784 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\ECLibrary.dll
MOD - [2008.10.17 10:32:46 | 000,010,240 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingClients.dll
MOD - [2008.10.17 10:32:26 | 000,040,960 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingServer.dll
MOD - [2008.10.17 10:32:26 | 000,028,672 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingMessages.dll
MOD - [2008.10.17 10:32:26 | 000,005,632 | ---- | M] () -- C:\Programme\Hewlett-Packard\HP Advisor\MessagingInterface.dll
MOD - [2006.12.10 21:51:08 | 000,077,824 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll
MOD - [2006.12.10 21:51:08 | 000,065,536 | R--- | M] () -- C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 -- (Norton Internet Security)
SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.10.07 01:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.02.03 13:00:00 | 000,129,992 | ---- | M] (EasyBits Sofware AS) [Auto | Running] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008.01.21 04:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2008.01.21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS -- (SRTSPX)
DRV - File not found [File_System | System | Stopped] -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS -- (SRTSP)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVEX15.SYS -- (NAVEX15)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVENG.SYS -- (NAVENG)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - [2012.02.15 20:06:45 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.10.07 01:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2009.04.30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - [2008.11.10 04:08:24 | 004,017,152 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.09.26 03:36:34 | 000,059,376 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- c:\Programme\Hewlett-Packard\Media\DVD\000.fcl -- ({55662437-DA8C-40c0-AADA-2C816A897A49})
DRV - [2008.09.10 02:58:08 | 000,020,640 | ---- | M] (PC-Doctor, Inc.) [Kernel | On_Demand | Stopped] -- C:\Programme\PC-Doctor for Windows\pcd5srvc.pkms -- (PCD5SRVC{BD6912E3-AC9D80E8-05040000})
DRV - [2008.08.01 14:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2008.07.21 18:12:50 | 000,145,952 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2008.07.21 18:12:50 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2008.05.22 11:39:34 | 000,015,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007.07.19 02:44:00 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2007.07.19 02:39:15 | 000,013,848 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
DRV - [2005.12.12 19:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
IE - HKLM\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {99D31906-4B07-4CA5-9B7E-2032E112F800}
IE - HKCU\..\SearchScopes\{128D3E0A-3F1A-48D1-ADFD-59991F7A7CDF}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7SKPB_de
IE - HKCU\..\SearchScopes\{83A34CBC-E79C-41B7-A0F1-C22B7046A60D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=B5BC9946-237B-4616-95B3-78C82F760E26&apn_sauid=9333CBDF-4E3E-464E-8637-A207B1EAB65D&
IE - HKCU\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de
IE - HKCU\..\SearchScopes\{9D04F553-D9B9-42D0-B204-A6492677F5FC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933
IE - HKCU\..\SearchScopes\{AC28C4EA-82C3-4BB2-857D-37856D737068}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\..\SearchScopes\{EB19C0FF-7226-4154-8E32-42BEE64A61F1}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

========== Chrome ==========

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [SmartMenu] C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [TSMAgent] c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AlSnqDidGxPete.exe] C:\ProgramData\AlSnqDidGxPete.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED515004-0C4A-4397-857C-CCB44C77AC01}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012.04.15 17:51:45 | 000,000,000 | -H-D | C] -- C:\Users\Sweta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD
[2012.04.12 17:31:35 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.04.12 17:31:34 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.04.12 17:31:33 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.04.12 17:31:33 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2012.04.12 17:31:33 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.04.12 17:31:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.04.12 17:31:33 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.04.12 17:31:33 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.04.12 17:31:33 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.04.12 17:31:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.04.12 17:31:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.04.12 17:31:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.04.12 17:31:32 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.04.12 17:31:32 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.04.12 17:31:32 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.04.12 17:31:32 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.04.12 17:31:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.04.12 17:31:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

========== Files - Modified Within 30 Days ==========

[2012.04.15 18:27:16 | 011,400,724 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.04.15 18:27:16 | 003,856,622 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.04.15 18:27:16 | 003,595,128 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.04.15 18:27:16 | 003,236,102 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.04.15 18:20:31 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 18:20:29 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.04.15 18:20:28 | 000,000,680 | -H-- | M] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat
[2012.04.15 18:20:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.04.15 18:20:19 | 3220,332,544 | -HS- | M] () -- C:\hiberfil.sys
[2012.04.15 17:51:45 | 000,000,601 | -H-- | M] () -- C:\Users\Sweta\Desktop\SMART_HDD.lnk
[2012.04.15 17:51:45 | 000,000,168 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708r
[2012.04.15 17:51:45 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708
[2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe
[2012.04.15 17:51:32 | 000,000,256 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708
[2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe
[2012.04.10 12:06:30 | 000,026,538 | -H-- | M] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

========== Files Created - No Company Name ==========

[2012.04.15 17:51:45 | 000,000,601 | -H-- | C] () -- C:\Users\Sweta\Desktop\SMART_HDD.lnk
[2012.04.15 17:51:45 | 000,000,168 | -H-- | C] () -- C:\ProgramData\-VOcdQnqbv4L708r
[2012.04.15 17:51:45 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-VOcdQnqbv4L708
[2012.04.15 17:51:32 | 000,221,696 | -H-- | C] () -- C:\ProgramData\VOcdQnqbv4L708.exe
[2012.04.15 17:51:32 | 000,000,256 | -H-- | C] () -- C:\ProgramData\VOcdQnqbv4L708
[2012.04.15 17:45:17 | 000,301,568 | -H-- | C] () -- C:\ProgramData\AlSnqDidGxPete.exe
[2012.03.03 00:22:56 | 000,000,680 | -H-- | C] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat
[2010.11.29 12:48:02 | 000,000,462 | ---- | C] () -- C:\Windows\{A67C4EF9-725D-4C83-A67A-BB7B7DE96CF4}_WiseFW.ini
[2010.07.02 07:49:11 | 000,009,728 | -H-- | C] () -- C:\Users\Sweta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.06.19 21:33:13 | 000,000,760 | -H-- | C] () -- C:\Users\Sweta\AppData\Roaming\setup_ldm.iss
[2010.05.11 16:55:00 | 000,058,163 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

========== Files - Unicode (All) ==========
[2010.03.25 16:19:53 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps
[2010.03.25 16:19:53 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps
[2010.03.25 16:19:21 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps
[2010.03.25 16:19:21 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps
[2009.12.13 19:51:26 | 000,080,896 | -H-- | M] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps
[2009.12.13 19:51:26 | 000,080,896 | -H-- | C] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps
[2009.11.17 23:26:42 | 000,027,136 | -H-- | M] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps
[2009.11.17 23:26:42 | 000,027,136 | -H-- | C] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps
[2009.11.05 19:36:51 | 000,019,968 | -H-- | M] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps
[2009.11.05 19:36:51 | 000,019,968 | -H-- | C] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps
[2009.11.05 19:34:16 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps
[2009.11.05 19:34:16 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps
[2009.11.05 19:33:06 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps
[2009.11.05 19:33:06 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps
[2009.11.05 19:28:54 | 000,016,896 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps
[2009.11.05 19:28:54 | 000,016,896 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps
[2009.11.05 19:25:07 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps
[2009.11.05 19:25:07 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps
[2009.11.05 19:18:20 | 000,016,384 | -H-- | M] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps
[2009.11.05 19:18:20 | 000,016,384 | -H-- | C] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps
[2009.11.05 01:10:33 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps
[2009.11.01 15:02:19 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps
[2009.10.26 15:55:38 | 000,025,600 | -H-- | M] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps
[2009.10.13 10:06:44 | 000,025,600 | -H-- | C] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps
[2009.10.12 22:06:39 | 000,015,872 | -H-- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps
[2009.10.12 22:06:39 | 000,015,872 | -H-- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps
[2009.10.10 21:24:37 | 000,015,872 | -H-- | M] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps
[2009.10.10 21:24:37 | 000,015,872 | -H-- | C] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps
[2009.10.10 19:18:29 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps
[2009.10.10 19:18:28 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps
[2009.10.04 13:00:20 | 000,017,408 | -H-- | M] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps
[2009.10.04 13:00:20 | 000,017,408 | -H-- | C] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps
[2009.09.17 23:08:26 | 000,017,920 | -H-- | M] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps
[2009.09.17 23:08:26 | 000,017,920 | -H-- | C] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps
[2009.09.15 23:21:27 | 000,016,896 | -H-- | M] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps
[2009.09.15 23:21:27 | 000,016,896 | -H-- | C] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps
[2009.09.15 22:34:29 | 000,021,504 | -H-- | M] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps
[2009.09.15 22:34:29 | 000,021,504 | -H-- | C] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps

< End of report >

:hallo:

Mein Name ist Marius und ich werde dir bei deinem Problem helfen.

Eines vorneweg:

Hinweis: Wir können hier nie dafür garantieren, dass wir sämtliche Reste von Schadsoftware gefunden haben. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.

Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass du clean bist.

Eine Bereinigung ist mitunter mit viel Arbeit für dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Solltest du irgendwo nicht weiterkommen, stoppe an diesem Punkt und beschreibe dein Problem hier!
Nur Scans durchführen, zu denen du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren) - wenn du die anweisungen mehrere Helfer ausführst, kann das schwere Probleme nach sich ziehen!.
Installiere oder Deinstalliere während der Bereinigung keine Software (ausser, du wurdest dazu aufgefordert).
Wenn etwas unklar ist: Frage, bevor du etwas "blind" machst!
Poste die Logfiles direkt in deinen Thread. Nicht anhängen, außer, ich fordere dich dazu auf. Erschwert mir nämlich das Auswerten.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1: defogger

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

Starte das Tool mit Doppelklick.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.

Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.

Schritt 2: Gmer

Bitte

alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
nichts am Rechner arbeiten,
nach jedem Scan der Rechner neu gestarten.

Gmer scannen lassen

Lade Dir Gmer von dieser Seite herunter (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Alle anderen Programme sollen geschlossen sein.
Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen). Vista und Win7 User mit Rechtsklick und als Administrator starten.
Sollte sich ein Fenster mit folgender Warnung öffnen:
WARNING !!! GMER has found system modification, which might have been caused by ROOTKIT activity. Do you want to fully scan your system ?
Unbedingt auf "No" klicken.
Entferne rechts den Haken bei:
- IAT/EAT
- Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
- Show all (sollte abgehackt sein)
Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Hallo Marius,
vielen Dank für deine Hilfe.
Habe alles gemacht, wie du beschrieben hast.
Allerdings ist mein Desktop nach dem Neustart wieder schwarz und die ganzen Dateien nicht mehr sichtbar. Ist das normal?
Ok, was nun?

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

:OTL

MOD - [2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe

MOD - [2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe

IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)

IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}

IE - HKLM\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={output Encoding}&sourceid=ie7

IE - HKLM\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE - HKLM\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask)

IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)

IE - HKCU\..\SearchScopes,DefaultScope = {99D31906-4B07-4CA5-9B7E-2032E112F800}

IE - HKCU\..\SearchScopes\{128D3E0A-3F1A-48D1-ADFD-59991F7A7CDF}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}: "URL" = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06&type=ie2008

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={output Encoding}&sourceid=ie7&rlz=1I7SKPB_de

IE - HKCU\..\SearchScopes\{83A34CBC-E79C-41B7-A0F1-C22B7046A60D}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ 000YYDE&apn_uid=B5BC9946-237B-4616-95B3-78C82F760E26&apn_sauid=9333CBDF-4E3E-464E-8637-A207B1EAB65D&

IE - HKCU\..\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}: "URL" = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1145&query={searchTerms}&invocationType=tb50hpcndtie7-de-de

IE - HKCU\..\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}: "URL" = hxxp://de.kelkoopartners.net/ctl/do/search?siteSearchQuery={searchTerms}&fromform=true&x=true&y=true&partner=hp&partnerId=96913933

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245

O4 - HKCU..\Run: [AlSnqDidGxPete.exe] C:\ProgramData\AlSnqDidGxPete.exe ()

[2012.04.15 17:51:45 | 000,000,601 | -H-- | M] () -- C:\Users\Sweta\Desktop\SMART_HDD.lnk

[2012.04.15 17:51:45 | 000,000,168 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708r

[2012.04.15 17:51:45 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-VOcdQnqbv4L708

[2012.04.15 17:51:32 | 000,221,696 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708.exe

[2012.04.15 17:51:32 | 000,000,256 | -H-- | M] () -- C:\ProgramData\VOcdQnqbv4L708

[2012.04.15 17:43:10 | 000,301,568 | -H-- | M] () -- C:\ProgramData\AlSnqDidGxPete.exe

[2012.04.10 12:06:30 | 000,026,538 | -H-- | M] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

:COMMANDS

[EMPTYTEMP]

Schliesse bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2: defogger

Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.

Starte das Tool mit Doppelklick.
Vista und Win7 User mit Rechtsklick "als Administrator starten".
Klicke nun auf den Disable Button um die Treiber gewisser Emulatoren zu deaktivieren.
Wenn der Scan beendet wurde ( Finished ), klicke auf OK.
Defogger fordert gegebenfalls zum Neustart auf. Bestätige dies mit OK.

Sollte Defogger eine Fehlermeldung ausgeben, poste bitte die defogger_disable Log von deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung.

Schritt 3: GMER

Bitte

alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
nichts am Rechner arbeiten,
nach jedem Scan der Rechner neu gestarten.

Gmer scannen lassen

Lade Dir Gmer von dieser Seite herunter (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
Alle anderen Programme sollen geschlossen sein.
Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen). Vista und Win7 User mit Rechtsklick und als Administrator starten.
Sollte sich ein Fenster mit folgender Warnung öffnen:
WARNING !!! GMER has found system modification, which might have been caused by ROOTKIT activity. Do you want to fully scan your system ?
Unbedingt auf "No" klicken.
Entferne rechts den Haken bei:
- IAT/EAT
- Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
- Show all (sollte abgehackt sein)
Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ deleted successfully.
C:\Programme\softonic-de3\tbsoft.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D14827A-DABF-4680-AE44-F46DDFE0E614}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D31906-4B07-4CA5-9B7E-2032E112F800}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AAF799E4-D65C-49E1-838D-12A435C677FF}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\StartPageCache| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{128D3E0A-3F1A-48D1-ADFD-59991F7A7CDF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{128D3E0A-3F1A-48D1-ADFD-59991F7A7CDF}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{4D14827A-DABF-4680-AE44-F46DDFE0E614}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4D14827A-DABF-4680-AE44-F46DDFE0E614}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{83A34CBC-E79C-41B7-A0F1-C22B7046A60D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{83A34CBC-E79C-41B7-A0F1-C22B7046A60D}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{99D31906-4B07-4CA5-9B7E-2032E112F800}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D31906-4B07-4CA5-9B7E-2032E112F800}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AAF799E4-D65C-49E1-838D-12A435C677FF}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AAF799E4-D65C-49E1-838D-12A435C677FF}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\AlSnqDidGxPete.exe deleted successfully.
C:\ProgramData\AlSnqDidGxPete.exe moved successfully.
C:\Users\Sweta\Desktop\SMART_HDD.lnk moved successfully.
C:\ProgramData\-VOcdQnqbv4L708r moved successfully.
C:\ProgramData\-VOcdQnqbv4L708 moved successfully.
C:\ProgramData\VOcdQnqbv4L708.exe moved successfully.
C:\ProgramData\VOcdQnqbv4L708 moved successfully.
File C:\ProgramData\AlSnqDidGxPete.exe not found.
C:\Users\Sweta\AppData\Roaming\wklnhst.dat moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Sweta
->Temp folder emptied: 1811027 bytes
->Temporary Internet Files folder emptied: 197746555 bytes
->Java cache emptied: 21381196 bytes
->Google Chrome cache emptied: 6202823 bytes
->Apple Safari cache emptied: 915456 bytes
->Flash cache emptied: 470 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2366988 bytes
RecycleBin emptied: 257 bytes

Total Files Cleaned = 220,00 mb

OTL by OldTimer - Version 3.2.39.2 log created on 04162012_225528

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

OK, Windows sollte wieder normal starten.
Poste noch das Gmer-Log

Ja, die Sicherheitsfenster sind weg. Desktop ist immer noch schwarz.

Hier ist die Gmer.Log
Danke!

GMER Logfile:

Code:

GMER 1.0.15.15641 - GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-16 23:39:10

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\00000057 WDC_WD64 rev.01.0

Running: 6o40ng5l.exe; Driver: C:\Users\Sweta\AppData\Local\Temp\uwloypow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT   8B27D8A6                                                                                     ZwCreateSection

SSDT   8B27D8B0                                                                                     ZwRequestWaitReplyPort

SSDT   8B27D8AB                                                                                     ZwSetContextThread

SSDT   8B27D8B5                                                                                     ZwSetSecurityObject

SSDT   8B27D8BA                                                                                     ZwSystemDebugControl

SSDT   8B27D847                                                                                     ZwTerminateProcess
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text  ntkrnlpa.exe!KeSetEvent + 215                                                                81EEA998 4 Bytes  [A6, D8, 27, 8B]

.text  ntkrnlpa.exe!KeSetEvent + 539                                                                81EEACBC 4 Bytes  [B0, D8, 27, 8B]

.text  ntkrnlpa.exe!KeSetEvent + 56D                                                                81EEACF0 4 Bytes  [AB, D8, 27, 8B]

.text  ntkrnlpa.exe!KeSetEvent + 5D1                                                                81EEAD54 4 Bytes  [B5, D8, 27, 8B]

.text  ntkrnlpa.exe!KeSetEvent + 619                                                                81EEAD9C 4 Bytes  [BA, D8, 27, 8B]

.text  ...                                                                                          

.text  C:\Windows\system32\DRIVERS\atikmdag.sys                                                     section is writeable [0x8E40E000, 0x21FB8F, 0xE8000020]

       c:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                           entry point in "" section [0x9D51D41C]

.clc   c:\Program Files\Hewlett-Packard\Media\DVD\000.fcl                                           unknown last code section [0x9D51E000, 0x1000, 0xE0000020]
 

---- User code sections - GMER 1.0.15 ----
 

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CreateDialogParamW          771472A2 5 Bytes  JMP 10134BA0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!GetAsyncKeyState            7714863C 5 Bytes  JMP 6D188F27 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!SetWindowsHookExW           771487AD 5 Bytes  JMP 6D269AA5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CallNextHookEx              77148E3B 5 Bytes  JMP 6D25D119 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!UnhookWindowsHookEx         771498DB 5 Bytes  JMP 6D1D4686 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!EnableWindow                7714CD8B 5 Bytes  JMP 6D26DD2D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CreateWindowExW             77151305 5 Bytes  JMP 6D26DB14 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!GetKeyState                 77158CB1 5 Bytes  JMP 6D26D2DB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!IsDialogMessageW            77160745 5 Bytes  JMP 6D195A17 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!TrackPopupMenu              771614F3 5 Bytes  JMP 10134320 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CreateDialogParamA          771617AA 5 Bytes  JMP 6D36601B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!IsDialogMessage             77161847 5 Bytes  JMP 6D3658B7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CreateDialogIndirectParamA  771626F1 5 Bytes  JMP 6D366052 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!CreateDialogIndirectParamW  77169A62 5 Bytes  JMP 6D366089 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!SetKeyboardState            77170987 5 Bytes  JMP 6D365C26 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!TrackPopupMenuEx            77170CE7 5 Bytes  JMP 10134480 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!DialogBoxParamW             771710B0 5 Bytes  JMP 10134D20 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!DialogBoxIndirectParamW     77172EF5 5 Bytes  JMP 6D3653AF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!SendInput                   77172F75 5 Bytes  JMP 6D3667E3 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!EndDialog                   7717326E 5 Bytes  JMP 6D197EC2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!SetCursorPos                77186FB2 5 Bytes  JMP 6D366837 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!DialogBoxParamA             77188152 5 Bytes  JMP 6D36534C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!DialogBoxIndirectParamA     7718847D 5 Bytes  JMP 6D365412 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!MessageBoxIndirectA         7719D4D9 5 Bytes  JMP 6D3652E1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!MessageBoxIndirectW         7719D5D3 5 Bytes  JMP 6D365276 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!MessageBoxExA               7719D639 5 Bytes  JMP 6D365214 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!MessageBoxExW               7719D65D 5 Bytes  JMP 6D3651B2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] USER32.dll!keybd_event                 7719D972 5 Bytes  JMP 6D366B67 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] SHELL32.dll!SHRestricted + D95         763F89A8 4 Bytes  [4D, 30, E7, 61] {DEC EBP; XOR BH, AH; POPA }

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] SHELL32.dll!SHRestricted + D9D         763F89B0 8 Bytes  [57, 2F, E7, 61, 9C, 5B, E6, ...] {PUSH EDI; DAS ; OUT 0x61, EAX; PUSHF ; POP EBX; OUT 0x61, AL}

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] ole32.dll!OleLoadFromStream            75771E80 5 Bytes  JMP 6D365717 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3088] ole32.dll!CoCreateInstance             757A9F3E 5 Bytes  JMP 6D26DB70 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!CreateWindowExW             77151305 5 Bytes  JMP 6D26DB14 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!DialogBoxParamW             771710B0 5 Bytes  JMP 6D195505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!DialogBoxIndirectParamW     77172EF5 5 Bytes  JMP 6D3653AF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!DialogBoxParamA             77188152 5 Bytes  JMP 6D36534C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!DialogBoxIndirectParamA     7718847D 5 Bytes  JMP 6D365412 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!MessageBoxIndirectA         7719D4D9 5 Bytes  JMP 6D3652E1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!MessageBoxIndirectW         7719D5D3 5 Bytes  JMP 6D365276 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!MessageBoxExA               7719D639 5 Bytes  JMP 6D365214 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[3540] USER32.dll!MessageBoxExW               7719D65D 5 Bytes  JMP 6D3651B2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CreateDialogParamW          771472A2 5 Bytes  JMP 10134BA0 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!GetAsyncKeyState            7714863C 5 Bytes  JMP 6D188F27 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!SetWindowsHookExW           771487AD 5 Bytes  JMP 6D269AA5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CallNextHookEx              77148E3B 5 Bytes  JMP 6D25D119 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!UnhookWindowsHookEx         771498DB 5 Bytes  JMP 6D1D4686 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!EnableWindow                7714CD8B 5 Bytes  JMP 6D26DD2D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CreateWindowExW             77151305 5 Bytes  JMP 6D26DB14 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!GetKeyState                 77158CB1 5 Bytes  JMP 6D26D2DB C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!IsDialogMessageW            77160745 5 Bytes  JMP 6D195A17 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!TrackPopupMenu              771614F3 5 Bytes  JMP 10134320 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CreateDialogParamA          771617AA 5 Bytes  JMP 6D36601B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!IsDialogMessage             77161847 5 Bytes  JMP 6D3658B7 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CreateDialogIndirectParamA  771626F1 5 Bytes  JMP 6D366052 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!CreateDialogIndirectParamW  77169A62 5 Bytes  JMP 6D366089 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!SetKeyboardState            77170987 5 Bytes  JMP 6D365C26 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!TrackPopupMenuEx            77170CE7 5 Bytes  JMP 10134480 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!DialogBoxParamW             771710B0 5 Bytes  JMP 10134D20 C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Toolbar/Conduit Ltd.)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!DialogBoxIndirectParamW     77172EF5 5 Bytes  JMP 6D3653AF C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!SendInput                   77172F75 5 Bytes  JMP 6D3667E3 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!EndDialog                   7717326E 5 Bytes  JMP 6D197EC2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!SetCursorPos                77186FB2 5 Bytes  JMP 6D366837 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!DialogBoxParamA             77188152 5 Bytes  JMP 6D36534C C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!DialogBoxIndirectParamA     7718847D 5 Bytes  JMP 6D365412 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!MessageBoxIndirectA         7719D4D9 5 Bytes  JMP 6D3652E1 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!MessageBoxIndirectW         7719D5D3 5 Bytes  JMP 6D365276 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!MessageBoxExA               7719D639 5 Bytes  JMP 6D365214 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!MessageBoxExW               7719D65D 5 Bytes  JMP 6D3651B2 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] USER32.dll!keybd_event                 7719D972 5 Bytes  JMP 6D366B67 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] SHELL32.dll!SHRestricted + D95         763F89A8 4 Bytes  [4D, 30, E7, 61] {DEC EBP; XOR BH, AH; POPA }

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] SHELL32.dll!SHRestricted + D9D         763F89B0 8 Bytes  [57, 2F, E7, 61, 9C, 5B, E6, ...] {PUSH EDI; DAS ; OUT 0x61, EAX; PUSHF ; POP EBX; OUT 0x61, AL}

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] ole32.dll!OleLoadFromStream            75771E80 5 Bytes  JMP 6D365717 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text  C:\Program Files\Internet Explorer\iexplore.exe[5888] ole32.dll!CoCreateInstance             757A9F3E 5 Bytes  JMP 6D26DB70 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

unhide

Downloade bitte Grinler's unhide.exe auf deinen Desktop
Starte das Tool mit Doppelklick.

Wenn es seine Arbeit getan hat, wird eine Nachricht mit Done aufpoppen.
Es wird auch eine Logfile, Unhide.txt erstellen. Poste diese bitte hier.

Guten Morgen Marius,
es sind ein Paar Files jetzt auf dem Desktop sichtbar, die neuen Dateien und ein mein altes. Es stand in einem kleinem "Finished" Fenster etwas mit Avira runterfahren, dann werden die anderen auch sichtbar sein..

Hier ist Unhide Log:

Unhide by Lawrence Abrams (Grinler)
Bleeping Computer - Computer Help and Discussion
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
Unhide.exe - A introduction as to what this program does

Program started at: 04/17/2012 06:56:24 AM
Windows Version: Windows Vista

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 170767 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 16836 files processed.

Processing the F:\ drive
Finished processing the F:\ drive. 0 files processed.

Processing the G:\ drive
Finished processing the G:\ drive. 0 files processed.

Processing the H:\ drive
Finished processing the H:\ drive. 0 files processed.

Processing the I:\ drive
Finished processing the I:\ drive. 0 files processed.

The C:\Users\Sweta\AppData\Local\Temp\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: Unhide.exe - A introduction as to what this program does

Searching for Windows Registry changes made by FakeHDD rogues.
- Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
- Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
* Start_ShowControlPanel was set to 0! It was set back to 1!
* Start_ShowHelp was set to 0! It was set back to 1!
* Start_ShowMyComputer was set to 0! It was set back to 1!
* Start_ShowMyDocs was set to 0! It was set back to 1!
* Start_ShowMyMusic was set to 0! It was set back to 1!
* Start_ShowMyPics was set to 0! It was set back to 1!
* Start_ShowPrinters was set to 0! It was set back to 1!
* Start_ShowRun was set to 0! It was set back to 1!
* Start_ShowSearch was set to 0! It was set back to 1!
* Start_ShowSetProgramAccessAndDefaults was set to 0! It was set back to 1!
* Start_ShowRecentDocs was set to 0! It was set back to 2!
* Start_ShowNetConn was set to 0! It was set back to 1!
* Start_ShowNetPlaces was set to 0! It was set back to 1!
* Start_TrackDocs was set to 0! It was set back to 1!
* Start_TrackProgs was set to 0! It was set back to 1!
* Start_ShowUser was set to 0! It was set back to 1!
* Start_ShowMyGames was set to 0! It was set back to 1!

Restarting Explorer.exe in order to apply changes.

Program finished at: 04/17/2012 07:00:36 AM
Execution time: 0 hours(s), 4 minute(s), and 11 seconds(s)

combofix

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Das ist die Combofix Log

Combofix Logfile:

Code:

ComboFix 12-04-16.03 - Sweta 17.04.2012  20:14:28.1.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.1856 [GMT 2:00]

ausgeführt von:: c:\users\Sweta\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Sweta\4.0

c:\users\Sweta\Defogger.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-17 bis 2012-04-17  ))))))))))))))))))))))))))))))

.

.

2012-04-17 18:22 . 2012-04-17 18:22        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-16 20:55 . 2012-04-16 20:55        --------        d-----w-        C:\_OTL

2012-04-13 09:39 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{61518BE9-AE47-4522-B9B6-396B79869569}\mpengine.dll

2012-04-12 22:59 . 2012-02-29 15:11        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-04-12 22:59 . 2012-02-29 15:11        172032        ----a-w-        c:\windows\system32\wintrust.dll

2012-04-12 22:59 . 2012-02-29 15:09        157696        ----a-w-        c:\windows\system32\imagehlp.dll

2012-04-12 22:59 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-03-13 09:26 . 2011-05-13 14:52        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-23 08:18 . 2009-10-03 09:47        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-15 18:06 . 2011-10-15 05:34        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-02-02 15:16 . 2012-03-14 08:45        2044416        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2010-10-18 11:26        3908192        ----a-w-        c:\program files\ConduitEngine\ConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF42D4A8-016E-4fcd-B1EB-837659FD77C6}]

2011-12-12 16:12        1600616        ----a-w-        c:\program files\WEB.DE Toolbar\IE\uitb.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]

"{C424171E-592A-415a-9EB1-DFD6D95D3530}"= "c:\program files\WEB.DE Toolbar\IE\uitb.dll" [2011-12-12 1600616]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{c424171e-592a-415a-9eb1-dfd6d95d3530}]

[HKEY_CLASSES_ROOT\uitb.Toolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{99F77431-0658-476F-99CE-A05F35CDC7BA}]

[HKEY_CLASSES_ROOT\uitb.Toolbar]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\ConduitEngine.dll" [2010-10-18 3908192]

"{C424171E-592A-415A-9EB1-DFD6D95D3530}"= "c:\program files\WEB.DE Toolbar\IE\uitb.dll" [2011-12-12 1600616]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{c424171e-592a-415a-9eb1-dfd6d95d3530}]

[HKEY_CLASSES_ROOT\uitb.Toolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{99F77431-0658-476F-99CE-A05F35CDC7BA}]

[HKEY_CLASSES_ROOT\uitb.Toolbar]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-10-17 972080]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"NVRaidService"="c:\windows\system32\nvraidservice.exe" [2008-10-03 203296]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePDIRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]

"UpdatePSTShortCut"="c:\program files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" [2008-09-11 210216]

"TSMAgent"="c:\program files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe" [2008-10-17 1152296]

"CLMLServer for HP TouchSmart"="c:\program files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe" [2008-10-17 189736]

"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2008-09-26 1148200]

"SmartMenu"="c:\program files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe" [2008-09-23 912688]

"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-08-23 887976]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-01-16 421736]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

Inhalt des "geplante Tasks" Ordners

.

2010-07-26 c:\windows\Tasks\PCDRScheduledMaintenance.job

- c:\program files\PC-Doctor for Windows\pcdr5cuiw32.exe [2008-09-10 14:43]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://mail.ru/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.178.1

Handler: webde - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - c:\program files\WEB.DE Toolbar\IE\uitb.dll

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

BHO-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)

BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

Toolbar-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)

Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-04-17 20:22

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]

"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{55662437-DA8C-40c0-AADA-2C816A897A49}]

"ImagePath"="\??\c:\program files\Hewlett-Packard\Media\DVD\000.fcl"

.

Zeit der Fertigstellung: 2012-04-17  20:30:00

ComboFix-quarantined-files.txt  2012-04-17 18:29

.

Vor Suchlauf: 9 Verzeichnis(se), 490.321.997.824 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 490.251.493.376 Bytes frei

.

- - End Of File - - AEEE3ECB09BFDDF9C70B6F90292B815B

--- --- ---

Schritt 1: Programme deinstallieren

Klicke Start-->Systemsteuerung.
Öffne Programme und Funktionen.
Suche und deinstalliere folgende Einträge:

Zitat:

conduit engine
softonic-de3 toolbar
ask toolbar
Schließe das Fenster.

Schritt 2: MBAM

Downloade Dir bitte Malwarebytes

Installiere das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
Wenn das Update beendet wurde, aktiviere Vollständigen Scan durchführen und drücke auf Scannen.(Hinweis: Alle Festplatten anhaken!
Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 3: Neues OTL-Log

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)

Doppelklick auf die OTL.exe
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt
Poste die Logfiles hier in den Thread.

Hi Marius,
habe conduit engine und ask toolbar deinstalliert.
Softonic- de3 toolbar lässt sich nicht deinstallieren, es kommt ein Fenster mit:
- Datei Install.log konnte nicht geöffnet werden.-

Soll ich mit weiteren Schritten fortfahren?

Ja, fahre bitte fort!

Malwarebytes Anti-Malware 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.04.18.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.19222
Sweta :: SWETA-PC [Administrator]

18.04.2012 15:31:44
mbam-log-2012-04-18 (15-31-44).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 339802
Laufzeit: 1 Stunde(n), 30 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\_OTL\MovedFiles\04162012_225528\C_ProgramData\AlSnqDidGxPete.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\04162012_225528\C_ProgramData\VOcdQnqbv4L708.exe (Backdoor.Agent.RCGen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

OTL Logfile:

Code:

OTL logfile created on: 18.04.2012 17:12:00 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Sweta\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19222)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 61,74% Memory free

6,19 Gb Paging File | 4,84 Gb Available in Paging File | 78,10% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 583,19 Gb Total Space | 455,03 Gb Free Space | 78,02% Space Free | Partition Type: NTFS

Drive D: | 12,98 Gb Total Space | 1,78 Gb Free Space | 13,69% Space Free | Partition Type: NTFS

 

Computer Name: SWETA-PC | User Name: Sweta | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Sweta\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe (Adobe Systems, Inc.)

PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Logitech\Logitech WebCam Software\LWS.exe ()

PRC - C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe ()

PRC - C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()

PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

PRC - C:\Programme\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)

PRC - C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

PRC - C:\Programme\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)

PRC - C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\09b9cd1c630210237b5b46d9943e1946\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\61759b9905aed9a87347d04b5fad046b\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a8100864c7dd9ecf5d9f07fdaf5ba246\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\89b3b18de5d2cc945c24c0333d78f665\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0ef893bbf33d38a1f7a63b9cee2dabfe\System.Transactions.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.Wrapper.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\bcb66dbad2b45d05235b37a02f737eb5\Accessibility.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Programme\Logitech\Logitech WebCam Software\LWS.exe ()

MOD - C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe ()

MOD - C:\Windows\System32\msjetoledb40.dll ()

MOD - C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3235.39253__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3235.39378__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3235.39232__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3235.39256__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3235.39350__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3235.39324__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3235.39248__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3235.39301__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3235.39241__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3235.39331__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3235.39380__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3235.39333__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3235.39241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3235.39305__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3235.39243__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3235.39258__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3235.39297__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3235.39303__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3235.39342__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3235.39257__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3235.39319__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3235.39304__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3235.39400__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3235.39330__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3235.39302__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3235.39376__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3235.39261__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3235.39303__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3235.39318__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3235.39321__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3184.27501__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3184.27534__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3184.27485__90ba9c70f846762e\CLI.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3184.27518__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3184.27528__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3184.27483__90ba9c70f846762e\LOG.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3184.27484__90ba9c70f846762e\NEWAEM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3184.27567__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3184.27527__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3184.27511__90ba9c70f846762e\DEM.OS.I0602.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3184.27503__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3184.27499__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3184.27492__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3184.27499__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3184.27491__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3184.27510__90ba9c70f846762e\MOM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3184.27511__90ba9c70f846762e\DEM.OS.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3184.27512__90ba9c70f846762e\DEM.Graphics.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3184.27498__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3184.27515__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3184.27513__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3184.27506__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3184.27533__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3184.27509__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3184.27533__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3184.27518__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3184.27517__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3184.27509__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3184.27516__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3184.27513__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3184.27510__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3184.27519__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3184.27514__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3184.27508__90ba9c70f846762e\APM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3184.27499__90ba9c70f846762e\AEM.Server.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3235.39369__90ba9c70f846762e\MOM.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3235.39366__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3235.39393__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3184.27488__90ba9c70f846762e\CLI.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3184.27493__90ba9c70f846762e\LOG.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3184.27504__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3184.27510__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3184.27488__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()

MOD - C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3235.39406__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3235.39228__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.resources\2.0.3235.39237_de_90ba9c70f846762e\CLI.Component.Dashboard.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3235.39237__90ba9c70f846762e\CLI.Component.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3235.39248__90ba9c70f846762e\CLI.Component.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3235.39230__90ba9c70f846762e\ATIDEMOS.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3235.39229__90ba9c70f846762e\CLI.Component.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3235.39226__90ba9c70f846762e\APM.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3235.39231__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3184.27505__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3235.39227__90ba9c70f846762e\AEM.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3184.27496__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3235.39368__90ba9c70f846762e\CCC.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3184.27504__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3184.27521__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()

MOD - C:\Windows\System32\atitmmxx.dll ()

MOD - C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\RemotingClient.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\ECLibrary.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingClients.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingServer.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingMessages.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingInterface.dll ()

MOD - c:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll ()

MOD - C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll ()

MOD - C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 File not found

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (LVPrcSrv) -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (SRTSPX) -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS File not found

DRV - (SRTSP) -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS File not found

DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found

DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVEX15.SYS File not found

DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVENG.SYS File not found

DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found

DRV - (catchme) -- C:\Users\Sweta\AppData\Local\Temp\catchme.sys File not found

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (LVPr2Mon) -- C:\Windows\System32\drivers\LVPr2Mon.sys ()

DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) -- c:\Programme\Hewlett-Packard\Media\DVD\000.fcl (Cyberlink Corp.)

DRV - (PCD5SRVC{BD6912E3-AC9D80E8-05040000}) -- C:\Programme\PC-Doctor for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)

DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)

DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)

DRV - (nvrd32) -- C:\Windows\System32\drivers\nvrd32.sys (NVIDIA Corporation)

DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)

DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (pepifilter) -- C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)

DRV - (Ps2) -- C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=91&bd=Pavilion&pf=cndt

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = @MAIL.RU:

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 

IE - HKCU\..\SearchScopes,DefaultScope = {9D04F553-D9B9-42D0-B204-A6492677F5FC}

IE - HKCU\..\SearchScopes\{9D04F553-D9B9-42D0-B204-A6492677F5FC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{AC28C4EA-82C3-4BB2-857D-37856D737068}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

IE - HKCU\..\SearchScopes\{EB19C0FF-7226-4154-8E32-42BEE64A61F1}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 
 ========== Chrome  ==========

 

 

O1 HOSTS File: ([2012.04.17 20:22:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [DVDAgent] c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()

O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [SmartMenu] C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)

O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [TSMAgent] c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED515004-0C4A-4397-857C-CCB44C77AC01}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.18 15:30:05 | 000,000,000 | ---D | C] -- C:\Users\Sweta\AppData\Roaming\Malwarebytes

[2012.04.18 15:29:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.18 15:29:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.18 15:29:57 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.04.18 15:27:48 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Sweta\Desktop\mbam-setup-1.61.0.1400.exe

[2012.04.17 20:28:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.04.17 20:10:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.04.17 20:10:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.04.17 20:10:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.04.17 20:10:35 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.04.17 20:10:32 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.04.17 20:08:19 | 004,465,211 | R--- | C] (Swearware) -- C:\Users\Sweta\Desktop\ComboFix.exe

[2012.04.17 06:55:51 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Sweta\Desktop\unhide.exe

[2012.04.16 22:55:28 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.04.16 22:51:57 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Sweta\Desktop\OTL.exe

[2012.04.15 17:51:45 | 000,000,000 | ---D | C] -- C:\Users\Sweta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD

[2012.04.12 17:31:35 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.04.12 17:31:34 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.04.12 17:31:33 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.04.12 17:31:33 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2012.04.12 17:31:33 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012.04.12 17:31:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012.04.12 17:31:33 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012.04.12 17:31:33 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012.04.12 17:31:33 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.04.12 17:31:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012.04.12 17:31:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012.04.12 17:31:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012.04.12 17:31:32 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.04.12 17:31:32 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012.04.12 17:31:32 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012.04.12 17:31:32 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012.04.12 17:31:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012.04.12 17:31:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.18 17:12:44 | 003,924,718 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.18 17:12:44 | 003,301,510 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.18 17:12:43 | 011,618,060 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.18 17:12:43 | 003,666,472 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.18 17:09:23 | 000,000,276 | ---- | M] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

[2012.04.18 17:06:42 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.18 17:06:42 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.18 17:06:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.18 17:06:33 | 3220,324,352 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.18 17:05:13 | 000,016,384 | ---- | M] () -- C:\Users\Sweta\Documents\malware.wps

[2012.04.18 15:30:00 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.18 15:27:49 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Sweta\Desktop\mbam-setup-1.61.0.1400.exe

[2012.04.18 15:09:43 | 000,000,680 | ---- | M] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat

[2012.04.17 20:22:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.04.17 20:08:40 | 004,465,211 | R--- | M] (Swearware) -- C:\Users\Sweta\Desktop\ComboFix.exe

[2012.04.17 06:55:53 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Sweta\Desktop\unhide.exe

[2012.04.16 23:09:54 | 000,302,592 | ---- | M] () -- C:\Users\Sweta\Desktop\6o40ng5l.exe

[2012.04.16 23:06:21 | 000,000,000 | ---- | M] () -- C:\Users\Sweta\defogger_reenable

[2012.04.16 22:52:01 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sweta\Desktop\OTL.exe

[2012.04.16 21:55:17 | 000,302,592 | ---- | M] () -- C:\Users\Sweta\Desktop\d61bggbw.exe

[2012.04.16 21:50:09 | 000,000,000 | ---- | M] () -- C:\Users\Sweta\Desktop\defogger_reenable

[2012.04.16 21:47:18 | 000,050,477 | ---- | M] () -- C:\Users\Sweta\Desktop\Defogger.exe

[2012.04.15 20:50:10 | 000,042,840 | ---- | M] () -- C:\Users\Sweta\Extras.Text

[2012.04.15 20:49:51 | 000,171,398 | ---- | M] () -- C:\Users\Sweta\OTL.Text

[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

 
 ========== Files Created - No Company Name ==========

 

[2012.04.18 17:05:13 | 000,016,384 | ---- | C] () -- C:\Users\Sweta\Documents\malware.wps

[2012.04.18 15:30:00 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.18 10:48:10 | 000,000,276 | ---- | C] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

[2012.04.17 20:10:41 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.04.17 20:10:41 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.04.17 20:10:41 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.04.17 20:10:41 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.04.17 20:10:41 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.04.16 23:09:50 | 000,302,592 | ---- | C] () -- C:\Users\Sweta\Desktop\6o40ng5l.exe

[2012.04.16 23:06:21 | 000,000,000 | ---- | C] () -- C:\Users\Sweta\defogger_reenable

[2012.04.16 21:55:15 | 000,302,592 | ---- | C] () -- C:\Users\Sweta\Desktop\d61bggbw.exe

[2012.04.16 21:50:09 | 000,000,000 | ---- | C] () -- C:\Users\Sweta\Desktop\defogger_reenable

[2012.04.16 21:47:18 | 000,050,477 | ---- | C] () -- C:\Users\Sweta\Desktop\Defogger.exe

[2012.04.15 20:50:10 | 000,042,840 | ---- | C] () -- C:\Users\Sweta\Extras.Text

[2012.04.15 20:49:51 | 000,171,398 | ---- | C] () -- C:\Users\Sweta\OTL.Text

[2012.03.03 00:22:56 | 000,000,680 | ---- | C] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat

[2010.11.29 12:48:02 | 000,000,462 | ---- | C] () -- C:\Windows\{A67C4EF9-725D-4C83-A67A-BB7B7DE96CF4}_WiseFW.ini

[2010.07.02 07:49:11 | 000,009,728 | ---- | C] () -- C:\Users\Sweta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.06.19 21:33:13 | 000,000,760 | ---- | C] () -- C:\Users\Sweta\AppData\Roaming\setup_ldm.iss

[2010.05.11 16:55:00 | 000,058,163 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

 
 ========== Files - Unicode (All) ==========

[2010.03.25 16:19:53 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps

[2010.03.25 16:19:53 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps

[2010.03.25 16:19:21 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps

[2010.03.25 16:19:21 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps

[2009.12.13 19:51:26 | 000,080,896 | ---- | M] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps

[2009.12.13 19:51:26 | 000,080,896 | ---- | C] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps

[2009.11.17 23:26:42 | 000,027,136 | ---- | M] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps

[2009.11.17 23:26:42 | 000,027,136 | ---- | C] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps

[2009.11.05 19:36:51 | 000,019,968 | ---- | M] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps

[2009.11.05 19:36:51 | 000,019,968 | ---- | C] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps

[2009.11.05 19:34:16 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps

[2009.11.05 19:34:16 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps

[2009.11.05 19:33:06 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps

[2009.11.05 19:33:06 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps

[2009.11.05 19:28:54 | 000,016,896 | ---- | M] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps

[2009.11.05 19:28:54 | 000,016,896 | ---- | C] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps

[2009.11.05 19:25:07 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps

[2009.11.05 19:25:07 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps

[2009.11.05 19:18:20 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps

[2009.11.05 19:18:20 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps

[2009.11.05 01:10:33 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps

[2009.11.01 15:02:19 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps

[2009.10.26 15:55:38 | 000,025,600 | ---- | M] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps

[2009.10.13 10:06:44 | 000,025,600 | ---- | C] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps

[2009.10.12 22:06:39 | 000,015,872 | ---- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps

[2009.10.12 22:06:39 | 000,015,872 | ---- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps

[2009.10.10 21:24:37 | 000,015,872 | ---- | M] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps

[2009.10.10 21:24:37 | 000,015,872 | ---- | C] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps

[2009.10.10 19:18:29 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps

[2009.10.10 19:18:28 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps

[2009.10.04 13:00:20 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps

[2009.10.04 13:00:20 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps

[2009.09.17 23:08:26 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps

[2009.09.17 23:08:26 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps

[2009.09.15 23:21:27 | 000,016,896 | ---- | M] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps

[2009.09.15 23:21:27 | 000,016,896 | ---- | C] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps

[2009.09.15 22:34:29 | 000,021,504 | ---- | M] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps

[2009.09.15 22:34:29 | 000,021,504 | ---- | C] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL logfile created on: 18.04.2012 17:12:00 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Sweta\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19222)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 61,74% Memory free

6,19 Gb Paging File | 4,84 Gb Available in Paging File | 78,10% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 583,19 Gb Total Space | 455,03 Gb Free Space | 78,02% Space Free | Partition Type: NTFS

Drive D: | 12,98 Gb Total Space | 1,78 Gb Free Space | 13,69% Space Free | Partition Type: NTFS

 

Computer Name: SWETA-PC | User Name: Sweta | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Sweta\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Windows\System32\Macromed\Flash\FlashUtil11g_ActiveX.exe (Adobe Systems, Inc.)

PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

PRC - C:\Programme\Logitech\Logitech WebCam Software\LWS.exe ()

PRC - C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe ()

PRC - C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()

PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

PRC - C:\Programme\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)

PRC - C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

PRC - C:\Programme\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)

PRC - C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)

PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\09b9cd1c630210237b5b46d9943e1946\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\61759b9905aed9a87347d04b5fad046b\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a8100864c7dd9ecf5d9f07fdaf5ba246\PresentationFramework.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\89b3b18de5d2cc945c24c0333d78f665\PresentationCore.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\8b5f54e3b382fc1720c76557ef8c8bc3\System.Management.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\5c3bfd69e0c268baff0d169e11a6a784\System.Runtime.Remoting.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\0ef893bbf33d38a1f7a63b9cee2dabfe\System.Transactions.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\a333ad288c1a4bbbba8f61249202bc1a\System.EnterpriseServices.Wrapper.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\7fd6c62196829d1e2dce5a253145d51a\System.Configuration.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d9f0f1dc8cbdb81f1ba122d77a6ab710\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\029217106fa24787ff7a61b754f8ebf7\System.Data.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\d48e106e015d0f8cb2d5295015cee508\PresentationFramework.Aero.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1e258a951222c818540b33880ca45f2e\WindowsBase.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\c50133cb67d7c013fa31e1ffb942060b\System.ni.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\bcb66dbad2b45d05235b37a02f737eb5\Accessibility.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll ()

MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll ()

MOD - C:\Programme\Logitech\Logitech WebCam Software\LWS.exe ()

MOD - C:\Programme\Common Files\logishrd\LQCVFX\COCIManager.exe ()

MOD - C:\Windows\System32\msjetoledb40.dll ()

MOD - C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()

MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Wizard\2.0.3235.39253__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3235.39378__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3235.39232__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3235.39256__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3235.39350__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3235.39324__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3235.39248__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3235.39301__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3235.39241__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3235.39331__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3235.39380__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3235.39333__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3235.39241__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3235.39305__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager.Graphics.Dashboard\2.0.3235.39243__90ba9c70f846762e\CLI.Aspect.DisplaysManager.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3235.39258__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3235.39297__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3235.39303__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3235.39342__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3235.39257__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3235.39319__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3235.39304__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3235.39400__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3235.39330__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3235.39302__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime\2.0.3235.39376__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3235.39261__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3235.39303__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3235.39318__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3235.39321__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3184.27501__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3184.27534__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3184.27485__90ba9c70f846762e\CLI.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3184.27518__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3184.27528__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3184.27483__90ba9c70f846762e\LOG.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3184.27484__90ba9c70f846762e\NEWAEM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3184.27567__90ba9c70f846762e\CLI.Foundation.XManifest.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.PowerPlayDPPE.Graphics.Shared\2.0.3184.27527__90ba9c70f846762e\CLI.Aspect.PowerPlayDPPE.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS.I0602\2.0.3184.27511__90ba9c70f846762e\DEM.OS.I0602.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3184.27503__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3184.27499__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3184.27492__90ba9c70f846762e\CLI.Component.Client.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3184.27499__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3184.27491__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3184.27510__90ba9c70f846762e\MOM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.OS\2.0.3184.27511__90ba9c70f846762e\DEM.OS.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3184.27512__90ba9c70f846762e\DEM.Graphics.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3184.27498__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3184.27515__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3184.27513__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3184.27506__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3184.27533__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3184.27509__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3184.27533__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3184.27518__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3184.27517__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3184.27520__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3184.27509__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3184.27516__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3184.27513__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3184.27510__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3184.27519__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ACE.Graphics.DisplaysManager.Shared\2.0.2573.17685__90ba9c70f846762e\ACE.Graphics.DisplaysManager.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3184.27514__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3184.27508__90ba9c70f846762e\APM.Foundation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3184.27499__90ba9c70f846762e\AEM.Server.Shared.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3235.39369__90ba9c70f846762e\MOM.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3235.39366__90ba9c70f846762e\LOG.Foundation.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3235.39393__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3184.27488__90ba9c70f846762e\CLI.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3184.27493__90ba9c70f846762e\LOG.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3184.27504__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3184.27510__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Private\2.0.3184.27488__90ba9c70f846762e\LOCALIZATION.Foundation.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AxInterop.WBOCXLib\1.0.0.0__90ba9c70f846762e\AxInterop.WBOCXLib.dll ()

MOD - C:\Windows\assembly\GAC\Interop.WBOCXLib\1.0.0.0__90ba9c70f846762e\Interop.WBOCXLib.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\LOCALIZATION.Foundation.Implementation\2.0.3235.39406__90ba9c70f846762e\LOCALIZATION.Foundation.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3235.39228__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.resources\2.0.3235.39237_de_90ba9c70f846762e\CLI.Component.Dashboard.resources.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3235.39237__90ba9c70f846762e\CLI.Component.Dashboard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3235.39248__90ba9c70f846762e\CLI.Component.Wizard.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ATIDEMOS\2.0.3235.39230__90ba9c70f846762e\ATIDEMOS.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3235.39229__90ba9c70f846762e\CLI.Component.Runtime.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3235.39226__90ba9c70f846762e\APM.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3235.39231__90ba9c70f846762e\CLI.Component.SkinFactory.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3184.27505__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3235.39227__90ba9c70f846762e\AEM.Server.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3184.27496__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3235.39368__90ba9c70f846762e\CCC.Implementation.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3184.27504__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3184.27521__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll ()

MOD - C:\Windows\System32\atitmmxx.dll ()

MOD - C:\Programme\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMediaLibrary.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\Content.XmlSerializers.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\RemotingClient.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\Pillars\PCAlerts\PCAlertsPillar.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\ECLibrary.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingClients.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingServer.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingMessages.dll ()

MOD - C:\Programme\Hewlett-Packard\HP Advisor\MessagingInterface.dll ()

MOD - c:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll ()

MOD - C:\Programme\HP\Digital Imaging\bin\crm\xmltok.dll ()

MOD - C:\Programme\HP\Digital Imaging\bin\crm\xmlparse.dll ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (Norton Internet Security) -- C:\Program Files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll /prefetch:1 File not found

SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)

SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)

SRV - (LVPrcSrv) -- C:\Programme\Common Files\logishrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)

SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (SRTSPX) -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSPX.SYS File not found

DRV - (SRTSP) -- C:\Windows\system32\drivers\NIS\1000000.07D\SRTSP.SYS File not found

DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found

DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVEX15.SYS File not found

DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20081022.006\NAVENG.SYS File not found

DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found

DRV - (catchme) -- C:\Users\Sweta\AppData\Local\Temp\catchme.sys File not found

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (LVPr2Mon) -- C:\Windows\System32\drivers\LVPr2Mon.sys ()

DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)

DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV - ({55662437-DA8C-40c0-AADA-2C816A897A49}) -- c:\Programme\Hewlett-Packard\Media\DVD\000.fcl (Cyberlink Corp.)

DRV - (PCD5SRVC{BD6912E3-AC9D80E8-05040000}) -- C:\Programme\PC-Doctor for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)

DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)

DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)

DRV - (nvrd32) -- C:\Windows\System32\drivers\nvrd32.sys (NVIDIA Corporation)

DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)

DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (pepifilter) -- C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)

DRV - (Ps2) -- C:\Windows\System32\drivers\PS2.sys (Hewlett-Packard Company)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = HP | MSN

IE - HKLM\..\SearchScopes,DefaultScope = 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = @MAIL.RU:

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 

IE - HKCU\..\SearchScopes,DefaultScope = {9D04F553-D9B9-42D0-B204-A6492677F5FC}

IE - HKCU\..\SearchScopes\{9D04F553-D9B9-42D0-B204-A6492677F5FC}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\..\SearchScopes\{AC28C4EA-82C3-4BB2-857D-37856D737068}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

IE - HKCU\..\SearchScopes\{EB19C0FF-7226-4154-8E32-42BEE64A61F1}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

 

 
 ========== Chrome  ==========

 

 

O1 HOSTS File: ([2012.04.17 20:22:36 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O2 - BHO: (WEB.DE Toolbar BHO) - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKLM\..\Toolbar: (WEB.DE Toolbar) - {C424171E-592A-415a-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (WEB.DE Toolbar) - {C424171E-592A-415A-9EB1-DFD6D95D3530} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Sweta\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)

O4 - HKLM..\Run: [DVDAgent] c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()

O4 - HKLM..\Run: [NVRaidService] C:\Windows\System32\nvraidservice.exe (NVIDIA Corporation)

O4 - HKLM..\Run: [SmartMenu] C:\Programme\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)

O4 - HKLM..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)

O4 - HKLM..\Run: [TSMAgent] c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdateP2GoShortCut] c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdatePDIRShortCut] c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKLM..\Run: [UpdatePSTShortCut] c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)

O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Ranges: Range1 ([http] in Local intranet)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ED515004-0C4A-4397-857C-CCB44C77AC01}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\webde {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Programme\WEB.DE Toolbar\IE\uitb.dll (1und1 Mail und Media GmbH)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Sweta\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012.04.18 15:30:05 | 000,000,000 | ---D | C] -- C:\Users\Sweta\AppData\Roaming\Malwarebytes

[2012.04.18 15:29:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2012.04.18 15:29:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2012.04.18 15:29:57 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012.04.18 15:29:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2012.04.18 15:27:48 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\Sweta\Desktop\mbam-setup-1.61.0.1400.exe

[2012.04.17 20:28:53 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012.04.17 20:10:41 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012.04.17 20:10:41 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012.04.17 20:10:41 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012.04.17 20:10:35 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT

[2012.04.17 20:10:32 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012.04.17 20:08:19 | 004,465,211 | R--- | C] (Swearware) -- C:\Users\Sweta\Desktop\ComboFix.exe

[2012.04.17 06:55:51 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Sweta\Desktop\unhide.exe

[2012.04.16 22:55:28 | 000,000,000 | ---D | C] -- C:\_OTL

[2012.04.16 22:51:57 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Sweta\Desktop\OTL.exe

[2012.04.15 17:51:45 | 000,000,000 | ---D | C] -- C:\Users\Sweta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SMART HDD

[2012.04.12 17:31:35 | 000,105,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll

[2012.04.12 17:31:34 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll

[2012.04.12 17:31:33 | 001,469,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl

[2012.04.12 17:31:33 | 000,611,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll

[2012.04.12 17:31:33 | 000,602,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll

[2012.04.12 17:31:33 | 000,387,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll

[2012.04.12 17:31:33 | 000,385,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec

[2012.04.12 17:31:33 | 000,184,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll

[2012.04.12 17:31:33 | 000,164,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll

[2012.04.12 17:31:33 | 000,133,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe

[2012.04.12 17:31:33 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll

[2012.04.12 17:31:33 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll

[2012.04.12 17:31:32 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb

[2012.04.12 17:31:32 | 000,174,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe

[2012.04.12 17:31:32 | 000,055,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll

[2012.04.12 17:31:32 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll

[2012.04.12 17:31:32 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll

[2012.04.12 17:31:32 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2012.04.18 17:12:44 | 003,924,718 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012.04.18 17:12:44 | 003,301,510 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012.04.18 17:12:43 | 011,618,060 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2012.04.18 17:12:43 | 003,666,472 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2012.04.18 17:09:23 | 000,000,276 | ---- | M] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

[2012.04.18 17:06:42 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012.04.18 17:06:42 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012.04.18 17:06:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012.04.18 17:06:33 | 3220,324,352 | -HS- | M] () -- C:\hiberfil.sys

[2012.04.18 17:05:13 | 000,016,384 | ---- | M] () -- C:\Users\Sweta\Documents\malware.wps

[2012.04.18 15:30:00 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.18 15:27:49 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\Sweta\Desktop\mbam-setup-1.61.0.1400.exe

[2012.04.18 15:09:43 | 000,000,680 | ---- | M] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat

[2012.04.17 20:22:36 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012.04.17 20:08:40 | 004,465,211 | R--- | M] (Swearware) -- C:\Users\Sweta\Desktop\ComboFix.exe

[2012.04.17 06:55:53 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Sweta\Desktop\unhide.exe

[2012.04.16 23:09:54 | 000,302,592 | ---- | M] () -- C:\Users\Sweta\Desktop\6o40ng5l.exe

[2012.04.16 23:06:21 | 000,000,000 | ---- | M] () -- C:\Users\Sweta\defogger_reenable

[2012.04.16 22:52:01 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sweta\Desktop\OTL.exe

[2012.04.16 21:55:17 | 000,302,592 | ---- | M] () -- C:\Users\Sweta\Desktop\d61bggbw.exe

[2012.04.16 21:50:09 | 000,000,000 | ---- | M] () -- C:\Users\Sweta\Desktop\defogger_reenable

[2012.04.16 21:47:18 | 000,050,477 | ---- | M] () -- C:\Users\Sweta\Desktop\Defogger.exe

[2012.04.15 20:50:10 | 000,042,840 | ---- | M] () -- C:\Users\Sweta\Extras.Text

[2012.04.15 20:49:51 | 000,171,398 | ---- | M] () -- C:\Users\Sweta\OTL.Text

[2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

 
 ========== Files Created - No Company Name ==========

 

[2012.04.18 17:05:13 | 000,016,384 | ---- | C] () -- C:\Users\Sweta\Documents\malware.wps

[2012.04.18 15:30:00 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

[2012.04.18 10:48:10 | 000,000,276 | ---- | C] () -- C:\Users\Sweta\AppData\Roaming\wklnhst.dat

[2012.04.17 20:10:41 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012.04.17 20:10:41 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012.04.17 20:10:41 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012.04.17 20:10:41 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012.04.17 20:10:41 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012.04.16 23:09:50 | 000,302,592 | ---- | C] () -- C:\Users\Sweta\Desktop\6o40ng5l.exe

[2012.04.16 23:06:21 | 000,000,000 | ---- | C] () -- C:\Users\Sweta\defogger_reenable

[2012.04.16 21:55:15 | 000,302,592 | ---- | C] () -- C:\Users\Sweta\Desktop\d61bggbw.exe

[2012.04.16 21:50:09 | 000,000,000 | ---- | C] () -- C:\Users\Sweta\Desktop\defogger_reenable

[2012.04.16 21:47:18 | 000,050,477 | ---- | C] () -- C:\Users\Sweta\Desktop\Defogger.exe

[2012.04.15 20:50:10 | 000,042,840 | ---- | C] () -- C:\Users\Sweta\Extras.Text

[2012.04.15 20:49:51 | 000,171,398 | ---- | C] () -- C:\Users\Sweta\OTL.Text

[2012.03.03 00:22:56 | 000,000,680 | ---- | C] () -- C:\Users\Sweta\AppData\Local\d3d9caps.dat

[2010.11.29 12:48:02 | 000,000,462 | ---- | C] () -- C:\Windows\{A67C4EF9-725D-4C83-A67A-BB7B7DE96CF4}_WiseFW.ini

[2010.07.02 07:49:11 | 000,009,728 | ---- | C] () -- C:\Users\Sweta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010.06.19 21:33:13 | 000,000,760 | ---- | C] () -- C:\Users\Sweta\AppData\Roaming\setup_ldm.iss

[2010.05.11 16:55:00 | 000,058,163 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

 
 ========== Files - Unicode (All) ==========

[2010.03.25 16:19:53 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps

[2010.03.25 16:19:53 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\?? ???????, ????? ???.wps) -- C:\Users\Sweta\Documents\Об отпуске, часть два.wps

[2010.03.25 16:19:21 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps

[2010.03.25 16:19:21 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Сука.wps

[2009.12.13 19:51:26 | 000,080,896 | ---- | M] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps

[2009.12.13 19:51:26 | 000,080,896 | ---- | C] ()(C:\Users\Sweta\Documents\???????????.wps) -- C:\Users\Sweta\Documents\Афродизиаки.wps

[2009.11.17 23:26:42 | 000,027,136 | ---- | M] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps

[2009.11.17 23:26:42 | 000,027,136 | ---- | C] ()(C:\Users\Sweta\Documents\????????? ? ???????.wps) -- C:\Users\Sweta\Documents\Подрулила к бордюру.wps

[2009.11.05 19:36:51 | 000,019,968 | ---- | M] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps

[2009.11.05 19:36:51 | 000,019,968 | ---- | C] ()(C:\Users\Sweta\Documents\??? ???????? ??? ????.wps) -- C:\Users\Sweta\Documents\Мне остаться или уйти.wps

[2009.11.05 19:34:16 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps

[2009.11.05 19:34:16 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\? ??? ?????..wps) -- C:\Users\Sweta\Documents\А что стихи..wps

[2009.11.05 19:33:06 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps

[2009.11.05 19:33:06 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\????????? ???????? ???.wps) -- C:\Users\Sweta\Documents\Ароматами терпкого коф.wps

[2009.11.05 19:28:54 | 000,016,896 | ---- | M] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps

[2009.11.05 19:28:54 | 000,016,896 | ---- | C] ()(C:\Users\Sweta\Documents\?? ??????????.wps) -- C:\Users\Sweta\Documents\не Аэрофлотом.wps

[2009.11.05 19:25:07 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps

[2009.11.05 19:25:07 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\? ???????? ? ?????.wps) -- C:\Users\Sweta\Documents\И коленкой в живот.wps

[2009.11.05 19:18:20 | 000,016,384 | ---- | M] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps

[2009.11.05 19:18:20 | 000,016,384 | ---- | C] ()(C:\Users\Sweta\Documents\??? ????? ??? ???????.wps) -- C:\Users\Sweta\Documents\Вот такая вот суббота.wps

[2009.11.05 01:10:33 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps

[2009.11.01 15:02:19 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\? ???? ?????.wps) -- C:\Users\Sweta\Documents\Я тебя очень.wps

[2009.10.26 15:55:38 | 000,025,600 | ---- | M] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps

[2009.10.13 10:06:44 | 000,025,600 | ---- | C] ()(C:\Users\Sweta\Documents\? ??????? ??? ????.wps) -- C:\Users\Sweta\Documents\я сегодня всю ночь.wps

[2009.10.12 22:06:39 | 000,015,872 | ---- | M] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps

[2009.10.12 22:06:39 | 000,015,872 | ---- | C] ()(C:\Users\Sweta\Documents\????.wps) -- C:\Users\Sweta\Documents\Стеб.wps

[2009.10.10 21:24:37 | 000,015,872 | ---- | M] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps

[2009.10.10 21:24:37 | 000,015,872 | ---- | C] ()(C:\Users\Sweta\Documents\? ????? ????.wps) -- C:\Users\Sweta\Documents\В нутри моей.wps

[2009.10.10 19:18:29 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps

[2009.10.10 19:18:28 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\?????-?????? ?? ????????? ??? ???,.wps) -- C:\Users\Sweta\Documents\Когда-нибудь ты вспомнишь обо мне,.wps

[2009.10.04 13:00:20 | 000,017,408 | ---- | M] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps

[2009.10.04 13:00:20 | 000,017,408 | ---- | C] ()(C:\Users\Sweta\Documents\??????? ??????.wps) -- C:\Users\Sweta\Documents\Немного интима.wps

[2009.09.17 23:08:26 | 000,017,920 | ---- | M] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps

[2009.09.17 23:08:26 | 000,017,920 | ---- | C] ()(C:\Users\Sweta\Documents\?????- ??????????? ????????.wps) -- C:\Users\Sweta\Documents\Осень- потихонечку холодает.wps

[2009.09.15 23:21:27 | 000,016,896 | ---- | M] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps

[2009.09.15 23:21:27 | 000,016,896 | ---- | C] ()(C:\Users\Sweta\Documents\??????????? ?????.wps) -- C:\Users\Sweta\Documents\Вялотекущая осень.wps

[2009.09.15 22:34:29 | 000,021,504 | ---- | M] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps

[2009.09.15 22:34:29 | 000,021,504 | ---- | C] ()(C:\Users\Sweta\Documents\?? ?? ????. ?? ?? ???.wps) -- C:\Users\Sweta\Documents\то ли дыбр. то ли хбз.wps
 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 18.04.2012 17:12:01 - Run 2

OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Sweta\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19222)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,85 Gb Available Physical Memory | 61,74% Memory free

6,19 Gb Paging File | 4,84 Gb Available in Paging File | 78,10% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 583,19 Gb Total Space | 455,03 Gb Free Space | 78,02% Space Free | Partition Type: NTFS

Drive D: | 12,98 Gb Total Space | 1,78 Gb Free Space | 13,69% Space Free | Partition Type: NTFS

 

Computer Name: SWETA-PC | User Name: Sweta | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"EnableFirewall" = 1

"DisableNotifications" = 0

 
 ========== Authorized Applications List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{006918C7-D3C7-4B04-A7AE-F2D60E3EC353}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{01B7E0A7-E2D0-4F74-B9A4-A71532D1648E}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartmusic.exe | 

"{09E422C6-1B3F-4AF8-B213-E017C264BED4}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hpdvdsmart.exe | 

"{0D5B6ED7-21CC-4099-9B60-C44FD46134A3}" = dir=in | app=c:\program files\itunes\itunes.exe | 

"{2282604A-1D8F-46D2-BA13-2D8DDF7D1DF3}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartphoto.exe | 

"{34C1F6C8-6BF9-4BEF-BC81-A0173C8A4D45}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartvideo.exe | 

"{478E8957-7AC7-42B5-9E52-A850098CE52F}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\kernel\clml\clmlsvc.exe | 

"{592A24BC-DB58-467C-B118-3E14C002DFC8}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 

"{5A111B57-39FB-4399-86CC-114814E63FCC}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\kernel\clml\clmlsvc.exe | 

"{7851E608-52F6-4D9D-820C-90AF9025903C}" = protocol=6 | dir=in | app=c:\program files\sibelius software\sibelius 6 demo\regtool.exe | 

"{7E1AF676-D422-49C4-A3E4-48788A984553}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\hptouchsmartvideo.exe | 

"{8CE71E66-E8A0-4456-B32B-791A81CF2CCE}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\tsmagent.exe | 

"{99BA3094-0D52-47D0-91CD-30AC214711D3}" = dir=in | app=c:\program files\hewlett-packard\touchsmart\media\tsmagent.exe | 

"{9B740708-F81C-48EE-9B80-CC0989BD2D78}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartphoto.exe | 

"{B2D93451-669B-4480-8E06-59F44E441E46}" = protocol=17 | dir=in | app=c:\program files\sibelius software\sibelius 6 demo\regtool.exe | 

"{CEB0AF09-706A-4C0C-B4F2-C9B6B3A0DD38}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 

"{CFA7FF49-F04F-4A31-BD24-B43F840986B3}" = dir=in | app=c:\program files\hewlett-packard\media\dvd\hptouchsmartmusic.exe | 

"{E55987CB-12FB-432D-9320-B6641C70CFDA}" = protocol=17 | dir=in | app=c:\program files\sibelius software\sibelius 6 demo\sibelius.exe | 

"{EC4BDBC7-1C1A-40A4-BAFB-5C4F0A9BE731}" = protocol=6 | dir=in | app=c:\program files\sibelius software\sibelius 6 demo\sibelius.exe | 

"{F71C39A6-6A7B-41CD-90EF-A460CE0E7FD2}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"TCP Query User{A2B97FE5-D6CD-422A-9448-8AD14BAD643B}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"TCP Query User{E55C87EC-0D74-496D-A549-D85B04DE5AE1}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"UDP Query User{0539FBC0-A54B-4930-B2AD-265422A56A67}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"UDP Query User{7AA7EC93-6EA1-4FCE-ACB0-5E1AE3E73152}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{009D4EA4-ED95-31DD-A888-C823E6F0BCAF}" = Catalyst Control Center Localization Chinese Standard

"{02340933-B55E-4110-0E17-77A626499E08}" = Catalyst Control Center Localization Turkish

"{03BF5CB1-B72E-4CA6-A278-F65680F05420}" = HP Picasso Media Center Add-In

"{0BA8ED75-18AB-7671-2585-B8C105EF27CE}" = CCC Help Italian

"{0C1F9A87-3CFF-CB4B-5093-EF25B2A1F9D0}" = Catalyst Control Center InstallProxy

"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan

"{154A4184-1A3D-4BF9-A5AE-4FA1660445F3}" = HP Total Care Advisor

"{1578FDD8-9655-EE62-7DD7-A339FDBBD0E3}" = Catalyst Control Center Localization Polish

"{16F8FF61-82D0-8104-57F9-E0F7F4DF3B92}" = CCC Help Finnish

"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan

"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg

"{18BD6BE8-4272-F1C2-49FB-5E35DD28D238}" = CCC Help French

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe

"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library

"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 29

"{2782BB84-164F-D0B7-D5A5-CD1CB0D64CF7}" = CCC Help Polish

"{280F84AA-B578-1F89-8D49-11AA77DEE33A}" = ccc-utility

"{2EAA933A-40E4-61C6-58C3-58E5602B3925}" = ATI Catalyst Install Manager

"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support

"{38058455-8C21-4C2F-B2F6-14ED166039CB}" = HP Total Care Setup

"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works

"{3C3D696B-0DB7-3C6D-A356-3DB8CE541918}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{3EBA09B3-885E-A9DC-A27A-8E6A8A62D49B}" = Catalyst Control Center Graphics Light

"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A1CEAFB-5951-0F7D-E87C-612AE8D908F3}" = CCC Help Czech

"{55AB37EA-129F-F625-FA6C-EAC777B29ED2}" = CCC Help Turkish

"{5CEB5196-1F20-A35C-EAC5-628BD2EFBE9F}" = Catalyst Control Center Graphics Previews Common

"{5DBD68C8-D9E7-9A60-71F6-4791C1AFBFEA}" = CCC Help Swedish

"{5E6D6161-5509-4f55-9372-1E01792F843A}" = F300_Help

"{631F3916-2D32-C600-102B-AF87B550AB7F}" = CCC Help German

"{64B9E2F5-558E-4C56-B419-A1679518F6E7}" = HP Customer Experience Enhancements

"{668451CD-112B-048B-8F52-E95A80344101}" = Catalyst Control Center Localization Japanese

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library

"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder

"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant

"{6B976ADF-8AE8-434E-B282-A06C7F624D2F}" = Python 2.5.2

"{6B9F9888-AF1A-C7E0-B38D-A1C9DE8141D9}" = Catalyst Control Center Localization Chinese Traditional

"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{736E34D3-3FA0-666A-C71F-CC0D13FBBF2C}" = CCC Help Thai

"{739EA056-0ED3-8DE4-0527-E3E6A466B1FD}" = Catalyst Control Center Localization French

"{73D772CC-F0EB-A1A0-6BE7-8248B746E490}" = Catalyst Control Center Localization Spanish

"{74D1BECD-ECFA-CD78-8952-5D6E9AD498AF}" = Catalyst Control Center Localization Dutch

"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update

"{78E72949-7752-37A6-D6AD-C6F5521C4037}" = CCC Help Dutch

"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour

"{79984D5D-7553-D7F5-5BED-D77BC9B9F176}" = Skins

"{7A218E11-66F7-6FEA-AC49-24803A6DD764}" = CCC Help Russian

"{7A7735A2-D4D2-F2AE-868D-A905F42BB6B6}" = Catalyst Control Center Localization Italian

"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax

"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security

"{7C56A6FF-CBBB-B899-2C2A-CFC42290AC8F}" = CCC Help English

"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support

"{86428C83-7961-C8B8-A777-1CC89B474999}" = CCC Help Hungarian

"{87DA00E6-7897-1440-19E6-3943BFECDF30}" = CCC Help Spanish

"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder

"{8A5B242D-6C06-6884-DDE3-AC10A5B9CEC3}" = CCC Help Korean

"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System

"{905D50D2-5757-01DC-424B-795299D57DC8}" = Catalyst Control Center Localization Finnish

"{94B1F146-46E4-B419-B6EF-1A9C64AD13D0}" = Catalyst Control Center Localization Thai

"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)

"{9559E87A-F3A2-2DAF-2E2E-6ADFF9301F63}" = Catalyst Control Center Localization Hungarian

"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch

"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status

"{97ABD26A-3249-46CB-B2E2-F66E64B2E480}" = HP Demo

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations

"{A0640EC2-B97E-4FC1-AD14-227C9E386BB4}" = HP Recovery Manager RSS

"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter

"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A67C4EF9-725D-4C83-A67A-BB7B7DE96CF4}" = Sibelius 6 Demo

"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder

"{ABED70D1-6AC0-6399-7FE8-4D0FDFBE20A9}" = Catalyst Control Center Graphics Full Existing

"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.5 - Deutsch

"{B11EF145-D607-4961-0F87-6A7E29A42CE0}" = CCC Help Chinese Standard

"{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"{B3D6AAD4-3723-C7D5-CC97-BDB289E95ED2}" = Catalyst Control Center Localization Swedish

"{B698B6B1-A369-C5EE-6BFA-CFDAE99FC551}" = Catalyst Control Center Localization Czech

"{BA4CBA30-A216-232A-D2F8-0AD591DCB239}" = CCC Help Greek

"{BC988D12-1885-B778-379C-39A18FEB31E2}" = Catalyst Control Center Localization Greek

"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm

"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software

"{C3709761-C5AD-1C6E-2F57-A26E88CBEB0C}" = Catalyst Control Center Localization Danish

"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"{C700A0F8-73D6-7AB1-AC4F-E7A723C0BDF6}" = ccc-core-static

"{C716522C-3731-4667-8579-40B098294500}" = Toolbox

"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B

"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"{CB896E7B-2513-18C9-69AF-93DEDBCE8991}" = CCC Help Japanese

"{CB8E86DA-E635-158D-8CBD-6706E9ABCB39}" = Catalyst Control Center Graphics Full New

"{CB9D20F6-A972-0F19-2C18-4071AAF29142}" = Catalyst Control Center Localization German

"{CC4BBCBA-89F6-47C3-9B0F-5CE5BB1C316C}" = WEB.DE Toolbar MSVC100 CRT x86

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE7E3BE0-2DD3-4416-A690-F9E4A99A8CFF}" = HP Active Support Library

"{D39D236C-4825-B30E-EE17-D78EBC486805}" = Catalyst Control Center Localization Korean

"{D61B56C9-17F3-9D28-1188-DB3946B7CAA0}" = CCC Help Danish

"{DAF00945-3EC9-6BBD-4007-1E59E1913F71}" = Catalyst Control Center Core Implementation

"{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"{DD0C23A8-4B7E-7777-65BD-49DC127BD18B}" = Catalyst Control Center Localization Portuguese

"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport

"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software

"{E37B4788-8D5D-7EF3-69B5-5F7DF0D70F54}" = Catalyst Control Center Graphics Previews Vista

"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext

"{E79945AB-C672-48F3-8BC3-E57FE021DFF9}" = Catalyst Control Center - Branding

"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential

"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply

"{EBF0EF07-AF6D-AFFF-CD6A-6C78CB4D417B}" = CCC Help Norwegian

"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE Creature Creator Trial Edition

"{ED6D44EE-8044-4C45-BD7F-26F37E97206A}" = CCC Help Chinese Traditional

"{EFC5939F-470F-454E-B3DA-F51FDD83F6CE}" = HP MediaSmart SmartMenu

"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F1568757-E564-4cb5-8980-9333119A4384}" = F300

"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer

"{F24BF91A-A7DB-D47D-FE58-B6A9B36418A0}" = Catalyst Control Center Localization Russian

"{F3096AD9-85BE-2230-59FF-E9A6941396D4}" = CCC Help Portuguese

"{F4E499B6-B446-CC90-E37A-3E96DD894156}" = Catalyst Control Center Localization Norwegian

"{F6AC5364-2FB7-437a-811A-D645F22AA6AC}" = F300Trb

"{F6D6B258-E3CA-4AAC-965A-68D3E3140A8C}" = iTunes

"{FDB5E0F3-86EA-4379-8A2F-1BC2436543E9}" = iCloud

"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update

"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = WEB.DE Softwareaktualisierung

"1&1 Mail & Media GmbH Toolbar IE8" = WEB.DE Toolbar für Internet Explorer

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Avira AntiVir Desktop" = Avira Free Antivirus

"CCleaner" = CCleaner

"Gutscheinmieze - Toolbar" = Gutscheinmieze - Toolbar

"HP Imaging Device Functions" = HP Imaging Device Functions 8.0

"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0

"HPExtendedCapabilities" = HP Customer Participation Program 8.0

"HPOCR" = HP OCR Software 8.0

"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe

"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go

"InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}" = HP MediaSmart Music/Photo/Video

"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint

"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector

"InstallShield_{DCCAD079-F92C-44DA-B258-624FC6517A5A}" = HP MediaSmart DVD

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"NVIDIA Drivers" = NVIDIA Drivers

"PC-Doctor for Windows" = Hardware Diagnose Tools

"QcDrv" = Logitech® Camera-Treiber

"softonic-de3 Toolbar" = softonic-de3 Toolbar

"WildTangent hp Master Uninstall" = My HP Games

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 22.04.2011 15:35:29 | Computer Name = Sweta-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung iexplore.exe, Version 8.0.6001.19048, Zeitstempel

 0x4d633f27, fehlerhaftes Modul SHELL32.dll, Version 6.0.6002.18393, Zeitstempel

 0x4d39b5c7, Ausnahmecode 0xc0000005, Fehleroffset 0x00056051,  Prozess-ID 0x9f8, 

Anwendungsstartzeit 01cc01211ee9a940.

 

Error - 22.04.2011 16:34:40 | Computer Name = Sweta-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 22.04.2011 16:34:41 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 22.04.2011 16:34:42 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 22.04.2011 16:34:42 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 22.04.2011 17:10:27 | Computer Name = Sweta-PC | Source = EventSystem | ID = 4621

Description = 

 

Error - 22.04.2011 17:11:40 | Computer Name = Sweta-PC | Source = WinMgmt | ID = 10

Description = 

 

Error - 22.04.2011 17:11:40 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 22.04.2011 17:11:43 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 22.04.2011 17:11:43 | Computer Name = Sweta-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

[ System Events ]

Error - 17.04.2012 14:39:25 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 18.04.2012 03:49:47 | Computer Name = Sweta-PC | Source = EventLog | ID = 6008

Description = Das System wurde zuvor am 17.04.2012 um 20:59:54 unerwartet heruntergefahren.

 

Error - 18.04.2012 03:50:08 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 18.04.2012 03:50:08 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 18.04.2012 05:27:11 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 18.04.2012 05:27:11 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 18.04.2012 09:10:13 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 18.04.2012 09:10:13 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7026

Description = 

 

Error - 18.04.2012 11:07:08 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 18.04.2012 11:07:08 | Computer Name = Sweta-PC | Source = Service Control Manager | ID = 7026

Description = 

 

 

< End of report >

--- --- ---

Schritt 1: Fix mit OTL

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg Textbox.

Code:

:OTL

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.

Schliesse bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt 2: ESET

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Danke, ich habe erneuert Reader und Java.
Der Computer macht noch insofern Probleme, das der Desktop immer noch schwarz ist und meine frühere Symbole der Programme immer noch nicht sichtbar sind, außer Internet Explorer, und der Scans die ich in den letzten Tagen benutzt habe.
Außerdem schaltet sich sehr oft und sehr laut doe Lüftung des Computers an...

Im ESET Scanner waren "no threads found" deswegen kann ich nichts posten.
Und das ist aus dem OTL
(P.S. wie schalte ich vorhandene externe Festplatten an?)

========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.

OTL by OldTimer - Version 3.2.39.2 log created on 04192012_211503

und seit heute morgen springt ein fenster beim durchblättern der seiten immer automatisch auf:
- Benutzerkontensteuerung
Zur Fortsetzung des Vorgangs ist Ihre Zustimmung erforderlich
Installationsprogramm für Internet Explorer Add Ons-

und bring auch nichts wenn ich auf Abbrechen gehe, weil kommt nach einer zeitlang wieder...

Externe Festplatten werden je nach Größe und Ausführung über den USB-Bus oder über eine extra Stromversorgung mit Spannung versorgt.

In der Regel werden sie automatisch aktiviert - ansonsten findest du einen Schalter daran, mit dem du sie einschalten kannst.

Das mit deinem Lüfter kann ich dir nicht beantworten - da werden wir dich ggf (nach Abschluß der Bereinigung) an unser Hardware-Forum verweisen.

Die Benutzerkontensteuerung dient dazu, vom User potentiell unerwünschte Handlungen durch diesen explizit freizugeben. Wenn dies beim surfen auftritt, versucht der IE, ein AddOn zu installieren, welches für die korrekte Anzeige der jeweiligen Website nötig ist.

Deine verschwundenen Icons werden wir nicht weiter als jetzt dargestellt wiederherstellen können, tut mir leid! :(

Hmm:( ich verstehe..
Und mit dem schwarzen Desktop kann man auch nichts mehr machen?

Hast du einmal versucht, den Hintergund manuell zu ändern?

Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist

Fehlende Rückmeldung
Dieses Thema wurde aus den Abos gelöscht. Somit bekomm ich keine Benachrichtigung über neue Antworten.
PM an mich falls Du denoch weiter machen willst.

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner schon sauber ist.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

Wo liegen momentan die Probleme?

Desktop schwarz ist klar - sind denn die icons am Desktop noch zu sehen?

Was gibts sonst noch an Problemen?

Desktop konnte ich manuell wieder einstellen mit einem beliebigen Bild, einfach nur nicht dieses Schwarz zu sehen. Die Icons habe ich durch die Verbindung wieder drauf kopiert.
Sobald ich es beurteilen kann, liegen im Moment keine Probleme.
Aber du meintest ja, auch wenn man es nicht merkt, heißt es nicht das es clean ist..

Schritt 1: Java update

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 6 Update 30 ) herunter laden.
Wenn die installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
Klicke erneut OK.

Schritt 2: Adobe Reader update

Dein Adobe Reader ist veraltet. Da einige Schädlinge die Schwachstellen in veralteten Versionen nutzen, werden wir sie aktualisieren.

Lade dir den aktuellen Adobe Reader von hier herunter. Wichtig: Entferne den Haken für optionale Software (z.B. Google Chrome), der auf der Seite angezeigt wird, bevor du auf "Jetzt herunterladen" klickst.
Starte die Installation und folge den Anweisungen auf dem Bildschirm.
Drücke die Windows- und die R-Taste, gib im folgenden Fenster appwiz.cpl ein und klicke auf OK.
Suche und entferne alle älteren Reader-Versionen.

Hallo,
Adobe und Java hatte ich vor ein paar tagen bereits mit dir aktualisiert

Ah, okay!

Dann sind wir durch, logfiles sind sauber! :daumenhoc

Lass uns noch ein wenig aufräumen:

Defogger re-enable

Starte bitte den Defogger und klicke den re-enable Button

ComboFix

Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.

Code:

Combofix /Uninstall

http://larusso.trojaner-board.de/Images/CFuninstall.jpg

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.

OTL

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Aktualität

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Antviren-Software

Gehe sicher immer eine Antiviren-Software installiert zu haben und dass diese auch up to date ist. Auch der beste Virenscanner ist sinnlos, wenn er nicht aktuell ist!
Eine Auswahl kostenloser Antivirenprogramme:

AVG Free Anti-Virus
Avast! Free Anti-Virus
Microsoft Security Essentials
Hinweis:MSE wird auch durch Windows Updates angeboten, falls kein Virenscanner am System erkannt wird

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner, um diesen zu AdBlockPlus hinzuzufügen, reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Sei mißtrauisch in sozialen Netzwerken (z.B. MeinVZ, Facebook, etc) - auch, wenn Nachrichten/Einträge scheinbar von einem deiner Freunde stammen, bedeutet das noch lange nicht, dass sie unschädlich sind (Malware kann seinen Rechner verseucht haben).
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann.

Hi,
super, vielen Dank!
Konnte Combofix nicht entfernen, habe nur den Icon ins Papierkorb verschoben.
OTL hat sich bei der Bereinigung selbst bereinigt, ist nicht mehr da)
Eine Frage noch, die kleinen Symbole an der Taskline für IE, Desktop und andere, die kann man auch nicht mehr wiederherstellen?

Combofix Uninstall

Downloade dir bitte CF_UNINST.exe und speichere diese auf deinem Desktop.

Starte die CF_UNINST.exe
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Folge den Anweisungen auf dem Desktop.
Wenn das Tool fertig ist sollte sich ein Fenster mit folgendem Inhalt öffnen: Done

Systemwiederherstellungspunkte löschen (Windows Vista/7)

Melde dich als Administrator an.
Öffne Computer-->Rechtsklick auf Laufwerk C-->Eigenschaften-->Button Bereinigen-->
Reiter Weitere Optionen-->Rubrik Systemwiederherstellung-->Button Bereinigen.
Nachricht "Möchten Sie alle Wiederherstellungspunkte bis auf den letzten löschen?" mit löschen bestätigen.

Was deine Icons angeht: Hast du eventuell deine Schnellstartleiste ausgeblendet? Rechtsklick auf eine freie Stelle der Taskleiste-->Symbolleisten-->Schnellstart

Das mit Combofix "done" hat geklappt.

Schnellstartleiste scheint jetzt da zu sein, allerdings ohne Symbole- leer..??

Datenträgerbereinigung.. soweit alles gemacht, bis zum "Löschen", und danach kann ich das Fenster nicht nicht schließen, es reagiert schon zum 2- Mal überhaupt nicht, heißt es, es wurde gelöscht, oder ist irgendwas falsch?

Und dann wollten wir mich "weiterleiten" wegen der lauten/often Lüftung..

Aah, hat geklappt jetzt, mit dem Löschen!

Wenn keine Symbole mehr drin sind, musst du sie dir selber wieder einfügen, da können wir nicht mehr abhelfen.

Was die Lüftergeräusche angeht:

Erstelle hier ein Thema. Achte darauf, dass du auch hier bereits vorab Infos zu deinem System liefern musst! ;)

Okay, vielen Dank für deine Hilfe!
Lg

Schön, dass wir helfen konnten! :abklatsch:

Dieses Thema scheint erledigt und wurde aus meinen Abos gelöscht.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM.

Jeder andere bitte hier klicken und ein eigenes Thema erstellen!