| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundespolizei Uskash 100 Euro MeldungWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
06.11.2011, 16:39
| #1 |
| |  Bundespolizei Uskash 100 Euro Meldung Hallo, als ich heute beim surfen war kam plötzlich eine Meldung von der "Bundespolizei" , außerdem stand dort noch etwas von bezahlen sie 100 Euro um ... wieder zu aktivieren. Von Paysafe und Ukash stand da auch noch etwas. Außerdem wurde ich angeblich bei einer illegalen Tat erwischt. Ob wohl ich dies nicht getan habe und man konnte das Fenster nicht schließen so musste ich leider den Pc per Kabel rausziehen ausschalten. Nun bin ich sehr besorgt. Ist diese Meldung echt muss ich mir Sorgen machen? Wurde ich wirklich erwischt? Ich hoffe ihr könnt mir helfen. |
|
06.11.2011, 17:41
| #2 | |||
| /// Helfer-Team    |  Bundespolizei Uskash 100 Euro Meldung Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! 1. Wenn du glaubst zu kennen die Zeitpunkt wo dein System noch einwandfrei funktioniert hat, die Systemwiederherstellung ist einen Versuch Wert!: - Gibt es einen "relativ einfachen Weg",wenn eine frische Infektion vorliegt, oder mal bestimmte Probleme bekommt man auch gelöst, was man sogleich ausprobieren sollte. Dies bietet Dir die Möglichkeit, Systemänderungen am Computer ohne Auswirkung auf persönliche Dateien, wie z. B. E-Mails, Dokumente oder Fotos, rückgängig zu machen. Zitat:
(Kannst noch immer bis zum heutigen Zeitpunkt rückgängig machen, falls liefert nicht das gewünschte Ergebnis) ► berichte mir auch, ob die SWH funktioniert hat, bzw ob Du das System auf einen früheren Wiederherstellungspunkt zurückstellen können? 2. Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
3. Systemscan mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop.
4. Ich würde gerne noch all deine installierten Programme sehen: Lade dir das Tool CCleaner herunter → Download installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..." wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein Zitat:
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw grußkira
__________________ |
|
06.11.2011, 17:55
| #3 |
| | Bundespolizei Uskash 100 Euro Meldung Also diese Meldung ist nicht echt oder? Wollte ich nur wissen , damit meine Sorgen ein Ende haben. Also bei Punkt 1 ist das Problem das auf dem Computer kein Wiederherstellungspunkt gefunden wurde. Allerdings habe ich 3 CDs auf denen das gespeichert ist , dass ist doch das gleiche oder?
__________________ |
|
06.11.2011, 19:37
| #4 |
| | Bundespolizei Uskash 100 Euro Meldung Hallo, also Nummer 1 habe ich vorerst ausgelassen , da du noch nicht zurückgeschrieben hast. Also der Bericht von Nummer 2 Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 8097 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 06.11.2011 19:35:12 mbam-log-2011-11-06 (19-35-12).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|) Durchsuchte Objekte: 406747 Laufzeit: 1 Stunde(n), 18 Minute(n), 24 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Dennis\AppData\LocalLow\Sun\Java\deployment\cache\6.0\6\7a8f5006-221e41e1 (Trojan.Agent) -> Quarantined and deleted successfully. c:\Users\Dennis\Desktop\programme\microsoft\microsoft.office.professional.plus.2010.x86.german.vl.edition-tiw\activator\mini-kms_activator_v1.052.exe (Riskware.Keygen) -> Quarantined and deleted successfully. |
|
06.11.2011, 19:51
| #5 |
| | Bundespolizei Uskash 100 Euro Meldung Leide habe ich das öfters gepostet. Geändert von Denjoo (06.11.2011 um 20:04 Uhr) Grund: Doppel Post |
|
06.11.2011, 19:54
| #6 |
| | Bundespolizei Uskash 100 Euro Meldung Leider habe ich das öfters gepostet. Geändert von Denjoo (06.11.2011 um 20:05 Uhr) Grund: Doppel Post |
|
06.11.2011, 19:55
| #7 |
| | Bundespolizei Uskash 100 Euro Meldung Das ist Nummer 3. OTL Logfile: Code:
ATTFilter OTL logfile created on: 06.11.2011 19:39:00 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Dennis\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,99 Gb Total Physical Memory | 3,28 Gb Available Physical Memory | 54,71% Memory free 11,98 Gb Paging File | 9,09 Gb Available in Paging File | 75,83% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 457,95 Gb Total Space | 201,20 Gb Free Space | 43,94% Space Free | Partition Type: NTFS Drive D: | 458,46 Gb Total Space | 415,93 Gb Free Space | 90,72% Space Free | Partition Type: NTFS Drive F: | 931,51 Gb Total Space | 771,10 Gb Free Space | 82,78% Space Free | Partition Type: NTFS Computer Name: DENNIS-PC | User Name: Dennis | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.06 17:58:30 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe PRC - [2011.11.06 09:42:54 | 000,247,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11c_ActiveX.exe PRC - [2011.10.31 21:37:00 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2011.10.11 13:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2011.10.09 16:02:22 | 000,055,144 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\ATH.exe PRC - [2011.10.09 11:54:58 | 000,055,144 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe PRC - [2011.10.06 03:34:56 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe PRC - [2011.09.27 07:22:28 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe PRC - [2011.09.23 17:37:42 | 000,641,832 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe PRC - [2011.08.31 17:00:48 | 001,047,208 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe PRC - [2009.06.04 21:48:00 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2008.08.04 05:45:16 | 005,779,456 | ---- | M] () -- C:\Program Files (x86)\open3A\mysql\bin\mysqld-nt.exe ========== Modules (No Company Name) ========== MOD - [2011.09.27 07:23:00 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.09.27 07:22:40 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2011.03.16 23:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ========== Win32 Services (SafeList) ========== SRV:64bit: - [2011.09.01 13:19:32 | 000,036,160 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp) SRV - [2011.10.31 21:37:00 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2011.10.19 13:59:45 | 003,552,856 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai\netsession_win_807ba95.dll -- (Akamai) SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.09.23 17:37:42 | 000,641,832 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2011.09.01 13:25:34 | 002,027,840 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe -- (TuneUp.UtilitiesSvc) SRV - [2011.09.01 13:19:26 | 000,029,504 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp) SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.08.30 17:18:30 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.08.03 12:50:00 | 002,255,464 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2011.04.24 21:55:00 | 004,066,168 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWow64\GameMon.des -- (npggsvc) SRV - [2011.03.31 15:08:14 | 000,080,896 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe -- (PassThru Service) SRV - [2010.06.25 18:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009.08.27 16:09:10 | 001,253,376 | ---- | M] (MAGIX AG) [Unknown | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2009.07.04 02:47:12 | 000,240,160 | ---- | M] (Acer) [Auto | Running] -- C:\Programme\Packard Bell\Packard Bell Updater\UpdaterService.exe -- (Updater Service) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.06.04 21:48:00 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.06.04 14:04:50 | 001,150,496 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files (x86)\Packard Bell\Registration\GregHSRW.exe -- (Greg_Service) SRV - [2008.08.07 18:10:02 | 003,276,800 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2008.08.04 05:45:16 | 005,779,456 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\open3A\mysql\bin\mysqld-nt.exe -- (mysql) SRV - [2008.06.14 09:02:12 | 000,017,408 | ---- | M] (Apache Software Foundation) [Disabled | Stopped] -- C:\Program Files (x86)\open3A\apache\bin\apache.exe -- (Apache2.2) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.10.11 15:05:32 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2011.10.11 14:00:01 | 000,130,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011.10.11 14:00:01 | 000,097,312 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2011.05.10 10:41:27 | 000,174,184 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.11.09 14:35:24 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135) DRV:64bit: - [2010.06.25 18:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF) DRV:64bit: - [2010.06.25 15:08:10 | 000,036,928 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\htcnprot.sys -- (htcnprot) DRV:64bit: - [2009.07.14 17:46:48 | 001,708,800 | ---- | M] (Hauppauge Computer Works) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HCW85BDA.sys -- (HCW85BDA) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.22 04:05:58 | 000,273,072 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GearAspiWDM) DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2007.08.08 17:54:12 | 000,035,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ATITool64.sys -- (ATITool) DRV - [2011.10.10 15:07:27 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\gdrv.sys -- (gdrv) DRV - [2011.04.26 14:30:20 | 000,011,856 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys -- (TuneUpUtilitiesDrv) DRV - [2010.07.09 14:08:14 | 000,327,368 | ---- | M] (BitDefender) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\bdfsfltr.sys -- (bdfsfltr) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2005.01.01 10:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=ixtreme_m5740&r=173605112206p0385v165y48j3024q IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=ixtreme_m5740&r=173605112206p0385v165y48j3024q IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=ixtreme_m5740&r=173605112206p0385v165y48j3024q IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKLM\..\URLSearchHook: {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - C:\Program Files (x86)\GIGA_Deutsch\prxtbGIGA.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Facemoods Search" FF - prefs.js..browser.startup.homepage: "hxxp://start.facemoods.com/?a=ddrnw" FF - prefs.js..network.proxy.no_proxies_on: "*.local" FF - prefs.js..network.proxy.type: 0 FF - prefs.js..browser.search.defaultenginename: "Google" FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Dennis\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.10.28 11:55:53 | 000,000,000 | ---D | M] [2011.09.24 21:35:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennis\AppData\Roaming\mozilla\Extensions [2011.10.29 08:35:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\m1kupqjj.default\extensions [2011.10.29 08:35:33 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Dennis\AppData\Roaming\mozilla\Firefox\Profiles\m1kupqjj.default\extensions\battlefieldheroespatcher@ea.com [2011.08.23 20:16:36 | 000,002,333 | ---- | M] () -- C:\Users\Dennis\AppData\Roaming\Mozilla\Firefox\Profiles\m1kupqjj.default\searchplugins\askcom.xml [2011.10.28 11:55:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions File not found (No name found) -- C:\USERS\DENNIS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\M1KUPQJJ.DEFAULT\EXTENSIONS\FFXTLBR@FACEMOODS.COM [2011.09.29 08:09:51 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.09.29 02:24:37 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.09.29 02:16:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.09.29 02:24:37 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.10.08 20:32:29 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2011.09.29 02:24:37 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.09.29 02:24:37 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.09.29 02:24:37 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Dennis\AppData\Local\Google\Chrome\Application\15.0.874.106\gcswf32.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.250.6 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U25 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Dennis\AppData\Local\Google\Chrome\Application\15.0.874.106\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Dennis\AppData\Local\Google\Chrome\Application\15.0.874.106\pdf.dll CHR - plugin: Nero Kwik Media Helper (Enabled) = C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Unity Player (Enabled) = C:\Users\Dennis\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Battlefield Heroes = C:\Users\Dennis\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdfjahpadlpfnfheehpddpcllihfkmm\5.0.127.0_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (GIGA Deutsch Toolbar) - {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - C:\Program Files (x86)\GIGA_Deutsch\prxtbGIGA.dll (Conduit Ltd.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation) O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (GIGA Deutsch Toolbar) - {1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} - C:\Program Files (x86)\GIGA_Deutsch\prxtbGIGA.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (GIGA Deutsch Toolbar) - {1CE76C93-A797-4CA2-AB3C-F4A6CFBA3440} - C:\Program Files (x86)\GIGA_Deutsch\prxtbGIGA.dll (Conduit Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) O4 - Startup: C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk = C:\Program Files (x86)\Wecker6\Wecker.exe (Christoph Bünger Software) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Wecker-Alarm - {7B499570-29C5-4a80-9F57-94A420D140CE} - C:\Program Files (x86)\Wecker6\WfWIEButton.dll (Christoph Bünger Software) O9 - Extra 'Tools' menuitem : Nach Wecker für Windows exportieren - {7B499570-29C5-4a80-9F57-94A420D140CE} - C:\Program Files (x86)\Wecker6\WfWIEButton.dll (Christoph Bünger Software) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 10.0.0) O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27) O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Java Plug-in 1.7.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.127.0.cab (Battlefield Heroes Updater) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C5211B36-F8DC-4B10-9145-BB636D7D852B}: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O27:64bit: - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\GREG.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\hardcopy.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\htcupctloader.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\lxupdatemanager.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\nvstlink.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\nvstview.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\teamviewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\wecker.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\xampp-control.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\excel.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\GREG.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\hardcopy.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\htcupctloader.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\lxupdatemanager.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\mstore.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\nvstlink.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\nvstview.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\onenote.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\powerpnt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\teamviewer.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\unins000.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\wecker.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\winword.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\xampp-control.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2011\TUAutoReactivator64.exe (TuneUp Software) O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk /r \??\F:) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.11.06 18:09:04 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.11.06 18:03:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Google [2011.11.06 17:58:14 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe [2011.11.06 17:29:27 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Malwarebytes [2011.11.06 17:29:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.11.06 17:29:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.06 17:29:17 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2011.11.06 17:29:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2011.11.06 15:21:34 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\redsn0w [2011.11.05 20:33:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.11.05 20:33:47 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2011.11.05 20:33:34 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2011.11.05 20:33:34 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2011.11.05 20:32:01 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2011.11.05 20:32:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour [2011.11.05 18:31:57 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Origin [2011.11.05 18:31:40 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Origin [2011.11.05 18:31:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin [2011.11.05 18:31:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin Games [2011.11.05 18:31:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Origin [2011.11.05 18:31:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Origin [2011.11.05 18:26:17 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core [2011.11.05 18:25:39 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\FIFA 12 [2011.11.05 18:08:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Fifa 12 [2011.11.03 23:32:54 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Desktop\Lexware Sicherungen [2011.11.03 23:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lexware [2011.11.03 23:28:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Lexware [2011.11.03 23:28:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2011.11.03 23:27:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2011.11.03 23:10:11 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Desktop\Lexware_Faktura_und_Auftrag_Plus_2011_v15.10_GERMAN-CYGiSO [2011.11.02 11:38:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2 [2011.11.02 09:03:13 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Lexware [2011.11.01 23:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Lexware [2011.11.01 23:58:04 | 000,000,000 | ---D | C] -- C:\ProgramData\BTrieve [2011.11.01 23:57:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\examotion [2011.11.01 23:57:34 | 001,929,216 | ---- | C] (Amyuni Technologies hxxp://www.amyuni.com) -- C:\Windows\SysWow64\cdintf250.dll [2011.11.01 23:56:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Lexware [2011.11.01 23:56:28 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Lexware [2011.10.31 21:44:37 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\Battlefield Heroes [2011.10.31 21:36:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA Games [2011.10.31 11:12:15 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP [2011.10.29 20:36:00 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome [2011.10.29 10:30:51 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\PunkBuster [2011.10.29 08:35:23 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.10.25 09:36:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA Games [2011.10.25 09:16:26 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Unity [2011.10.24 08:44:46 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Avira [2011.10.24 08:44:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.10.24 08:44:24 | 000,130,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.10.24 08:44:24 | 000,097,312 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.10.24 08:44:24 | 000,027,760 | ---- | C] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.10.24 08:44:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.10.24 08:44:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2011.10.16 20:22:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2011.10.16 19:31:50 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\NVIDIA [2011.10.16 14:46:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2011.10.16 14:45:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2011.10.16 14:45:32 | 000,836,200 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\easyupdatusapiu64.dll [2011.10.16 14:45:27 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2011.10.16 14:45:08 | 001,426,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco642040.dll [2011.10.16 14:45:08 | 000,174,184 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\drivers\nvhda64v.sys [2011.10.16 14:45:08 | 000,029,288 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdap64.dll [2011.10.16 14:45:07 | 024,692,840 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll [2011.10.16 14:45:07 | 022,470,248 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll [2011.10.16 14:45:07 | 017,193,576 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll [2011.10.16 14:45:07 | 016,595,560 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll [2011.10.16 14:45:07 | 015,064,168 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll [2011.10.16 14:45:07 | 012,636,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll [2011.10.16 14:45:07 | 007,254,632 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll [2011.10.16 14:45:07 | 006,613,096 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll [2011.10.16 14:45:07 | 005,404,776 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll [2011.10.16 14:45:07 | 002,532,456 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll [2011.10.16 14:45:07 | 002,412,136 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll [2011.10.16 14:45:07 | 002,391,656 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll [2011.10.16 14:45:07 | 002,222,184 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvenc.dll [2011.10.16 14:45:07 | 002,090,088 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvenc.dll [2011.10.16 14:45:07 | 001,519,720 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco64.dll [2011.10.16 14:45:07 | 001,453,160 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvgenco64.dll [2011.10.16 14:45:07 | 000,067,176 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2011.10.16 14:45:07 | 000,057,960 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2011.10.16 14:44:58 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2011.10.16 14:44:34 | 000,000,000 | ---D | C] -- C:\NVIDIA [2011.10.16 12:04:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ATITool [2011.10.16 11:57:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SystemRequirementsLab [2011.10.16 09:51:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Steganos [2011.10.16 09:51:46 | 000,327,368 | ---- | C] (BitDefender) -- C:\Windows\SysWow64\drivers\bdfsfltr.sys [2011.10.15 23:51:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2011.10.15 23:51:14 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Documents\Electronic Arts [2011.10.15 23:50:36 | 000,447,752 | ---- | C] (On2.com) -- C:\Windows\SysWow64\vp6vfw.dll [2011.10.15 23:50:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WSE [2011.10.15 11:54:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts [2011.10.15 11:35:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSECache [2011.10.14 16:56:37 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DAEMON Tools Images [2011.10.14 16:37:51 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\Command & Conquer 3 Kanes Rache [2011.10.14 15:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts [2011.10.13 21:33:36 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2011.10.13 21:33:36 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2011.10.13 21:33:35 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2011.10.13 21:33:35 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2011.10.13 21:33:34 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2011.10.13 21:33:34 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2011.10.13 21:33:34 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2011.10.13 21:33:34 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2011.10.13 21:33:33 | 000,818,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2011.10.13 15:48:01 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll [2011.10.13 15:48:01 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2011.10.13 15:48:01 | 000,108,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisrndr.ax [2011.10.13 15:48:01 | 000,075,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisrndr.ax [2011.10.13 15:47:32 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleacc.dll [2011.10.13 15:47:31 | 000,861,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll [2011.10.13 15:39:45 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\CompleteFCE [2011.10.13 15:39:44 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache [2011.10.13 15:36:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cambridge [2011.10.11 15:05:32 | 000,270,912 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2011.10.11 15:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite [2011.10.11 15:05:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite [2011.10.11 15:02:35 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\DAEMON Tools Lite [2011.10.11 15:02:33 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite [2011.10.10 21:41:54 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\VCdRom.sys [2011.10.10 20:25:27 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\Conduit [2011.10.10 20:25:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit [2011.10.10 20:25:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GIGA_Deutsch [2011.10.10 19:01:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\open3A [2011.10.10 19:01:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\open3A [2011.10.10 15:44:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium [2011.10.10 15:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate [2011.10.10 15:06:11 | 000,025,640 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys [2011.10.10 15:05:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Core Temp [2011.10.10 14:56:03 | 000,021,992 | ---- | C] (CPUID) -- C:\Windows\SysNative\drivers\cpuz135_x64.sys [2011.10.10 14:56:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CPUID [2011.10.10 14:56:03 | 000,000,000 | ---D | C] -- C:\Program Files\CPUID [2011.10.09 14:20:29 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\MusicBrainz [2011.10.09 14:20:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MusicBrainz Picard [2011.10.09 11:27:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GeoGebra [2011.10.09 11:27:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GeoGebra [2011.10.09 10:49:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Big Fish Games [2011.10.08 21:07:57 | 000,126,312 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\GEARAspi64.dll [2011.10.08 21:07:57 | 000,107,368 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysWow64\GEARAspi.dll [2011.10.08 21:07:57 | 000,034,152 | ---- | C] (GEAR Software Inc.) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys [2011.10.08 21:06:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2011.10.08 21:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update [2011.10.08 21:06:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2011.10.08 20:37:47 | 000,000,000 | ---D | C] -- C:\Users\Dennis\Neuer Ordner [2011.10.08 20:32:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2011.10.08 20:16:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine [2011.10.08 20:16:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp [2011.10.08 20:04:32 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Local\MediaMonkey [2011.10.07 20:54:52 | 000,000,000 | ---D | C] -- C:\Users\Dennis\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2011.10.07 20:54:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Download Assistant [2009.09.03 15:13:01 | 000,036,136 | ---- | C] (Oberon Media) -- C:\ProgramData\FullRemove.exe [1 C:\Users\Dennis\*.tmp files -> C:\Users\Dennis\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.06 19:16:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.06 18:15:02 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.06 18:09:04 | 000,041,272 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2011.11.06 18:04:39 | 000,000,834 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.11.06 17:58:30 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dennis\Desktop\OTL.exe [2011.11.06 17:42:10 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.06 17:42:10 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.06 17:39:05 | 001,492,188 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.06 17:39:05 | 000,651,774 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.06 17:39:05 | 000,613,962 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.06 17:39:05 | 000,128,814 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.06 17:39:05 | 000,105,204 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.06 17:34:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.06 17:34:38 | 529,879,039 | -HS- | M] () -- C:\hiberfil.sys [2011.11.06 17:29:20 | 000,001,121 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.06 09:42:54 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2011.11.05 21:19:09 | 000,270,240 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2011.11.05 21:19:09 | 000,270,240 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.11.05 20:33:48 | 000,001,795 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.11.05 18:14:37 | 000,001,087 | ---- | M] () -- C:\Users\Public\Desktop\Fifa 12.lnk [2011.11.05 18:10:04 | 000,000,144 | ---- | M] () -- C:\Windows\Pcfk32.INI [2011.11.04 10:45:17 | 000,270,240 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2011.11.03 23:31:03 | 000,002,803 | ---- | M] () -- C:\Users\Public\Desktop\Lexware faktura+auftrag.lnk [2011.11.03 23:31:03 | 000,000,503 | ---- | M] () -- C:\Windows\ODBCINST.ini [2011.11.02 00:02:51 | 000,618,784 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.10.31 21:37:00 | 000,075,136 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.31 11:31:26 | 000,001,754 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2011.10.29 20:36:01 | 000,002,330 | ---- | M] () -- C:\Users\Dennis\Desktop\Google Chrome.lnk [2011.10.29 18:00:39 | 000,002,026 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2011.10.26 11:24:44 | 000,001,900 | -H-- | M] () -- C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk [2011.10.16 09:52:06 | 000,010,387 | ---- | M] () -- C:\ProgramData\bdinstall.bin [2011.10.15 12:01:42 | 000,000,003 | ---- | M] () -- C:\Windows\treeskp.sys [2011.10.15 12:01:42 | 000,000,003 | ---- | M] () -- C:\Windows\sbacknt.bin [2011.10.14 15:36:13 | 000,000,043 | ---- | M] () -- C:\END [2011.10.11 15:05:32 | 000,270,912 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2011.10.11 15:05:30 | 000,001,962 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2011.10.11 14:00:01 | 000,130,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avipbb.sys [2011.10.11 14:00:01 | 000,097,312 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avgntflt.sys [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) -- C:\Windows\SysNative\drivers\avkmgr.sys [2011.10.10 19:01:56 | 000,005,517 | ---- | M] () -- C:\Windows\my.ini [2011.10.10 15:07:27 | 000,025,640 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys [2011.10.09 21:59:24 | 000,001,978 | ---- | M] () -- C:\Users\Dennis\Desktop\JDownloader.lnk [2011.10.08 21:06:47 | 000,001,857 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [1 C:\Users\Dennis\*.tmp files -> C:\Users\Dennis\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.06 18:04:26 | 000,001,110 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.06 18:04:17 | 000,001,106 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.06 17:29:20 | 000,001,121 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.11.05 20:33:48 | 000,001,795 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2011.11.05 18:14:37 | 000,001,099 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fifa 12.lnk [2011.11.05 18:14:37 | 000,001,087 | ---- | C] () -- C:\Users\Public\Desktop\Fifa 12.lnk [2011.11.03 23:28:49 | 000,002,803 | ---- | C] () -- C:\Users\Public\Desktop\Lexware faktura+auftrag.lnk [2011.11.02 00:07:02 | 000,000,144 | ---- | C] () -- C:\Windows\Pcfk32.INI [2011.11.01 23:58:19 | 000,000,503 | ---- | C] () -- C:\Windows\ODBCINST.ini [2011.10.31 11:12:17 | 000,001,754 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk [2011.10.31 11:12:17 | 000,001,704 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk [2011.10.29 20:36:01 | 000,002,330 | ---- | C] () -- C:\Users\Dennis\Desktop\Google Chrome.lnk [2011.10.29 10:31:10 | 000,270,240 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2011.10.29 10:02:05 | 000,270,240 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.10.29 10:02:05 | 000,270,240 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2011.10.29 10:02:05 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.28 11:55:54 | 000,001,162 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.10.26 11:24:44 | 000,001,900 | -H-- | C] () -- C:\Users\Dennis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wecker für Windows 6.lnk [2011.10.16 14:45:07 | 000,007,383 | ---- | C] () -- C:\Windows\SysNative\nvinfo.pb [2011.10.16 09:51:46 | 000,010,387 | ---- | C] () -- C:\ProgramData\bdinstall.bin [2011.10.15 11:59:13 | 000,000,003 | ---- | C] () -- C:\Windows\treeskp.sys [2011.10.15 11:59:12 | 000,000,003 | ---- | C] () -- C:\Windows\sbacknt.bin [2011.10.15 11:36:19 | 000,002,555 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk [2011.10.14 15:36:13 | 000,000,043 | ---- | C] () -- C:\END [2011.10.13 15:38:22 | 000,002,657 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CompleteFCE.lnk [2011.10.11 15:05:30 | 000,001,962 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2011.10.10 19:02:04 | 000,005,517 | ---- | C] () -- C:\Windows\my.ini [2011.10.09 21:59:24 | 000,001,978 | ---- | C] () -- C:\Users\Dennis\Desktop\JDownloader.lnk [2011.10.09 14:20:23 | 000,001,183 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MusicBrainz Picard.lnk [2011.10.08 21:06:47 | 000,001,857 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2011.10.08 21:06:38 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk [2011.10.08 20:32:24 | 000,001,978 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk [2011.10.08 20:32:24 | 000,001,957 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk [2011.10.08 20:32:24 | 000,001,936 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk [2011.09.18 20:59:30 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2011.09.18 13:29:18 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.09.02 09:31:06 | 000,000,328 | ---- | C] () -- C:\Windows\wininit.ini [2011.08.26 20:00:13 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini [2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.07.31 12:34:17 | 000,024,064 | ---- | C] () -- C:\Windows\SysWow64\Lclic32.dll [2011.06.27 17:43:24 | 000,000,000 | ---- | C] () -- C:\Users\Dennis\AppData\Roaming\chrtmp [2011.06.20 22:04:37 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat [2011.05.30 20:35:47 | 001,574,292 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.10.21 14:19:42 | 000,208,896 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll [2010.10.21 14:18:46 | 000,303,104 | ---- | C] () -- C:\Windows\SysWow64\dnt27VC8.dll [2010.10.21 14:16:58 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\dntvmc27VC8.dll [2010.10.21 14:16:34 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dntvm27VC8.dll [2010.06.25 18:03:12 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll [2009.09.03 15:19:59 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2009.05.18 10:20:17 | 000,007,680 | ---- | C] () -- C:\Windows\aRun.exe [2001.12.12 13:41:36 | 000,041,472 | ---- | C] () -- C:\Windows\SysWow64\W32btstp.dll [2001.12.12 13:41:36 | 000,025,088 | ---- | C] () -- C:\Windows\SysWow64\W32btxlt.dll ========== LOP Check ========== [2011.09.19 21:05:17 | 000,000,000 | -HSD | M] -- C:\Users\Dennis\AppData\Roaming\.# [2011.10.25 12:16:44 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\.minecraft [2011.08.26 20:04:49 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Canneverbe Limited [2011.10.02 17:02:59 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\cbuenger [2011.10.07 20:54:52 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2011.10.14 16:37:51 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Command & Conquer 3 Kanes Rache [2011.10.13 15:54:02 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\CompleteFCE [2011.10.11 15:10:30 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DAEMON Tools Lite [2011.08.27 08:58:10 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\DragonicaSCB [2011.07.18 13:05:37 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\FOG Downloader [2011.09.18 21:58:16 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Genieo [2011.10.05 16:23:56 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\GrabPro [2011.09.24 22:57:31 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\HTC [2011.11.03 23:34:40 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Lexware [2011.09.17 21:31:42 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\MAGIX [2011.10.09 14:20:29 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\MusicBrainz [2011.10.05 16:23:52 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\OpenCandy [2011.10.05 16:46:23 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Orbit [2011.11.05 18:32:34 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Origin [2011.10.05 16:23:59 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\ProgSense [2011.11.06 15:50:28 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\redsn0w [2011.08.08 18:03:13 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Software Informer [2011.08.31 18:24:50 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\TeamViewer [2011.09.02 09:32:36 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Three Rings Design [2011.06.07 13:48:27 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\TuneUp Software [2011.09.17 22:29:52 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\Ubisoft [2011.08.23 21:24:12 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\wargaming.net [2011.06.22 14:14:52 | 000,000,000 | ---D | M] -- C:\Users\Dennis\AppData\Roaming\WinSweep [2011.10.31 10:10:25 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 94 bytes -> C:\ProgramData\TEMP:A18D1A5B @Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:E3C56885 < End of report > Leider konnte ich das mit dem Code nicht senden , dann kam immer ein Fenster mit Verbindungsproblem. |
|
06.11.2011, 19:56
| #8 |
| | Bundespolizei Uskash 100 Euro Meldung Leider habe ich das öfters gepostet. Geändert von Denjoo (06.11.2011 um 20:05 Uhr) Grund: Doppel Post |
|
06.11.2011, 20:00
| #9 |
| | Bundespolizei Uskash 100 Euro Meldung Das ist Nummer 3. Leider klappte das mit dem Code nicht ich hoffe das geht auch als Anhang. |
|
06.11.2011, 20:08
| #10 |
| | Bundespolizei Uskash 100 Euro Meldung Und nun noch Nummer 4. Bei Nummer 1 brauche ich deinen Rat noch. |
|
07.11.2011, 07:58
| #11 | |
| /// Helfer-Team | Bundespolizei Uskash 100 Euro Meldung ohje...ohje: - Das Installieren von Raubkopien ist eine ziemlich sichere Methode, ein Rechner zu infizieren  - Ich beführte dass Du Dein Problem nur lösen kannst, wenn du dein System neu installierst, da geht`s um: Code:
ATTFilter microsoft.office.professional.plus.2010.x86.german.vl.ed ition-tiw\activator\mini-kms_activator_v1.052.exe (Riskware.Keygen)
** Du solltest in so einem Fall mal dein Konsummuster überdenken  Weil dein Verhalten damit dem deutschen Recht unterliegt, wird den Support an dieser Stelle von unsere Seite aus beendet. Also am besten ist es, Du Sicherst deiner Daten (ohne cracks & Keygens!) und machst eine komplette Neuinstallation des Rechners, das ist der schnellste und sauberste lösung! Aber wenigstens hast Du dann nach einer Neuinstallation wieder ein sauberes System und hoffentlich hast Du was draus gelernt und in Zukunft lässt die Finger von... -> Forumregel! Zitat:
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
|
| Themen zu Bundespolizei Uskash 100 Euro Meldung |
| 100 euro, aktiviere, angeblich, bezahlen, bundespolizei, euro, fenster, heute, hoffe, illegale, kabel, konnte, meldung, nicht schließen, paysafe, plötzlich, schließe, schließen, sorge, sorgen, stand, surfe, surfen, ukash, wirklich |
Linear-Darstellung
