| |
| |||||||
Log-Analyse und Auswertung: Winlogon.exe stealer.exe was ist das allesWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
25.11.2011, 11:09
| #1 |
 |  Winlogon.exe stealer.exe was ist das alles Hallo liebe Gemeinde, ich habe vor kurzem zufällig eine Meldung auf meinem Rechner gesehen in der stand das 34892stealer.exe nicht mehr funktioniert, nach ewiger Suche hatte ich sie gefunden,prüfen lassen und gelöscht aber in der Prüfung stand nichts negatives. nun habe ich im Selben Ordner (temp) eine Datei namens 34748winlogon.exe, natürlich wieder Online prüfen lassen aber auch wieder nichts erkannt, Antivir komplett über meinen PC rennen lassen aber findet auch nichts. Hijackthis meldet aber viele sachen. Da ich aber keine Ahnung davon habe würde ich euch bitten mal drüber zu schauen und Tipps zu geben denn allein komme ich nicht weiter und neu Aufsetzen will ich auch nicht denn alle Bilder Videos und Musik von meiner Familie sind dann wohl auch infiziert wenn da was ist, so vermute ich zumindest. OTL Logfile: Code:
ATTFilter OTL logfile created on: 25.11.2011 11:30:34 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\*****\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 5,93 Gb Total Physical Memory | 4,13 Gb Available Physical Memory | 69,70% Memory free 11,86 Gb Paging File | 9,98 Gb Available in Paging File | 84,15% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 918,27 Gb Total Space | 404,38 Gb Free Space | 44,04% Space Free | Partition Type: NTFS Drive D: | 13,14 Gb Total Space | 1,81 Gb Free Space | 13,77% Space Free | Partition Type: NTFS Drive E: | 465,67 Gb Total Space | 206,79 Gb Free Space | 44,41% Space Free | Partition Type: NTFS Drive F: | 100,97 Mb Total Space | 72,77 Mb Free Space | 72,07% Space Free | Partition Type: NTFS Drive G: | 7,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive Y: | 465,83 Gb Total Space | 354,08 Gb Free Space | 76,01% Space Free | Partition Type: NTFS Computer Name: *****-PC | User Name: ***** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\*****\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation) PRC - C:\Program Files (x86)\Digital Trends Club\Payback-Reporting.exe () PRC - C:\Program Files (x86)\Digital Trends Club\Payback-Updater.exe () PRC - C:\Program Files (x86)\Bandoo\Bandoo.exe (Bandoo Media Inc.) PRC - C:\Program Files (x86)\Common Files\Mediafour\iPod\M4iPodWPDService.exe (Mediafour Corporation) PRC - C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe () PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) PRC - C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE (Mediafour Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () MOD - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF () ========== Win32 Services (SafeList) ========== SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (MSCamSvc) -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe (Microsoft Corporation) SRV - (ServiceLayer) -- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (Payback-Reporting-Service) -- C:\Program Files (x86)\Digital Trends Club\Payback-Reporting.exe () SRV - (Payback-Update-Service) -- C:\Program Files (x86)\Digital Trends Club\Payback-Updater.exe () SRV - (Bandoo Coordinator) -- C:\Program Files (x86)\Bandoo\Bandoo.exe (Bandoo Media Inc.) SRV - (M4iPodWPDService) -- C:\Program Files (x86)\Common Files\Mediafour\iPod\M4iPodWPDService.exe (Mediafour Corporation) SRV - (OS Selector) -- C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe () SRV - (LBTServ) -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (IAStorDataMgrSvc) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) SRV - (M4LIC) -- C:\Program Files (x86)\Common Files\Mediafour\M4LIC.EXE (Mediafour Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (ezSharedSvc) -- C:\Windows\SysWOW64\ezsvc7.dll (EasyBits Sofware AS) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (KMService) -- C:\Windows\SysWOW64\srvany.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (truecrypt) -- C:\Windows\SysNative\drivers\truecrypt.sys (TrueCrypt Foundation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (snapman) -- C:\Windows\SysNative\drivers\snapman.sys (Acronis) DRV:64bit: - (UsbserFilt) -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys (Nokia) DRV:64bit: - (upperdev) -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys (Nokia) DRV:64bit: - (nmwcdc) -- C:\Windows\SysNative\drivers\ccdcmbox64.sys (Nokia) DRV:64bit: - (nmwcd) -- C:\Windows\SysNative\drivers\ccdcmbx64.sys (Nokia) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (mobiolavs) -- C:\Windows\SysNative\drivers\mobiolavs.sys (SHAPE Services GmbH) DRV:64bit: - (MOBIOLA_Wave) Mobiola Wave Audio Device (WDM) -- C:\Windows\SysNative\drivers\mobiolawave.sys (SHAPE Services) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.) DRV:64bit: - (CLNUIDriver) -- C:\Windows\SysNative\drivers\CLNUIDriver.sys (Code Laboratories, Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (usbser) -- C:\Windows\SysNative\drivers\usbser.sys (Microsoft Corporation) DRV:64bit: - (CbFs) -- C:\Windows\SysNative\drivers\cbfs.sys (EldoS Corporation) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.) DRV:64bit: - (VX3000) -- C:\Windows\SysNative\drivers\VX3000.sys (Microsoft Corporation) DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.) DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.) DRV:64bit: - (ggsemc) -- C:\Windows\SysNative\drivers\ggsemc.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (ggflt) -- C:\Windows\SysNative\drivers\ggflt.sys (Sony Ericsson Mobile Communications) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (DFUBTUSB) -- C:\Windows\SysNative\drivers\frmupgr.sys (Broadcom Corporation.) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (MDFSYSNT) -- C:\Windows\SysNative\drivers\MDFSYSNT.SYS (Mediafour Corporation) DRV:64bit: - (vncmirror) -- C:\Windows\SysNative\drivers\vncmirror.sys (RealVNC Ltd.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (netr28x) -- C:\Windows\SysNative\drivers\netr28x.sys (Ralink Technology, Corp.) DRV:64bit: - (KMWDFILTER) -- C:\Windows\SysNative\drivers\KMWDFILTER.sys (Windows (R) Codename Longhorn DDK provider) DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation) DRV:64bit: - (pccsmcfd) -- C:\Windows\SysNative\drivers\pccsmcfdx64.sys (Nokia) DRV:64bit: - (ElbyCDFL) -- C:\Windows\SysNative\drivers\ElbyCDFL.sys (SlySoft, Inc.) DRV:64bit: - (ElbyCDIO) -- C:\Windows\SysNative\drivers\ElbyCDIO.sys (Elaborate Bytes AG) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ElbyCDFL) -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys (SlySoft, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPDSK/4 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=1 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://startsear.ch/?aff=1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://startsear.ch/?aff=1&src=sp&cf=8fa34532-0237-11e1-8054-cf6766fd19f9&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search"# Mozilla User Preferences FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.selectedEngine: "ICQ Search" FF - prefs.js..browser.startup.homepage: "hxxp://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3 FF - prefs.js..extensions.enabledItems: {4BBDD651-70CF-4821-84F8-2B918CF89CA3}:6.3.2 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:2.0.0.3 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.732 FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.36.0 FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=101&q=" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.defaultengine: "Web Search" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.11: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: [INSTALLDIR] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Program Files (x86)\Google\Google Gears\Firefox\ [2010.08.02 19:07:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\gacela2@nurago.com: C:\Program Files (x86)\Digital Trends Club\ [2011.11.25 11:23:45 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.08 18:37:17 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.29 15:09:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\te_7.0@nokia.com: C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_7.0 [2011.11.10 19:45:46 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firefox@bandoo.com: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles/67b3q80q.default\extensions\firefox@bandoo.com [2011.02.13 11:50:55 | 000,000,000 | ---D | M] [2010.03.31 14:22:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Extensions [2011.07.28 11:02:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions [2010.03.31 22:17:13 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2011.06.12 13:23:54 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.08.09 20:00:41 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.06.09 09:18:44 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.03.31 22:17:13 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011.02.13 11:50:55 | 000,000,000 | ---D | M] (Bandoo for Firefox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\67b3q80q.default\extensions\firefox@bandoo.com [2011.11.24 20:17:50 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions [2010.04.27 22:14:41 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.09.06 08:48:23 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2010.03.31 22:40:20 | 000,000,000 | ---D | M] (IE Tab) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9} [2011.10.14 12:24:33 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670} [2010.03.31 22:40:18 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} [2011.08.09 13:12:55 | 000,000,000 | ---D | M] (Разпознаване на устройство Logitech) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\DeviceDetection@logitech.com [2010.03.31 22:40:21 | 000,000,000 | ---D | M] (Noia 2.0 eXtreme OPT) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\noia2_option@kk.noia [2011.03.13 08:36:22 | 000,000,000 | ---D | M] (Personas) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\personas@christopher.beard [2011.10.27 19:25:34 | 000,000,000 | ---D | M] (Reload Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Don\extensions\reloadplus@blackwind [2011.06.12 13:23:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions [2010.08.09 19:19:15 | 000,000,000 | ---D | M] ("ColorfulTabs") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FlashGot) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FEBE) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{4BBDD651-70CF-4821-84F8-2B918CF89CA3} [2011.06.12 13:23:55 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2010.08.09 20:00:41 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Noia 2.0 (eXtreme)) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FoxTab) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Noia 2.0 eXtreme OPT) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\noia2_option@kk.noia [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (Personas) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\personas@christopher.beard [2010.08.09 19:19:15 | 000,000,000 | ---D | M] (FastestFox) -- C:\Users\*****\AppData\Roaming\mozilla\Firefox\Profiles\febeprof.Hamster\extensions\smarterwiki@wikiatic.com [2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\icqplugin.xml [2010.08.12 12:12:24 | 000,005,529 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\SearchquWebSearch.xml [2011.07.11 19:04:02 | 000,000,633 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\searchplugins\startsear.xml [2011.11.08 18:37:19 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.10.24 09:13:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2010.08.02 19:07:00 | 000,000,000 | ---D | M] (Google Gears) -- C:\PROGRAM FILES (X86)\GOOGLE\GOOGLE GEARS\FIREFOX File not found (No name found) -- C:\PROGRAM FILES (X86)\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC [2011.11.08 18:37:17 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2007.12.17 18:16:14 | 000,065,536 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npkimi.dll [2011.10.03 10:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll [2011.10.01 07:19:12 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.01 07:19:12 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011.10.01 07:19:12 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011.07.28 11:02:44 | 000,002,048 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml [2011.10.01 07:19:12 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.08.12 12:12:24 | 000,005,529 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchquWebSearch.xml [2011.10.01 07:19:12 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.01 07:19:12 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Web Search (Enabled) CHR - default_search_provider: search_url = hxxp://startsear.ch/?aff=1&src=sp&cf=8fa34532-0237-11e1-8054-cf6766fd19f9&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - plugin: Shockwave Flash (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U26 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: DivX Web Player (Enabled) = C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Microsoft Windows Media Player Firefox Plugin (Enabled) = C:\Users\*****\AppData\Roaming\Mozilla\plugins\np-mswmp.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL CHR - plugin: Chrome NaCl (Disabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\Application\12.0.742.112\pdf.dll CHR - plugin: Gacela Plugin (Enabled) = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.1.3037_1\plugin/npgacela.dll CHR - plugin: Imikimi.com Plugin (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npkimi.dll CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npLegitCheckPlugin.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Picasa (Enabled) = C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.57\npGoogleUpdate3.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Donna Karan = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\fijgnliiiplghalknhobbcngpcngaoji\3_0\ CHR - Extension: AdBlock = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.4.29_0\ CHR - Extension: Page Refresh = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmooaemjmediafeacjplpbpenjnpcneg\1.0.5_0\ CHR - Extension: Payback Digital Trends Club = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkejcihojcegdmifcnlkhmnelneogef\11.1.3067_0\ CHR - Extension: vshare plugin = C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\ O1 HOSTS File: ([2011.10.14 21:11:28 | 000,000,918 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.acronis.de. O1 - Hosts: 127.0.0.1 secure.tune-up.com O2:64bit: - BHO: (Reg Error: Value error.) - {4907C0AD-874D-44D9-B13E-7B0A4D8B9D3E} - C:\Programme\Mediafour\XPlay 3\XPBHO.DLL (Mediafour Corporation) O2:64bit: - BHO: (Digital Trends Club) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (nurago GmbH) O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Digital Trends Club) - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (nurago GmbH) O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.) O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.) O2 - BHO: (BandooIEPlugin Class) - {EB5CEE80-030A-4ED8-8E20-454E9C68380F} - C:\Program Files (x86)\Bandoo\Plugins\IE\ieplugin.dll (Bandoo Media Inc.) O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKLM\..\Toolbar: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files (x86)\YRefresher\YRefresher.dll () O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (RefresherBand Class) - {B24BA06E-FB7B-4757-95C2-DC01125F750E} - C:\Program Files (x86)\YRefresher\YRefresher.dll () O4:64bit: - HKLM..\Run: [Bluetooth Connection Assistant] LBTWIZ.EXE -silent File not found O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [HKCU] C:\Users\*****\AppData\Roaming\Java\Java.exe (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm () O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\*****\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Ãœber Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\x64\Gacela2.dll (nurago GmbH) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files (x86)\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Über Digital Trends Club - {4BEEA052-726D-4A6E-B65D-A6BD07C263F3} - C:\Program Files (x86)\Digital Trends Club\Gacela2.dll (nurago GmbH) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files (x86)\ICQ7.6\ICQ.exe (ICQ, LLC.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000010 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {0972B098-DEE9-4279-AC7E-4BAAA029102D} hxxp://assets.photobox.com/assets/aurigma/ImageUploader5.cab?20110606050927 (PhotoboxPhotowaysUploader5 Control) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6241356A-2B31-4D51-B2C6-EE02547F87C1}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (c:\progra~2\bandoo\bndhook.dll) -c:\Program Files (x86)\Bandoo\BndHook.dll (Discordia Limited) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{12c927ef-aaed-11df-9459-406186961122}\Shell - "" = AutoRun O33 - MountPoints2\{12c927ef-aaed-11df-9459-406186961122}\Shell\AutoRun\command - "" = L:\iStudio.exe O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell - "" = AutoRun O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell\AutoRun\command - "" = M:\SETUP.EXE O33 - MountPoints2\{4a21454f-b8f4-11e0-a994-a1cb2b4c3ef3}\Shell\dinstall\command - "" = M:\DirectX\dxsetup.exe O33 - MountPoints2\{9feb5d87-dd3a-11df-a4de-406186961122}\Shell - "" = AutoRun O33 - MountPoints2\{9feb5d87-dd3a-11df-a4de-406186961122}\Shell\AutoRun\command - "" = H:\Setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.11.25 10:46:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft HiJackFree [2011.11.25 10:46:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft HiJackFree [2011.11.25 10:13:50 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\E000019F5AC9EFB0_MountPt [2011.11.24 20:27:10 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{7DF87030-9AFB-4919-A6A7-FA2F64AE3EA4} [2011.11.24 20:26:59 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{7A5B1994-C0BE-43F8-8F4D-C84F1678CD60} [2011.11.24 14:48:35 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Xbox 360 Hash Block Calculator [2011.11.24 14:48:35 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\CON-Uncorrupter [2011.11.24 14:05:39 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\DaysOfThunder XBLA - Non JTAG [2011.11.23 10:18:09 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{48B30CBD-051F-474E-9947-9989752B80C5} [2011.11.23 10:17:58 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{35E71655-CAFB-488F-A056-4D59A0230827} [2011.11.21 13:41:47 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{EE93B1D3-6645-487F-A155-57E9010D6CBA} [2011.11.21 13:41:36 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{F1B2DD0E-75A4-455F-A132-277E96EAF0E0} [2011.11.20 11:56:19 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{82EC050F-6D29-4D73-A29D-66C2D9B95C67} [2011.11.20 11:55:54 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{F6BC02C0-DE0D-4ABF-A66D-1151FA9D2390} [2011.11.19 12:01:32 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A5836E48-7BD4-41F9-B3B9-8C60EA52549F} [2011.11.19 12:01:21 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{FA6A59B2-732C-49D0-A4F7-9821291967EB} [2011.11.19 00:00:57 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{483F9527-7294-4D3C-ABDD-8542C23F81AF} [2011.11.19 00:00:46 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{CA39CD1B-D409-47D0-BEB1-5E566346E982} [2011.11.18 12:00:33 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{2922FA3D-0634-43DF-9138-FC929F3AEF48} [2011.11.18 12:00:09 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{0CA9EDF5-4388-4610-AED1-020F14AA6FC4} [2011.11.17 15:27:02 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E7AD2F8D-2512-4BF4-85DA-60BD136D4B7C} [2011.11.17 15:26:51 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A499F695-BB4A-4763-8E74-18992D7E4450} [2011.11.16 15:30:18 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{EB8B8600-7500-46E8-9B49-3D9D42CE275E} [2011.11.16 15:30:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{CFE809EE-8772-4F21-BFE5-E2D7730D9A03} [2011.11.16 09:20:46 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.11.15 17:21:51 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{5FD551FE-4C93-4D26-A74D-22E3C7D04E3B} [2011.11.15 17:21:25 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{B83214DD-84CF-4846-89F7-B68E44C33F3A} [2011.11.10 19:44:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PC Connectivity Solution [2011.11.10 19:34:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EroNavi [2011.11.10 19:34:00 | 000,000,000 | ---D | C] -- C:\ProgramData\EroNavi [2011.11.10 19:34:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EroNavi [2011.11.10 16:04:47 | 000,000,000 | ---D | C] -- C:\Users\*****\Desktop\Content [2011.11.07 11:31:05 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{D7C55F2A-7465-42AC-94AF-54CBD365302A} [2011.11.07 11:30:40 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{215FAAAB-0265-43F2-9BE5-02EC76E25A57} [2011.11.06 21:13:08 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\ODUI [2011.11.06 21:13:01 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Stardock [2011.11.06 21:12:59 | 000,000,000 | ---D | C] -- C:\Users\*****\Documents\Stardock [2011.11.06 21:12:59 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\Stardock [2011.11.06 21:12:47 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\PackageAware [2011.11.06 20:42:19 | 000,034,624 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe [2011.11.06 20:42:19 | 000,025,920 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll [2011.11.06 20:42:19 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll [2011.11.06 20:42:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012 [2011.11.06 20:42:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2012 [2011.11.06 20:40:39 | 026,148,728 | ---- | C] (TuneUp Software) -- C:\Users\*****\AppData\Roaming\TuneUpUtilities2012_2030.5-DE.exe [2011.11.06 20:40:39 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\Java [2011.11.06 20:40:38 | 000,040,960 | ---- | C] (Microsoft) -- C:\Users\*****\AppData\Roaming\Java.exe [2011.11.06 08:57:27 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{8EBCB85A-7674-4A55-A569-1E836D28048A} [2011.11.06 08:57:03 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{C85BCF8B-1DC7-4F54-B21A-D3AAB9BD2545} [2011.11.04 11:33:14 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E9753DF3-8850-4975-B735-1D46FB779BB4} [2011.11.04 11:33:03 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{94793514-D774-40C2-84F6-7EE662195523} [2011.11.03 22:44:32 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\TrueCrypt [2011.11.03 22:44:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TrueCrypt [2011.11.03 22:44:15 | 000,230,864 | ---- | C] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.11.03 22:44:13 | 000,000,000 | ---D | C] -- C:\Program Files\TrueCrypt [2011.11.03 11:47:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{A3E9553B-7C63-4293-87EF-F401FD7D22A1} [2011.11.03 11:46:57 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{60CE36AB-522F-4AFC-A816-94D0BB1AB521} [2011.11.02 23:46:31 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{8EC3181F-EDCF-4C94-9CEB-D667506B3889} [2011.11.02 23:46:07 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{29D59D44-A31D-4CCD-8CF9-88388218531A} [2011.11.02 21:13:56 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\gtk-2.0 [2011.11.02 20:24:24 | 000,000,000 | ---D | C] -- C:\Users\*****\.thumbnails [2011.11.02 20:22:58 | 000,000,000 | ---D | C] -- C:\Users\*****\.gimp-2.6 [2011.11.02 09:10:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Roaming\NVIDIA [2011.11.01 10:15:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{5E6B09E4-2224-4326-B445-0E18F42CACAF} [2011.11.01 10:14:42 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{17996A8A-A11A-46F3-9533-4363F18CB874} [2011.10.31 09:15:12 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{030BA732-4F81-4E1A-8845-B13F84BF8C27} [2011.10.31 09:15:01 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{0D9907B1-269E-4580-968A-3C37637FAD11} [2011.10.30 09:45:30 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{05A7D7A8-CE77-4874-A749-8EEF7759766C} [2011.10.30 09:45:06 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{56EF9223-4CCB-4052-83D0-1FCFBC497FA6} [2011.10.29 15:09:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\vShare.tv plugin [2011.10.28 13:33:56 | 000,000,000 | ---D | C] -- C:\Windows\AutoKMS [2011.10.26 12:56:13 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{E7F466A0-71AC-4186-88DB-BBFD082D9DED} [2011.10.26 12:56:02 | 000,000,000 | ---D | C] -- C:\Users\*****\AppData\Local\{AFB757D0-0779-476C-B2F7-0321C172D826} [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ] [1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.25 11:30:49 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.25 11:30:49 | 000,015,568 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.25 11:27:51 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.25 11:27:51 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.25 11:27:51 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.25 11:27:51 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.25 11:27:51 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.25 11:23:47 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.11.25 11:23:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.25 11:22:24 | 000,000,020 | ---- | M] () -- C:\Users\*****\defogger_reenable [2011.11.25 11:02:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.11.25 10:46:22 | 000,000,984 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft HiJackFree.lnk [2011.11.25 10:14:20 | 032,034,816 | ---- | M] () -- C:\Users\*****\E000019F5AC9EFB0 [2011.11.25 10:13:50 | 031,981,568 | ---- | M] () -- C:\Users\*****\Desktop\E000019F5AC9EFB0 [2011.11.24 20:41:09 | 004,446,151 | ---- | M] () -- C:\Users\*****\Desktop\K 165.jpg [2011.11.24 20:39:27 | 000,107,098 | ---- | M] () -- C:\Users\*****\Desktop\Hello-Kitty-Wallpaper-hello-kitty-8257470-1024-768.jpg [2011.11.24 20:38:37 | 097,409,343 | ---- | M] () -- C:\Users\*****\Desktop\K 165.psd [2011.11.24 11:26:52 | 000,013,598 | ---- | M] () -- C:\Users\*****\Desktop\1321960655288966372.jpg [2011.11.22 11:44:41 | 000,021,138 | ---- | M] () -- C:\Users\*****\Desktop\1321958348249268541.jpg [2011.11.22 11:43:52 | 000,053,266 | ---- | M] () -- C:\Users\*****\Desktop\1321958367076497904.jpg [2011.11.20 20:18:50 | 013,621,249 | ---- | M] () -- C:\Users\*****\Desktop\cam.pdf [2011.11.16 09:20:47 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2011.11.14 14:53:46 | 000,000,132 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011.11.10 09:14:45 | 005,013,328 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.09 12:33:23 | 000,000,132 | ---- | M] () -- C:\Users\*****\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.11.07 10:22:12 | 000,001,758 | ---- | M] () -- C:\Users\*****\Desktop\Downloads.lnk [2011.11.07 10:22:00 | 000,001,900 | ---- | M] () -- C:\Users\*****\Desktop\Wizard.lnk [2011.11.07 10:16:50 | 000,001,077 | ---- | M] () -- C:\Users\*****\Desktop\Musik.lnk [2011.11.07 10:16:47 | 000,001,094 | ---- | M] () -- C:\Users\*****\Desktop\Bilder.lnk [2011.11.07 10:16:42 | 000,001,105 | ---- | M] () -- C:\Users\*****\Desktop\Dokumente.lnk [2011.11.06 20:40:39 | 026,148,728 | ---- | M] (TuneUp Software) -- C:\Users\*****\AppData\Roaming\TuneUpUtilities2012_2030.5-DE.exe [2011.11.06 20:40:38 | 000,040,960 | ---- | M] (Microsoft) -- C:\Users\*****\AppData\Roaming\Java.exe [2011.11.03 22:44:15 | 000,230,864 | ---- | M] (TrueCrypt Foundation) -- C:\Windows\SysNative\drivers\truecrypt.sys [2011.11.02 21:13:56 | 000,002,102 | ---- | M] () -- C:\Users\*****\.recently-used.xbel [2011.10.31 10:43:56 | 000,000,544 | ---- | M] () -- C:\Windows\tasks\PCDRScheduledMaintenance.job [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [1 C:\Users\*****\AppData\Local\*.tmp files -> C:\Users\*****\AppData\Local\*.tmp -> ] [1 C:\Users\*****\*.tmp files -> C:\Users\*****\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.25 11:22:24 | 000,000,020 | ---- | C] () -- C:\Users\*****\defogger_reenable [2011.11.25 10:46:22 | 000,000,984 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft HiJackFree.lnk [2011.11.25 10:14:20 | 032,034,816 | ---- | C] () -- C:\Users\*****\E000019F5AC9EFB0 [2011.11.25 10:00:55 | 031,981,568 | ---- | C] () -- C:\Users\*****\Desktop\E000019F5AC9EFB0 [2011.11.24 20:41:04 | 004,446,151 | ---- | C] () -- C:\Users\*****\Desktop\K 165.jpg [2011.11.24 20:39:26 | 000,107,098 | ---- | C] () -- C:\Users\*****\Desktop\Hello-Kitty-Wallpaper-hello-kitty-8257470-1024-768.jpg [2011.11.24 20:38:33 | 097,409,343 | ---- | C] () -- C:\Users\*****\Desktop\K 165.psd [2011.11.22 12:20:42 | 000,013,598 | ---- | C] () -- C:\Users\*****\Desktop\1321960655288966372.jpg [2011.11.22 11:44:18 | 000,021,138 | ---- | C] () -- C:\Users\*****\Desktop\1321958348249268541.jpg [2011.11.22 11:43:51 | 000,053,266 | ---- | C] () -- C:\Users\*****\Desktop\1321958367076497904.jpg [2011.11.20 20:18:47 | 013,621,249 | ---- | C] () -- C:\Users\*****\Desktop\cam.pdf [2011.11.09 12:33:23 | 000,000,132 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Adobe BMP Format CS5 Prefs [2011.11.07 10:18:30 | 000,001,758 | ---- | C] () -- C:\Users\*****\Desktop\Downloads.lnk [2011.11.07 10:18:06 | 000,001,900 | ---- | C] () -- C:\Users\*****\Desktop\Wizard.lnk [2011.11.07 10:16:50 | 000,001,077 | ---- | C] () -- C:\Users\*****\Desktop\Musik.lnk [2011.11.07 10:16:47 | 000,001,094 | ---- | C] () -- C:\Users\*****\Desktop\Bilder.lnk [2011.11.07 10:16:42 | 000,001,105 | ---- | C] () -- C:\Users\*****\Desktop\Dokumente.lnk [2011.11.06 20:42:17 | 000,002,167 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk [2011.11.02 21:13:56 | 000,002,102 | ---- | C] () -- C:\Users\*****\.recently-used.xbel [2011.10.14 23:54:52 | 000,321,856 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2011.07.26 16:26:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2011.07.26 16:26:46 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll [2011.07.26 16:26:46 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll [2011.07.26 16:26:46 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll [2011.07.26 16:26:46 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll [2011.05.23 21:11:12 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\srvany.exe [2011.01.30 20:38:24 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2011.01.30 20:38:24 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2010.12.06 14:58:56 | 002,496,715 | ---- | C] () -- C:\Windows\SysWow64\abgx360.exe [2010.12.04 00:05:28 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\portio64.sys [2010.12.04 00:05:10 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\portio64.sys [2010.11.16 14:50:11 | 000,080,896 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe [2010.09.29 08:57:34 | 000,000,132 | ---- | C] () -- C:\Users\*****\AppData\Roaming\Adobe PNG Format CS5 Prefs [2010.09.27 14:30:57 | 000,000,600 | ---- | C] () -- C:\Users\*****\AppData\Roaming\winscp.rnd [2010.08.13 16:18:54 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2010.08.13 16:18:54 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2010.08.13 16:18:54 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2010.08.13 16:18:54 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2010.08.13 16:18:54 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2010.08.13 16:18:54 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2010.08.13 16:18:54 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2010.08.13 16:18:54 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2010.08.13 16:18:54 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2010.08.13 16:18:54 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2010.08.13 16:18:54 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2010.08.13 16:18:54 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2010.08.13 16:18:54 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2010.08.13 16:18:54 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2010.08.13 16:18:54 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2010.08.13 16:18:54 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2010.08.13 16:18:54 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2010.08.13 16:18:54 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2010.08.13 16:18:54 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2010.04.23 23:23:39 | 000,034,308 | ---- | C] () -- C:\ProgramData\mazuki.dll [2010.04.09 18:02:33 | 000,000,546 | ---- | C] () -- C:\Users\*****\AppData\Roaming\wklnhst.dat [2010.04.07 18:19:58 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.03.31 23:07:53 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2010.03.31 23:07:52 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2010.03.31 23:07:52 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2010.03.31 23:07:50 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2010.02.02 16:13:22 | 000,009,868 | ---- | C] () -- C:\Windows\SysWow64\ezdigsgn.dat [2009.09.29 15:25:16 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.26 17:24:18 | 000,015,498 | ---- | C] () -- C:\Windows\VX3000.ini [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2002.10.15 23:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2001.08.29 14:11:40 | 000,398,848 | R--- | C] () -- C:\Windows\SysWow64\DK2WIN32.DLL ========== Files - Unicode (All) ========== [2011.06.06 10:48:42 | 000,000,000 | ---D | M](C:\Users\*****\Documents\DonChulio21???) -- C:\Users\*****\Documents\DonChulio21的证书 [2009.07.21 08:01:45 | 000,000,000 | ---D | C](C:\Users\*****\Documents\DonChulio21???) -- C:\Users\*****\Documents\DonChulio21的证书 ========== Alternate Data Streams ========== @Alternate Data Stream - 164 bytes -> C:\ProgramData\Temp:264B2CC4 @Alternate Data Stream - 146 bytes -> C:\ProgramData\Temp:B6AC352B < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 25.11.2011 11:30:34 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\*****\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
5,93 Gb Total Physical Memory | 4,13 Gb Available Physical Memory | 69,70% Memory free
11,86 Gb Paging File | 9,98 Gb Available in Paging File | 84,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 918,27 Gb Total Space | 404,38 Gb Free Space | 44,04% Space Free | Partition Type: NTFS
Drive D: | 13,14 Gb Total Space | 1,81 Gb Free Space | 13,77% Space Free | Partition Type: NTFS
Drive E: | 465,67 Gb Total Space | 206,79 Gb Free Space | 44,41% Space Free | Partition Type: NTFS
Drive F: | 100,97 Mb Total Space | 72,77 Mb Free Space | 72,07% Space Free | Partition Type: NTFS
Drive G: | 7,58 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive Y: | 465,83 Gb Total Space | 354,08 Gb Free Space | 76,01% Space Free | Partition Type: NTFS
Computer Name: *****-PC | User Name: *****| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{0E543634-7E25-4B8F-8D5B-97880E5E5088}" = Bonjour
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1934BCF7-A63A-4C1F-809D-2B33C8F03B8F}" = O&O PartitionManager Professional
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1" = Media Player Classic - Home Cinema v1.3.2494.0 x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4D668D4F-FAA2-4726-834C-31F4614F312E}" = MSVC80_x64_v2
"{5621D339-24C0-492F-ACDD-C7B478EC15BD}" = XPlay 3
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6140C8C0-05CB-427B-9D45-7445CE833FC1}" = WBFS Manager 2.2.2
"{626672CD-BFCF-49A9-AEFE-AB0FED3BFC5B}" = Windows Mobile-Gerätecenter
"{680EDA59-9266-44B4-949E-0C24F65DFF82}" = Microsoft_VC100_CRT_SP1_x64
"{6965A8D2-465D-4F98-9FAA-0E9E2348F329}" = Microsoft LifeCam
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{92DBCA36-9B41-4DD1-941A-AED149DD37F0}" = Windows Mobile-Gerätecenter: Treiberupdate
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9C5A08BF-BB99-4998-81BD-F6CC32483B34}" = Microsoft Corporation
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{AB071C8B-873C-459F-ACA9-9EBE03C3E89B}" = MSVC90_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.5.20
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.24.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F83779DF-E1F5-43A2-A7BE-732F856FADB7}" = Microsoft SQL Server Compact 3.5 SP1 x64 English
"320E5A650E531D358621D0E81B35A922E0F32E16" = Windows-Treiberpaket - Sony Ericsson Mobile Communications (ggsemc) USB (04/01/2009 2.2.0.5)
"A195FB90FAD326D6887486405817715BDBC9DA48" = Windows-Treiberpaket - PrimeSense (psdrv3) PrimeSensor (07/13/2010 3.1.0.4)
"AD7AB2629F8514508E17FEDAF4E26A36107ECC2D" = Windows-Treiberpaket - PrimeSense (psdrv3) PrimeSense (02/16/2011 3.1.2.0)
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"FCEC33AD40CEA5E0FC4CEE6E42041A0DA189652D" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"PC-Doctor for Windows" = Hardwarediagnosetools
"SP6" = Logitech SetPoint 6.15
"Unlocker" = Unlocker 1.9.1-x64
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002FA4C4-DDFE-4E83-A5E0-E2A18B965468}" = Phoenix Service Software
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{06E34C00-0446-4176-81C8-A5DAFE53CA36}" = Acronis*Disk*Director*11*Home
"{07FA4960-B038-49EB-891B-9F95930AA544}" = HP Customer Experience Enhancements
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0DD140D3-9563-481E-AA75-BA457CBDAEF2}" = PC Inspector File Recovery
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{17B4760F-334B-475D-829F-1A3E94A6A4E6}" = HP Setup
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1EABDDCB-B788-4FD2-BA76-23472D8DD1D6}" = EPSON Easy Photo Print
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 29
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{3096C412-7636-45FD-9074-F596F4417076}" = AKVIS Retoucher
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}" = HP Advisor
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{44B2A0AB-412E-4F8C-B058-D1E8AECCDFF5}" = Recovery Manager
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D568C38-0552-4CDD-A643-01FAFA2957EF}" = Nokia Software Updater
"{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}" = PC Connectivity Solution
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F0545E7-3F0F-4730-AF70-26E61DBDF263}" = Digital Trends Club
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{6D65264D-49E2-4990-9159-4070604BDEA0}" = Playlist tool
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{741CFE3A-1C0B-4A7D-8E08-5D78C911C09D}" = HP Support Assistant
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8969CD6F-5B75-40B9-8701-86ECA4C1F263}_is1" = VSO Image Resizer 4.0.1.5
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90A6D70C-BD95-4AE1-9E8D-45399989D30B}_is1" = Dukto R4
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92DA4424-0CFB-44D1-A08B-B63D5D8BEFBC}_is1" = Phoenix Service Software 2010.8.4.41526
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.6 - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{AF88496B-4BBA-4922-97E9-2582D3A28358}" = Nokia Connectivity Cable Driver
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B8AC1A89-FFD1-4F97-8051-E505A160F562}" = HP Odometer
"{B9A03B7B-E0FF-4FB3-BA83-762E58A1B0AA}" = HP Support Information
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C611CF88-969D-43E6-A877-D6D6439DD081}" = HP Remote Solution
"{CC8E94A2-55C7-4460-953C-2A790180578C}" = LightScribe System Software
"{CCF298AF-9CE1-4B26-B251-486E98A34789}" = Windows 7 USB/DVD Download Tool
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D46D081B-F60E-467E-A7C4-117B70D76731}" = HP Update
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB24A9E5-A068-43DD-88D0-B51BED3C0B99}" = Nokia Suite
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E9E34215-82EF-4909-BE2F-F581F0DC9062}" = DirectX for Managed Code Update (Summer 2004)
"{EA4E18F0-E334-41F8-9AB6-7C2E2D1F8CF2}" = Trendyflash Intro Builder
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Activision(R)
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"1489-3350-5074-6281" = JDownloader 0.9
"7-Zip" = 7-Zip 4.65
"abgx360" = abgx360 v1.0.5
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"aEton CommunicaEor" = aEton CommunicaEor
"Angry Birds Rio" = Angry Birds Rio
"Avira AntiVir Desktop" = Avira Free Antivirus
"Bandoo" = Bandoo
"CD Audio Reader Filter" = CD Audio Reader Filter (remove only)
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CloneCD" = CloneCD
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DCoder Image Source" = DCoder Image Source (remove only)
"DivX Setup.divx.com" = DivX-Setup
"Drum Machine" = Drum Machine 1.36 BETA
"Emsisoft HiJackFree_is1" = Emsisoft HiJackFree 4.5
"EPSON Scanner" = EPSON Scan
"EroNavi_is1" = EroNavi 1.046
"ffdshow_is1" = ffdshow [rev 3124] [2009-11-03]
"FFMPEG Core Files" = FFMPEG Core Files (remove only)
"Filters Unlimited_is1" = Filters Unlimited 2.0.3
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.5
"Gabest MPEG Splitter" = Gabest MPEG Splitter (remove only)
"Gordon's Gate Flash Driver" = Gordon's Gate Flash Driver 1.1.0.12
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"HaaliMkx" = Haali Media Splitter
"HDClone.Professional.3.9.4.1033" = HDClone 3.9 Professional Edition
"HP Remote Solution" = HP Remote Solution
"ImgBurn" = ImgBurn
"Imikimi Plugin" = Imikimi Plugin
"Incomedia WebSite X5 v8 - Evolution" = Incomedia WebSite X5 v8 - Evolution
"InstallShield_{FC8A7918-D65D-440C-9596-C88185E8DCA4}" = Drum Controller Standard Tuning Kit
"JAFSetup" = JAF Setup
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.6.6 (Full) BETA
"Live Usb Helper" = Live Usb Helper 0.0.8
"MONOGRAM AMR Splitter/Decoder" = MONOGRAM AMR Splitter/Decoder (remove only)
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Mp3tag" = Mp3tag v2.48
"Noki_is1" = Noki v2.1
"Nokia Suite" = Nokia Suite
"NSS" = NSS (remove only)
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"OpenNI 1.0.0 for Windows" = OpenNI 1.0.0 for Windows (remove only)
"OpenSource AVI Splitter" = OpenSource AVI Splitter (remove only)
"OpenSource DTS/AC3/DD+ Source Filter" = OpenSource DTS/AC3/DD+ Source Filter (remove only)
"OpenSource Flash Video Splitter" = OpenSource Flash Video Splitter (remove only)
"Opera 11.52.1100" = Opera 11.52
"Phoenix Service Software 2010.08.004.41526_is1" = Phoenix Service Software 2010.08.004.41526
"Qt SDK 2010.05 - C:_Qt_2010.05" = Qt SDK 2010.05
"QuickPar" = QuickPar 0.9
"RATattack" = RATattack 0.2
"ratDVD" = ratDVD 0.78.1444
"RealMedia" = RealMedia (remove only)
"SHOUTcast Source" = SHOUTcast Source (remove only)
"SSC Service Utility_is1" = SSC Service Utility v4.30
"SystemRequirementsLab" = System Requirements Lab
"TrueCrypt" = TrueCrypt
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Uninstall_is1" = Uninstall 1.0.0.1
"UseNeXT_is1" = UseNeXT
"VLC media player" = VLC media player 1.1.11
"vShare.tv plugin" = vShare.tv plugin 1.3
"WBFS Manager 3.0" = WBFS Manager 3.0
"WinLiveSuite" = Windows Live Essentials
"XMedia Recode" = XMedia Recode 3.0.3.4
"YRefresher_is1" = Yrefresher 1.00
"ZoomPlayer" = Zoom Player (remove only)
"ZoomPlayerLang" = Zoom Player deutsche Sprachdateien (entfernen)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"360WAVESPATCHERCLT" = 360WavesPatcher (Client setup)
"Google Chrome" = Google Chrome
"WinSetupFromUSB" = WinSetupFromUSB
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
Geändert von DonChulio (25.11.2011 um 11:47 Uhr) |
|
25.11.2011, 11:28
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Winlogon.exe stealer.exe was ist das alles Bitte beachten => http://www.trojaner-board.de/95173-b...es-posten.html und http://www.trojaner-board.de/69886-a...-beachten.html
__________________ |
|
25.11.2011, 12:24
| #3 |
| | Winlogon.exe stealer.exe was ist das alles Tut mir leid ich habe es gerade korrigiert und zudem muss ich noch sagen das ich einen PC mit Windows 7 Home Premium 64bit habe.
__________________ |
|
25.11.2011, 12:59
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das alles Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
25.11.2011, 20:07
| #5 |
| | Winlogon.exe stealer.exe was ist das alles ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=c177b7e56d295e43a7c4bbbdf8f2f786 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2011-11-25 07:02:08 # local_time=2011-11-25 08:02:08 (+0100, Mitteleuropäische Zeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1792 16777215 100 0 3383790 3383790 0 0 # compatibility_mode=5893 16776574 100 94 17170712 73848887 0 0 # compatibility_mode=8192 67108863 100 0 3674 3674 0 0 # scanned=968644 # found=14 # cleaned=0 # scan_time=28691 C:\Program Files (x86)\Bandoo\Bandoo.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\BandooGo.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\BandooUI.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\BndCore.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\ExtensionsManager.exe a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\InstallerHelper.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\Plugins\IE\ieplugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\Plugins\MSN\msnplugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Program Files (x86)\Bandoo\Plugins\Yahoo\YahooPlugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS2.tmp HTML/ScrInject.B.Gen virus (unable to clean) 00000000000000000000000000000000 I C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS3.tmp JS/TrojanClicker.Agent.NCQ trojan (unable to clean) 00000000000000000000000000000000 I C:\Users\Daniel\AppData\Local\Opera\Opera\cache\g_0006\opr02TS5.tmp HTML/ScrInject.B.Gen virus (unable to clean) 00000000000000000000000000000000 I C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\67b3q80q.default\extensions\firefox@bandoo.com\components\FFPlugin.dll a variant of Win32/Adware.Bandoo.AA application (unable to clean) 00000000000000000000000000000000 I ${Memory} a variant of Win32/Remtasu.R trojan 00000000000000000000000000000000 I |
|
26.11.2011, 13:37
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das alles Was ist mit dem Vollscan Malwarebytes?
__________________ --> Winlogon.exe stealer.exe was ist das alles |
|
26.11.2011, 13:52
| #7 |
| | Winlogon.exe stealer.exe was ist das alles läuft seit 4std und 34 min |
|
26.11.2011, 18:13
| #8 |
| | Winlogon.exe stealer.exe was ist das alles Über 8,5 STD wahnsinn Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 8245 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 26.11.2011 18:08:51 mbam-log-2011-11-26 (18-08-47).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|Y:\|) Durchsuchte Objekte: 1141372 Laufzeit: 8 Stunde(n), 36 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 2 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Agent) -> Value: HKCU -> No action taken. Infizierte Dateiobjekte der Registrierung: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (Search) Good: (Google) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (Search) Good: (Google) -> No action taken. Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\*****\AppData\Roaming\Java\Java.exe (Backdoor.Agent) -> No action taken. c:\Users\*****\AppData\Roaming\Java.exe (Backdoor.Agent) -> No action taken. c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).cfg (Malware.Trace) -> No action taken. c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).dat (Malware.Trace) -> No action taken. |
|
27.11.2011, 01:11
| #9 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das allesZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
27.11.2011, 09:38
| #10 |
| | Winlogon.exe stealer.exe was ist das alles Schon geschehen |
|
27.11.2011, 11:55
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das alles Log dazu bitte posten
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.11.2011, 10:23
| #12 |
| | Winlogon.exe stealer.exe was ist das alles HAb jetzt mehrfach im fullscan rennen lassen und im quickscan und jedesmal tauchen die selben ergebnisse auf! Bekomme sie nicht weg! Malwarebytes' Anti-Malware 1.51.2.1300 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 8255 Windows 6.1.7601 Service Pack 1 Internet Explorer 9.0.8112.16421 28.11.2011 10:21:10 mbam-log-2011-11-28 (10-21-07).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 189796 Laufzeit: 3 Minute(n), 30 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 3 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU (Backdoor.Agent) -> Value: HKCU -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\*****\AppData\Roaming\Java\Java.exe (Backdoor.Agent) -> No action taken. c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).cfg (Malware.Trace) -> No action taken. c:\Users\*****\AppData\Roaming\microsoft\Windows\((mutex)).dat (Malware.Trace) -> No action taken. |
|
28.11.2011, 13:41
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das alles CustomScan mit OTL Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
28.11.2011, 15:09
| #14 |
| | Winlogon.exe stealer.exe was ist das alles otl hängt jetzt seit ca 12minuten an dem Punkt ohne das was geschieht %systemroot%\system32\*.dll /lockedfiles Ging doch weiter im Anhang die datei Geändert von DonChulio (28.11.2011 um 15:52 Uhr) |
|
28.11.2011, 16:06
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Winlogon.exe stealer.exe was ist das alles Dann lass diese Zeile mal weg: %systemroot%\system32\*.dll /lockedfiles
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Winlogon.exe stealer.exe was ist das alles |
| 2.0.7, 64-bit, 7-zip, adblock, adobe, alternate, antivir, avg, avira, bandoo, bho, bonjour, browser, c:\windows\system32\rundll32.exe, converter, desktop, document, emsisoft, explorer, firefox, google, google chrome, google earth, install.exe, internet, internet explorer, jdownloader, locker, microsoft office word, mozilla, mp3, musik, neu aufsetzen, nvidia, nvidia update, opera, picasa, plug-in, prüfen, refresh, sched.exe, senden, shell32.dll, shortcut, software, temp, usenext, webcheck, windows, winlogon.exe |
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
