EXP/Java.Blacole.P & andere Späße

Virusblödsin

Hallo Trojaner-Board.

Mein Name ist Diana.
Ich habe festgestellt dass mein Laptop langsam geworden ist.
Ein Freund hat kurz darauf festgestellt, dass bei mir in der Leiste unten rechts, wo man sieht welche Programme im Hintergrund laufen, (weiß nicht wie man die nennt ) zu viel Programme sind. Davon waren auch ein paar antivir Programme. So habe ich zum Beispiel Norton deinstalliert. Das hat aber soweit ich weiß eh nicht mehr funktioniert weil sie testversion abgelaufen ist.
Dann hatte ich nur noch Spybot und Avira Antivir drauf.

Nach dem DEinstallieren sämtlicher Programme war mein Laptop aber immernoch nicht schneller. So habe ich einen Scan mit Antivir gemacht.
Dieser hat dann auch einiges gefunden was ich als bild unter VIRUS KACK ( auch im anhang ) abgespeichert habe. Das Gefundene wurde wie auch im Bild zu erkennen "In Quarantäne" verschoben.

Das hat aber auch nichts geholfen also hab ich noch Spybot suchen lassen, der auch nochmal was anderes gefunden hat. woran ich mich aber nicht mehr erinnern kann. ICh habe irgendwann noch was mit When.U.Wheater.cast oder ähnlich gelesen und sowas wie Win.Agent.32 war auch dabei.

Dann erst hab ich eingesehen dass ich hilfe brauche. Hab gegoogelt bin auf euer Forum gestossen durch jemand der eines der Viren auch hatte. Dem haben sie geraten Malwarebytes suchen lassen und danach CCleaner. Das hab ich dann auch gemacht aber erst danach verstanden dass er seine Ergebnisse ihnen schicken sollte.

Dann hab ich erst die Forenregeln gelesen und brav befolgt was ihr da schreibt. Die Dateien OTL, Extras und Gmer.txt erstellt die letzten beiden sollten wenns geklappt hat gezippt im Anhang sein. (Meinen "User" Namen habe ich in den Logdateien nicht geändert, was aber wie ich es verstanden habe auch nicht unbedingt nötig ist. )

Mindestens einen Virus habe ich bestimmt von gewissen Spam mails, die ich dummerweise geöffnet habe. Der Absender war mir bekannt aber der Betreff der Nachrichten: RE: I DID IT...
eine andere: RE: try it out for yourself.
und nochmal draufgeklickt: RE: Hey, I finally found this opportunity.
Die mails sind noch in meinen "Deleted" ordner in meinem email account auf hotmail.

Ich nehme mal stark an dass ich nicht alle Viren in den letzten Tagen bekommen habe, also war in der zwischenzeit auch mal eine externe Speicherplatte-Laufwerk oder wie mans nennt an meinen laptop angeschlossen. Diese muss dann wohl auch "gereinigt" werden?

Mein Internet bricht ständig kurz ab. Was bestimmt an den Viren liegt, da ein andere PC die gleiche Internetverbindung nutzt und keine Probleme hat.
Ich hoffe ihr könnt mir helfen.

Viele GRüße

Diana


Der OTL Text hier:


OTL logfile created on: 21.12.2011 10:38:36 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Diana\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1,99 Gb Total Physical Memory | 1,01 Gb Available Physical Memory | 50,65% Memory free
4,22 Gb Paging File | 2,92 Gb Available in Paging File | 69,15% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,22 Gb Total Space | 16,76 Gb Free Space | 22,59% Space Free | Partition Type: NTFS
Drive E: | 73,36 Gb Total Space | 10,85 Gb Free Space | 14,79% Space Free | Partition Type: NTFS

Computer Name: MEIN-COMPI | User Name: Diana | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011.12.21 10:32:27 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Diana\Desktop\OTL.exe
PRC - [2011.11.20 19:41:11 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.27 12:55:42 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2010.11.16 14:53:02 | 000,454,344 | ---- | M] (Gianpaolo Bottin) -- C:\Programme\WallpaperSS\WallpaperSS.exe
PRC - [2010.11.13 14:30:54 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.08.11 14:32:26 | 000,091,648 | ---- | M] () -- C:\Windows\System32\SupportAppXL\AutoDect.exe
PRC - [2009.05.15 06:35:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009.04.11 07:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 07:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.01.26 15:31:16 | 002,144,088 | RHS- | M] (Safer Networking Limited) -- E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- E:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.10.20 21:18:26 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2008.01.19 08:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.19 08:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2008.01.19 08:33:39 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe
PRC - [2007.07.06 10:06:52 | 004,669,440 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\System32\PSIService.exe
PRC - [2007.04.24 15:00:10 | 000,225,280 | ---- | M] (ATK0100) -- C:\Programme\ATK Hotkey\HControl.exe
PRC - [2007.03.22 16:09:28 | 002,420,736 | ---- | M] () -- C:\Programme\ATK Hotkey\ATKOSD.exe
PRC - [2007.02.05 17:13:14 | 000,094,208 | ---- | M] () -- C:\Programme\ATK Hotkey\ASLDRSrv.exe
PRC - [2006.11.03 11:01:16 | 000,319,488 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\Pac207\Monitor.exe
PRC - [2006.10.05 11:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006.05.25 18:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) -- C:\Windows\System32\TODDSrv.exe
PRC - [2006.05.24 07:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) -- C:\Windows\System32\StkASv2K.exe


========== Modules (No Company Name) ==========

MOD - [2009.12.12 15:12:03 | 000,141,824 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.08.11 14:32:26 | 000,091,648 | ---- | M] () -- C:\Windows\System32\SupportAppXL\AutoDect.exe


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (Automatisches LiveUpdate - Scheduler)
SRV - [2011.12.14 00:13:24 | 003,316,000 | ---- | M] () [Auto | Running] -- c:\program files\common files\akamai/netsession_win_b427739.dll -- (Akamai)
SRV - [2011.11.20 19:41:11 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.27 12:55:42 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2009.12.04 14:59:42 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.05.15 06:35:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- E:\Program Files\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.10.20 21:18:26 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2008.01.19 08:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2007.02.05 17:13:14 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Programme\ATK Hotkey\ASLDRSrv.exe -- (ASLDRService)
SRV - [2006.10.05 11:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006.05.25 18:30:16 | 000,114,688 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Windows\System32\TODDSrv.exe -- (TODDSrv)
SRV - [2006.05.24 07:49:14 | 000,024,576 | ---- | M] (Syntek America Inc.) [Auto | Running] -- C:\Windows\System32\StkASv2K.exe -- (StkASSrv)
SRV - [2005.11.17 13:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)


========== Driver Services (SafeList) ==========

DRV - [2011.11.20 19:41:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.11.20 19:41:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.08.11 14:19:44 | 000,007,680 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.07.29 05:05:04 | 000,919,552 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2007.07.30 10:54:02 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007.07.27 11:46:06 | 000,251,680 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acehlp10.sys -- (acehlp10)
DRV - [2007.07.27 09:13:08 | 000,330,144 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\ACEDRV10.sys -- (acedrv10)
DRV - [2007.07.26 15:18:04 | 000,285,184 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\tos_sps32.sys -- (tos_sps32)
DRV - [2007.07.13 15:18:20 | 000,050,688 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2007.02.24 13:42:22 | 000,039,936 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2007.02.21 12:33:54 | 000,080,232 | ---- | M] (Softwareentwicklung Remus - ArchiCrypt ) [Driver] [Kernel | System | Running] -- C:\Windows\System32\drivers\sleen15.sys -- (SLEE_15_DRIVER)
DRV - [2007.01.23 15:40:20 | 000,042,496 | ---- | M] (REDC) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007.01.18 15:47:18 | 000,211,072 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10n.sys -- (KR10N)
DRV - [2007.01.18 15:40:56 | 000,219,392 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\kr10i.sys -- (KR10I)
DRV - [2006.12.14 14:11:58 | 000,007,680 | ---- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ATKACPI.sys -- (MTsensor)
DRV - [2006.12.05 11:34:42 | 000,507,136 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PFC027.SYS -- (PAC207)
DRV - [2006.11.28 14:11:00 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.10.18 11:50:04 | 000,016,128 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tdcmdpst.sys -- (tdcmdpst)
DRV - [2006.09.27 04:01:36 | 000,241,628 | ---- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\StkAMini.sys -- (StkAMini)
DRV - [2006.08.02 07:44:04 | 000,004,772 | ---- | M] (Syntek America Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\StkScan.sys -- (StkScan)
DRV - [2004.02.04 09:27:56 | 000,049,536 | ---- | M] (Texas Instruments Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tiehdusb.sys -- (TIEHDUSB)
DRV - [2002.07.17 14:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60347
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.crawler.com/homepage.aspx?tbid=60347
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.zitate-datenbank.service-itzehoe.de/zitat-des-tages/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: dvscontextmenuy@dvdvideosoft.com:1.0
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1
FF - prefs.js..extensions.enabledItems: 6
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: 41
FF - prefs.js..extensions.enabledItems: {BBDA0591-3099-440a-AA10-41764D9DB4DB}:2.0
FF - prefs.js..extensions.enabledItems: {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}:4.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ATU2&o=14670&locale=de_DE&apn_uid=103d308a-dffa-4136-b7b9-732518819af2&apn_ptnrs=T8&apn_sauid=32D31D0B-7D4C-443E-8004-00A4CE64B5FE&apn_dtid=YYYYYYYYDE&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.23 13:31:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.30 10:42:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Namoroka 3.6a2pre\extensions\\Components: C:\Program Files\Minefield\components [2009.09.25 12:59:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Namoroka 3.6a2pre\extensions\\Plugins: C:\Program Files\Minefield\plugins [2010.01.10 10:58:17 | 000,000,000 | ---D | M]

[2009.08.27 11:12:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Diana\AppData\Roaming\mozilla\Extensions
[2011.06.29 12:24:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Diana\AppData\Roaming\mozilla\Firefox\Profiles\p0j38dr4.default\extensions
[2010.05.22 01:59:43 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Diana\AppData\Roaming\mozilla\Firefox\Profiles\p0j38dr4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.30 09:14:46 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Diana\AppData\Roaming\mozilla\Firefox\Profiles\p0j38dr4.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2009.08.27 11:16:21 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Diana\AppData\Roaming\mozilla\Firefox\Profiles\p0j38dr4.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2009.10.27 20:53:25 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Diana\AppData\Roaming\mozilla\Firefox\Profiles\p0j38dr4.default\extensions\moveplayer@movenetworks.com
[2011.06.29 12:15:06 | 000,002,396 | ---- | M] () -- C:\Users\Diana\AppData\Roaming\Mozilla\Firefox\Profiles\p0j38dr4.default\searchplugins\askcom.xml
[2011.01.05 22:47:21 | 000,002,094 | ---- | M] () -- C:\Users\Diana\AppData\Roaming\Mozilla\Firefox\Profiles\p0j38dr4.default\searchplugins\ecosia.xml
[2011.11.26 14:06:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.11.26 14:06:16 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.11.21 22:29:51 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.11.23 13:31:48 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.11.23 13:31:32 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.23 13:31:32 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2007.07.26 13:05:16 | 000,001,329 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml
[2011.11.23 13:31:32 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.11.23 13:31:32 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.11.23 13:31:32 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.11.23 13:31:32 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}

O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [autodetect] C:\Windows\System32\SupportAppXL\AutoDect.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Monitor] C:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O4 - HKCU..\Run: [WallpaperSS] C:\Programme\WallpaperSS\WallpaperSS.exe (Gianpaolo Bottin)
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] E:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowLegacyWebView = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: AllowUnhashedWebView = 1
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Diana\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Save YouTube Video as MP3 - C:\Program Files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll (DVSTeam)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: eBay - Der weltweite Online Marktplatz - {76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Amazon.de - {8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home File not found
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B37A36A5-3B2C-43FC-B1C7-35C12E563979}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B92FFF73-0C6C-49CF-8600-B8949315E859}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Diana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Diana\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {3E6DF801-82A1-11F4-C24D-880F688B8FE6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {B5D9B1AC-F3DF-2505-A4FC-35D159C7311B} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

MsConfig - StartUpReg: Orb - hkey= - key= - C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks)
MsConfig - StartUpReg: Toshiba Registration - hkey= - key= - C:\Programme\TOSHIBA\Registration\ToshibaRegistration.exe (Toshiba)
MsConfig - StartUpReg: UVS10 Preload - hkey= - key= - File not found
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files\Winamp\winampa.exe ()
MsConfig - State: "startup" - 2

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011.12.21 10:32:13 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Diana\Desktop\OTL.exe
[2011.12.21 10:16:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2011.12.21 02:47:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.21 02:47:02 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.07 20:09:10 | 000,000,000 | ---D | C] -- C:\Users\Diana\AppData\Roaming\DVDVideoSoft
[2011.12.05 15:46:06 | 000,000,000 | ---D | C] -- C:\ProgramData\SpywareTerminator2012Upgrade
[2011.11.29 21:58:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011.11.29 21:58:14 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011.11.29 21:11:46 | 000,000,000 | ---D | C] -- C:\Users\Diana\AppData\Local\Biro_Solutions
[2011.11.29 20:53:15 | 000,000,000 | ---D | C] -- C:\Users\Diana\AppData\Roaming\Applied Recognition Inc
[2011.11.29 20:53:00 | 000,000,000 | ---D | C] -- C:\Users\Diana\AppData\Roaming\com.appliedrec.Fotobounce
[2011.11.29 20:51:33 | 000,000,000 | ---D | C] -- C:\Program Files\Fotobounce Family
[2011.11.29 18:03:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ALDI Bestellsoftware
[2011.11.29 17:58:58 | 000,000,000 | ---D | C] -- C:\Program Files\ALDI Bestellsoftware
[2011.11.27 22:07:22 | 000,000,000 | ---D | C] -- C:\Users\Diana\Desktop\muell
[2011.11.26 14:05:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.11.24 13:51:13 | 000,000,000 | R--D | C] -- C:\Users\Diana\Music
[2011.11.22 12:57:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OverDisk
[2011.11.22 12:57:39 | 000,000,000 | ---D | C] -- C:\Users\Diana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OverDisk
[2011.11.22 12:57:39 | 000,000,000 | ---D | C] -- C:\Program Files\OverDisk
[2002.03.11 10:06:30 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2002.03.11 09:45:04 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsia.exe
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.12.21 10:32:27 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Diana\Desktop\OTL.exe
[2011.12.21 10:29:52 | 000,000,000 | ---- | M] () -- C:\Users\Diana\defogger_reenable
[2011.12.21 10:16:16 | 000,001,976 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.12.21 10:15:01 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.21 10:04:00 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.21 10:04:00 | 000,003,696 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.21 10:03:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.21 02:47:06 | 000,000,809 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.20 23:42:36 | 000,052,798 | ---- | M] () -- C:\Users\Diana\Desktop\VIRUS KACK2.JPG
[2011.12.20 23:41:40 | 000,055,577 | ---- | M] () -- C:\Users\Diana\Desktop\VIRUS KACK.JPG
[2011.12.20 23:15:05 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.20 19:17:44 | 2138,300,416 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.20 16:31:44 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.12.18 16:30:31 | 000,304,160 | ---- | M] () -- C:\PA207.DAT
[2011.12.18 14:07:47 | 000,024,481 | ---- | M] () -- C:\Users\Diana\Desktop\banner.jpg
[2011.12.16 00:31:33 | 000,671,152 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.12.16 00:31:33 | 000,631,842 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.12.16 00:31:33 | 000,144,094 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.12.16 00:31:33 | 000,118,468 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.12.15 11:12:19 | 000,352,976 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.12.13 09:29:54 | 000,064,158 | ---- | M] () -- C:\Users\Diana\Desktop\NAJU weg 2.JPG
[2011.12.13 09:28:34 | 000,089,171 | ---- | M] () -- C:\Users\Diana\Desktop\NAJU weg 1.JPG
[2011.12.09 14:52:26 | 000,014,352 | ---- | M] () -- C:\Users\Diana\Documents\Diana oh diana.odt
[2011.12.09 02:18:07 | 001,287,071 | ---- | M] () -- C:\Users\Diana\Desktop\Mama y yo-2.jpg
[2011.12.07 20:07:31 | 000,001,196 | ---- | M] () -- C:\Users\Diana\Desktop\Free YouTube to MP3 Converter.lnk
[2011.12.05 19:16:48 | 000,092,437 | ---- | M] () -- C:\Users\Diana\Desktop\tumblr_lvn9arNEMH1qza249o1_400.jpg
[2011.12.01 00:01:55 | 028,340,594 | ---- | M] () -- C:\Users\Diana\Zentralamerika.cpr
[2011.11.29 21:11:46 | 000,000,136 | ---- | M] () -- C:\Users\Diana\AppData\Local\configurator.xml
[2011.11.29 18:04:08 | 000,010,127 | ---- | M] () -- C:\Users\Diana\Documents\Motivationsschreiben.odt
[2011.11.29 18:03:10 | 000,000,953 | ---- | M] () -- C:\Users\Public\Desktop\ALDI Bestellsoftware.lnk
[2011.11.28 18:03:04 | 000,239,104 | ---- | M] () -- C:\Users\Diana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.24 13:48:38 | 000,000,396 | ---- | M] () -- C:\Users\Diana\Musik.lnk
[2011.11.21 17:13:40 | 000,002,780 | ---- | M] () -- C:\Users\Diana\.recently-used.xbel
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.12.21 10:29:52 | 000,000,000 | ---- | C] () -- C:\Users\Diana\defogger_reenable
[2011.12.21 10:16:16 | 000,001,976 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2011.12.21 02:47:06 | 000,000,809 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.12.20 23:42:34 | 000,052,798 | ---- | C] () -- C:\Users\Diana\Desktop\VIRUS KACK2.JPG
[2011.12.20 23:41:36 | 000,055,577 | ---- | C] () -- C:\Users\Diana\Desktop\VIRUS KACK.JPG
[2011.12.18 14:07:45 | 000,024,481 | ---- | C] () -- C:\Users\Diana\Desktop\banner.jpg
[2011.12.13 09:29:52 | 000,064,158 | ---- | C] () -- C:\Users\Diana\Desktop\NAJU weg 2.JPG
[2011.12.13 09:28:31 | 000,089,171 | ---- | C] () -- C:\Users\Diana\Desktop\NAJU weg 1.JPG
[2011.12.09 14:52:23 | 000,014,352 | ---- | C] () -- C:\Users\Diana\Documents\Diana oh diana.odt
[2011.12.09 02:18:04 | 001,287,071 | ---- | C] () -- C:\Users\Diana\Desktop\Mama y yo-2.jpg
[2011.12.07 20:07:30 | 000,001,196 | ---- | C] () -- C:\Users\Diana\Desktop\Free YouTube to MP3 Converter.lnk
[2011.12.05 19:16:48 | 000,092,437 | ---- | C] () -- C:\Users\Diana\Desktop\tumblr_lvn9arNEMH1qza249o1_400.jpg
[2011.11.29 21:11:45 | 000,000,136 | ---- | C] () -- C:\Users\Diana\AppData\Local\configurator.xml
[2011.11.29 20:16:37 | 028,340,594 | ---- | C] () -- C:\Users\Diana\Zentralamerika.cpr
[2011.11.29 18:04:07 | 000,010,127 | ---- | C] () -- C:\Users\Diana\Documents\Motivationsschreiben.odt
[2011.11.29 18:03:09 | 000,000,953 | ---- | C] () -- C:\Users\Public\Desktop\ALDI Bestellsoftware.lnk
[2011.11.24 13:48:23 | 000,000,396 | ---- | C] () -- C:\Users\Diana\Musik.lnk
[2011.11.22 02:02:15 | 000,285,288 | ---- | C] () -- C:\Users\Diana\Desktop\CIMG0587.JPG
[2011.11.22 02:02:01 | 000,987,311 | ---- | C] () -- C:\Users\Diana\Desktop\CIMG0585.JPG
[2011.11.21 17:13:40 | 000,002,780 | ---- | C] () -- C:\Users\Diana\.recently-used.xbel
[2011.03.28 19:34:14 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.18 23:50:49 | 000,001,940 | ---- | C] () -- C:\Users\Diana\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.06.06 11:02:35 | 000,284,160 | ---- | C] () -- C:\Windows\unin0407.exe
[2010.05.27 20:49:26 | 000,020,480 | ---- | C] () -- C:\Windows\System32\jesterss.dll
[2010.05.07 23:02:22 | 000,598,016 | ---- | C] () -- C:\Windows\System32\viscomqtde.dll
[2010.05.07 23:02:22 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2010.05.07 22:47:32 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2010.02.18 21:13:52 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2010.02.18 21:13:52 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2009.12.28 16:58:28 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009.12.28 16:58:26 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009.12.28 16:58:20 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009.12.28 16:58:20 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009.12.28 16:58:15 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009.09.28 13:15:44 | 000,023,888 | ---- | C] () -- C:\Users\Diana\AppData\Roaming\UserTile.png
[2009.09.24 17:42:40 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.24 17:42:39 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.07.15 18:52:06 | 000,367,957 | ---- | C] () -- C:\Users\Diana\AppData\Local\uesqq_nav.dat
[2009.07.15 18:52:06 | 000,004,367 | ---- | C] () -- C:\Users\Diana\AppData\Local\uesqq.dat
[2009.07.15 18:52:06 | 000,002,039 | ---- | C] () -- C:\Users\Diana\AppData\Local\uesqq_navps.dat
[2009.06.07 12:27:20 | 000,073,728 | ---- | C] () -- C:\Windows\System32\vbzlib1.dll
[2009.01.18 11:33:11 | 000,000,085 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.01.09 21:02:36 | 135,463,509 | ---- | C] () -- C:\Program Files\openofficeorg1.cab
[2009.01.09 20:35:34 | 000,000,336 | ---- | C] () -- C:\Program Files\setup.ini
[2008.12.17 11:17:14 | 000,426,776 | ---- | C] () -- C:\Program Files\setup.exe
[2008.12.13 10:51:07 | 000,000,088 | RHS- | C] () -- C:\Windows\System32\2CAADAF586.sys
[2008.12.13 10:51:06 | 000,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008.09.28 21:10:24 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.09.14 12:32:43 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2008.09.14 12:30:06 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008.08.27 19:12:57 | 000,000,088 | ---- | C] () -- C:\Users\Diana\AppData\Local\xccgqaf.bat
[2008.07.31 14:13:55 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.07.30 09:47:45 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2008.04.29 21:03:35 | 000,146,254 | ---- | C] () -- C:\Windows\hpoins18.dat
[2008.03.07 23:44:35 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat
[2008.01.04 22:29:21 | 000,036,864 | ---- | C] () -- C:\Windows\System32\LckFldService.exe
[2008.01.04 18:29:21 | 000,000,680 | ---- | C] () -- C:\Users\Diana\AppData\Local\d3d9caps.dat
[2008.01.02 16:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008.01.02 16:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008.01.02 16:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008.01.02 16:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007.12.30 23:14:49 | 000,000,016 | -H-- | C] () -- C:\Users\Diana\AppData\Roaming\mxfilerelatedcache.mxc2
[2007.12.30 23:14:49 | 000,000,016 | -H-- | C] () -- C:\Users\Diana\AppData\Local\mxfilerelatedcache.mxc2
[2007.12.27 22:37:50 | 000,239,104 | ---- | C] () -- C:\Users\Diana\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.08.13 13:20:38 | 000,006,768 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2007.08.13 12:44:38 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
[2007.08.13 12:30:56 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
[2007.08.13 12:30:56 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
[2007.08.13 12:30:56 | 000,010,146 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
[2007.08.13 12:30:56 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
[2007.08.13 11:06:59 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.08.13 11:06:09 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007.08.13 11:06:09 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007.06.05 13:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2007.03.01 00:52:43 | 000,006,600 | ---- | C] () -- C:\Windows\hpomdl18.dat
[2006.11.02 16:33:31 | 000,671,152 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:33:31 | 000,144,094 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,352,976 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,631,842 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,118,468 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:27:46 | 000,000,518 | ---- | C] () -- C:\Windows\System32\SP207.INI
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.06.06 01:01:58 | 000,029,696 | ---- | C] () -- C:\Windows\System32\asutl8.dll

========== LOP Check ==========

[2008.11.20 18:46:33 | 000,000,000 | -HSD | M] -- C:\Users\Diana\AppData\Roaming\.#
[2008.12.25 14:27:39 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Ableton
[2008.07.20 18:03:58 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Anvil Studio
[2011.11.29 20:53:15 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Applied Recognition Inc
[2009.05.21 07:58:01 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Canneverbe_Limited
[2011.11.29 20:53:00 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\com.appliedrec.Fotobounce
[2011.12.07 20:09:17 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\DVDVideoSoft
[2011.04.22 13:45:14 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.05.01 16:38:40 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\DxO Labs
[2010.01.04 16:38:34 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\GameHouse
[2010.06.06 12:27:17 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\GetRightToGo
[2011.11.18 21:03:30 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\gtk-2.0
[2008.06.15 12:33:12 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Image Zone Express
[2008.08.06 16:19:28 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Inkscape
[2007.12.30 15:38:53 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Jane s Hotel
[2010.10.09 17:38:43 | 000,000,000 | -HSD | M] -- C:\Users\Diana\AppData\Roaming\jh87uhnoe3
[2009.08.14 20:07:51 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\MAGIX
[2011.03.29 18:33:51 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\MusicBrainz
[2009.05.17 08:23:06 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\OpenOffice.org
[2011.05.01 16:31:22 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\PACE Anti-Piracy
[2009.09.28 13:15:43 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\PeerNetworking
[2010.09.21 19:26:56 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\PhotoScape
[2008.01.05 22:13:09 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\PlayFirst
[2008.06.02 19:38:24 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Printer Info Cache
[2009.05.21 11:21:22 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Steganos
[2009.08.21 15:34:48 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\SYSTEMAX Software Development
[2008.09.16 17:36:35 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Ulead Systems
[2011.12.21 03:08:54 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\uTorrent
[2011.01.07 13:54:59 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\WallpaperSS
[2008.01.05 22:13:07 | 000,000,000 | ---D | M] -- C:\Users\Diana\AppData\Roaming\Zylom
[2011.12.20 16:31:44 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*. >
[2011.03.22 16:04:43 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.10.13 16:56:27 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.12.15 02:30:10 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2007.12.27 12:09:40 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.02.28 09:13:58 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft
[2008.03.02 09:06:18 | 000,000,000 | ---D | M] -- C:\Intel
[2008.09.03 19:18:07 | 000,000,000 | ---D | M] -- C:\Phenomedia
[2010.06.11 13:56:34 | 000,000,000 | ---D | M] -- C:\Phenomedia AG
[2011.12.21 02:47:02 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.12.15 13:31:44 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2007.12.27 12:09:40 | 000,000,000 | -HSD | M] -- C:\Programme
[2009.08.29 13:27:24 | 000,000,000 | RHSD | M] -- C:\sys
[2011.12.21 10:42:46 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2007.12.27 12:10:08 | 000,000,000 | R--D | M] -- C:\Users
[2011.12.21 03:00:09 | 000,000,000 | ---D | M] -- C:\Windows

< %PROGRAMFILES%\*.exe >
[2002.03.11 09:45:04 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsia.exe
[2002.03.11 10:06:30 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
[2008.12.17 11:17:14 | 000,426,776 | ---- | M] () -- C:\Program Files\setup.exe

< %LOCALAPPDATA%\*.exe >

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.manifest /3 >


< MD5 for: AFD.SYS >
[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\System32\drivers\afd.sys
[2011.04.21 14:58:27 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=3911B972B55FEA0478476B2E777B29FA -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18457_none_d99fb42e5bb59d9b\afd.sys
[2011.04.21 14:16:42 | 000,273,408 | ---- | M] (Microsoft Corporation) MD5=48EB99503533C27AC6135648E5474457 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18639_none_d7d0e0cc5e7d461c\afd.sys
[2006.11.02 09:58:43 | 000,270,336 | ---- | M] (Microsoft Corporation) MD5=5D24CAF8EFD924A875698FF28384DB8B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6000.16386_none_d5b1809661820e7c\afd.sys
[2011.04.21 14:28:53 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=70EE0FC7A0F384DBD929A01384AEEB4B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.22629_none_da4bc33774b91967\afd.sys
[2008.01.19 06:57:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=763E172A55177E478CB419F88FD0BA03 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.18000_none_d7e842925e6d1f50\afd.sys
[2009.04.11 05:47:03 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=A201207363AA900ABF1A388468688570 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6002.18005_none_d9d3bb9e5b8eea9c\afd.sys
[2011.04.21 14:12:21 | 000,273,920 | ---- | M] (Microsoft Corporation) MD5=C8AF25017CECB75906A571AC70D2D306 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6001.22905_none_d876efff77862705\afd.sys

< MD5 for: EXPLORER.EXE >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.12.27 15:17:49 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.12.27 15:17:48 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 08:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

< MD5 for: REGEDIT.EXE >
[2008.01.19 08:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 08:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe

< MD5 for: USERINIT.EXE >
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 08:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

< MD5 for: WININIT.EXE >
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 08:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

< MD5 for: WINLOGON.EXE >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 08:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-16 16:38:01

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 48 bytes -> C:\Windows:4A2508CBD15D1B57
@Alternate Data Stream - 1293 bytes -> C:\ProgramData\Microsoft:LWOZObL22mjhMeJi7YOyROaJwWVz
@Alternate Data Stream - 1212 bytes -> C:\Users\Diana\AppData\Local\Temp:QmVANT1veIWOAl0KKC7AwFPrcmiGJ
@Alternate Data Stream - 1175 bytes -> C:\Users\Diana\AppData\Local\Temp:dsnRxmwCt3AIKWCZnIgzXFM37eBx
@Alternate Data Stream - 1073 bytes -> C:\ProgramData\Microsoft:QRm8zARgzeZINimj7dPRM

< End of report >

Miniaturansicht angehängter Grafiken