| |
| |||||||
Log-Analyse und Auswertung: windows securitycenter pc gesperrt- 32-bit Vista home auf laptopWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
05.02.2012, 00:31
| #1 |
| |  windows securitycenter pc gesperrt- 32-bit Vista home auf laptop hallo habe folgendes problem: habe mir einen trojaner eingefangen zu dem es schon folgenden thread gibt: windows securitycenter pc gesperrt. habe die otl log-file und extras- file bereits kopiert, brauche dringend HILFE! Danke im Voraus OTL logfile created on: 04.02.2012 23:11:08 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Olaf\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,37 Gb Available Physical Memory | 79,02% Memory free 6,19 Gb Paging File | 5,81 Gb Available in Paging File | 93,92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 144,04 Gb Total Space | 53,49 Gb Free Space | 37,13% Space Free | Partition Type: NTFS Drive D: | 140,50 Gb Total Space | 118,59 Gb Free Space | 84,41% Space Free | Partition Type: NTFS Computer Name: OLAF-PC | User Name: Olaf | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.02.04 22:45:36 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Olaf\Downloads\OTL.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV - [2011.04.24 23:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Stopped] -- C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe -- (AVP) SRV - [2011.04.11 15:54:28 | 000,241,648 | ---- | M] (CyberLink) [Auto | Stopped] -- C:\Program Files\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe -- (CLKMSVC10_D20A29D4) SRV - [2008.11.09 21:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) SRV - [2008.10.16 16:26:20 | 000,860,160 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2008.10.16 15:54:34 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2008.03.07 15:05:10 | 000,024,576 | ---- | M] () [Auto | Stopped] -- C:\Programme\Acer\Empowering Technology\Service\ETService.exe -- (ETService) SRV - [2008.03.04 23:38:34 | 000,500,784 | ---- | M] (Egis Incorporated) [Auto | Stopped] -- C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe -- (eDataSecurity Service) SRV - [2008.02.15 08:09:30 | 000,595,248 | ---- | M] (Validity Sensors, Inc.) [Auto | Stopped] -- C:\Windows\System32\vfsFPService.exe -- (vfsFPService) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.10 16:03:00 | 000,233,472 | ---- | M] (Acer Incorporated) [Auto | Stopped] -- C:\Programme\Acer\Acer VCM\RS_Service.exe -- (RS_Service) SRV - [2007.12.11 04:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Stopped] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2007.12.06 16:15:28 | 000,110,592 | ---- | M] () [Auto | Stopped] -- C:\Acer\Mobility Center\MobilityService.exe -- (MobilityService) SRV - [2007.10.03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2007.06.14 18:57:42 | 000,145,504 | ---- | M] (B.H.A Corporation) [Auto | Stopped] -- C:\Windows\System32\bgsvcgen.exe -- (bgsvcgen) ========== Driver Services (SafeList) ========== DRV - [2012.01.04 03:28:59 | 000,570,160 | ---- | M] (Kaspersky Lab) [File_System | System | Stopped] -- C:\Windows\System32\drivers\klif.sys -- (KLIF) DRV - [2011.09.10 17:13:32 | 000,639,224 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd) DRV - [2011.03.10 18:36:18 | 000,023,856 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6) DRV - [2011.03.04 13:23:20 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2) DRV - [2011.03.04 13:23:14 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\kl1.sys -- (KL1) DRV - [2011.02.14 01:42:36 | 000,020,864 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbdiag.sys -- (UsbDiag) DRV - [2011.02.14 01:42:34 | 000,025,216 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbmodem.sys -- (USBModem) DRV - [2011.02.14 01:42:32 | 000,013,056 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgusbbus.sys -- (usbbus) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.11.02 20:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt) DRV - [2009.09.29 07:11:22 | 000,012,160 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgbtport.sys -- (LgBttPort) DRV - [2009.09.29 07:11:20 | 000,012,928 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lgvmodem.sys -- (LGVMODEM) DRV - [2009.09.29 07:11:20 | 000,010,496 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lgbtbus.sys -- (lgbusenum) DRV - [2009.08.05 05:18:22 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E60x86.sys -- (L1E) DRV - [2008.11.17 06:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2008.08.13 12:19:44 | 007,446,400 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008.07.07 17:14:45 | 000,043,184 | ---- | M] (Alfa Corporation) [File_System | Boot | Running] -- C:\Windows\system32\Drivers\AlfaFF.sys -- (AlfaFF) DRV - [2008.03.31 11:55:32 | 000,596,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UDXTTM6010.sys -- (UDXTTM6010) DRV - [2008.03.17 11:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2008.03.13 09:23:06 | 000,080,912 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR) DRV - [2008.03.05 18:38:38 | 000,015,392 | ---- | M] (Acer, Inc.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\int15.sys -- (int15) DRV - [2008.02.29 08:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008.02.15 08:09:46 | 000,040,752 | ---- | M] (Validity Sensors, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vfs101x.sys -- (vfs101x) DRV - [2008.01.23 09:19:44 | 000,501,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\ACEDRV11.sys -- (acedrv11) DRV - [2007.12.18 17:12:12 | 000,054,784 | ---- | M] (ITE Tech. Inc. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2007.09.26 12:12:22 | 002,251,776 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.07.17 16:40:20 | 000,036,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2007.07.17 16:40:14 | 000,034,960 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2006.11.02 14:27:34 | 000,020,112 | ---- | M] (Dritek System Inc.) [Kernel | System | Stopped] -- C:\Programme\Launch Manager\DPortIO.sys -- (DritekPortIO) DRV - [2006.02.20 01:17:40 | 000,033,408 | ---- | M] (B.H.A Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\cdrbsdrv.sys -- (cdrbsdrv) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.intl.acer.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.intl.acer.yahoo.com IE - HKLM\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com/?fr=fp-yie8 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredimail.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) IE - HKCU\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 192.168.178.:186 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredimail.com" FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.11.3.15590 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6 FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 FF - prefs.js..extensions.enabledItems: 6 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 41 FF - prefs.js..extensions.enabledItems: bettergmail2@ginatrapani.org:1.2 FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}:3.3.3.2 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=SPC&o=15000&locale=de_DE&apn_uid=7FF2AC20-915B-4704-B583-0F9F3479A066&apn_ptnrs=PV&apn_sauid=2A865F93-CA01-403A-94C6-F275231BCD02&apn_dtid=&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Ask.com" FF - prefs.js..browser.startup.homepage: "hxxp://mystart.incredimail.com/?a=6R7N8qHVhp" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.10.13 17:35:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.10.31 12:51:55 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011.10.31 12:52:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2012.01.04 03:49:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2012.01.04 03:49:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2012.01.04 03:49:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.12 00:22:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.01.21 14:01:13 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.10.13 17:35:00 | 000,000,000 | ---D | M] [2011.02.07 20:48:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Olaf\AppData\Roaming\mozilla\Extensions [2011.02.07 20:48:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Olaf\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2012.01.26 02:18:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions [2010.06.19 20:07:37 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.01.26 02:18:18 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.01.21 14:06:52 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829} [2011.11.10 20:03:11 | 000,000,000 | ---D | M] (IncrediMail MediaBar 2 Community Toolbar) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}(78) [2009.08.25 10:46:49 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2010.06.19 20:07:37 | 000,000,000 | ---D | M] ("Better Gmail 2") -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\bettergmail2@ginatrapani.org [2012.02.03 11:43:54 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\Olaf\AppData\Roaming\mozilla\Firefox\Profiles\auihu79m.default\extensions\toolbar@ask.com [2012.02.04 22:42:02 | 000,002,385 | ---- | M] () -- C:\Users\Olaf\AppData\Roaming\Mozilla\Firefox\Profiles\auihu79m.default\searchplugins\askcom.xml [2012.01.25 05:04:42 | 000,002,191 | ---- | M] () -- C:\Users\Olaf\AppData\Roaming\Mozilla\Firefox\Profiles\auihu79m.default\searchplugins\MyStart Search.xml [2012.01.21 14:00:36 | 000,003,915 | ---- | M] () -- C:\Users\Olaf\AppData\Roaming\Mozilla\Firefox\Profiles\auihu79m.default\searchplugins\SweetIM Search.xml [2011.11.08 18:46:33 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\USERS\OLAF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\AUIHU79M.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2012.01.12 00:22:51 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011.10.17 01:06:55 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.17 01:06:55 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.10.17 01:06:55 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.17 01:06:55 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.17 01:06:55 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.17 01:06:55 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms} CHR - Extension: PriceGong = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.5.4_0\ CHR - Extension: YouTube = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0\ CHR - Extension: Modul zur Link-Untersuchung = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0\ CHR - Extension: Virtuelle Tastatur = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0\ CHR - Extension: Google Mail = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\ CHR - Extension: Anti-Banner = C:\Users\Olaf\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0\ O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.) O2 - BHO: (Shopping Assistant Plugin) - {1631550F-191D-4826-B069-D9439253D926} - C:\Programme\PriceGong\2.5.4\PriceGongIE.dll (PriceGong) O2 - BHO: (HistoryTriggerBHO Class) - {21A88CB9-84D2-4020-A2D1-B25A21034884} - C:\Programme\LG Electronics\LG PC Suite IV\LinkAir\LinkAirBrowserHelper.dll (LG Electronics) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO) O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\bh\incredibar.dll (Montera Technologeis LTD) O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (ShowBarObj Class) - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\ActiveToolBand.dll (Egis) O2 - BHO: (Windows Live ID-Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Bing Bar BHO) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn1\YTSingleInstance.dll (Yahoo! Inc) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKLM\..\Toolbar: (@C:\Program Files\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll,-100) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Programme\MSN Toolbar\Platform\6.3.2291.0\npwinext.dll (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (IncrediMail MediaBar 2 Toolbar) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Programme\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.) O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.3.27\incredibarTlbr.dll (Montera Technologeis LTD) O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll (Egis Incorporated.) O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (IncrediMail MediaBar 2 Toolbar) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - C:\Programme\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [ArcadeDeluxeAgent] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (CyberLink Corp.) O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [eAudio] C:\Program Files\Acer\Empowering Technology\eAudio\eAudio.exe (Acer Incorporated) O4 - HKLM..\Run: [eDataSecurity Loader] C:\Programme\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe (Egis Incorporated) O4 - HKLM..\Run: [ePower_DMC] C:\Programme\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.) O4 - HKLM..\Run: [eRecoveryService] File not found O4 - HKLM..\Run: [FUFAXSTM] C:\Program Files\Epson Software\FAX Utility\FUFAXSTM.exe (SEIKO EPSON CORPORATION) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.) O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PlayMovie] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Acer Corp.) O4 - HKLM..\Run: [PLFSetI] C:\Windows\PLFSetI.exe () O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe (IncrediMail, Ltd.) O4 - HKCU..\Run: [MyTomTomSA.exe] C:\Program Files\MyTomTom 3\MyTomTomSA.exe (TomTom) O4 - HKCU..\Run: [vasja] C:\Users\Olaf\AppData\Local\Temp\0.37016726452194815.exe (Orb Networks) O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Image - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.) O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Memo - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.) O8 - Extra context menu item: LG Air Sync (R-Click) - Save as Mobile Text file - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.) O8 - Extra context menu item: LG Air Sync (R-Click) - Set as Mobile Wallpaper - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.) O8 - Extra context menu item: LG Air Sync Option - C:\Program Files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll (Mobile Leader Co.,Ltd.) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe () O9 - Extra 'Tools' menuitem : Quick-Launching Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Programme\Acer\Acer Bio Protection\PwdBank.exe () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: HP Smart Web Printing ein- oder ausblenden - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - Reg Error: Value error. File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{400FDECB-AE51-4C48-B8C8-BF5A4DBAB88F}: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FA05BF5D-7EB5-4997-A8C0-A24025149020}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\AWinNotifyVitaKey MC3000: DllName - (C:\Program Files\Acer\Acer Bio Protection\WinNotify.dll) - C:\Programme\Acer\Acer Bio Protection\WinNotify.dll (Arachnoid Biometrics Identification Group Corp.) O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\Acer03.JPG O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\Acer03.JPG O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - D:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{2af73d10-ca10-11dd-8169-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{2af73d10-ca10-11dd-8169-00a0d1a4baf1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{2af73d35-ca10-11dd-8169-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{2af73d35-ca10-11dd-8169-00a0d1a4baf1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{42a790c4-652a-11e0-a8e4-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{42a790c4-652a-11e0-a8e4-00a0d1a4baf1}\Shell\AutoRun\command - "" = F:\LGAutoRun.exe O33 - MountPoints2\{4e0d214c-cbb1-11dd-8597-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{4e0d214c-cbb1-11dd-8597-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{82f44396-bb04-11e0-9d11-001de0a17afd}\Shell - "" = AutoRun O33 - MountPoints2\{82f44396-bb04-11e0-9d11-001de0a17afd}\Shell\AutoRun\command - "" = F:\Install.exe O33 - MountPoints2\{82fee1f4-191f-11de-8392-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{82fee1f4-191f-11de-8392-00a0d1a4baf1}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a O33 - MountPoints2\{a027d371-1a39-11de-8945-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{a027d371-1a39-11de-8945-00a0d1a4baf1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a027d373-1a39-11de-8945-00a0d1a4baf1}\Shell - "" = AutoRun O33 - MountPoints2\{a027d373-1a39-11de-8945-00a0d1a4baf1}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{a5217545-bd3b-11e0-8113-001de0a17afd}\Shell - "" = AutoRun O33 - MountPoints2\{a5217545-bd3b-11e0-8113-001de0a17afd}\Shell\AutoRun\command - "" = F:\LGAutoRun.exe O33 - MountPoints2\{be5ce69c-a29a-11de-b7fe-00a0d1a4baf1}\Shell\AutoRun\command - "" = H:\tu2009_(8.0.3000.20)_tu2009aid22de_de-DE_V1.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.01.26 23:18:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.01.26 23:17:40 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.01.26 23:17:39 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2012.01.26 01:56:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome [2012.01.26 01:22:55 | 000,233,472 | ---- | C] (Broadcom Corporation.) -- C:\Windows\System32\BtwRSupport.dll [2012.01.26 01:22:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\es-MX [2012.01.26 01:22:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\es-AR [2012.01.26 01:12:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel® Matrix Storage Manager [2012.01.26 01:02:05 | 000,000,000 | ---D | C] -- C:\Users\Olaf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDirector [2012.01.26 00:21:26 | 000,000,000 | ---D | C] -- C:\Program Files\Launch Manager [2012.01.26 00:15:34 | 000,238,080 | ---- | C] (TODO: <Company name>) -- C:\Windows\System32\ITEIO_64.dll [2012.01.26 00:15:34 | 000,014,544 | ---- | C] (EnTech Taiwan) -- C:\Windows\System32\drivers\TVicPort.sys [2012.01.26 00:15:34 | 000,006,080 | ---- | C] (Zeal SoftStudio) -- C:\Windows\System32\drivers\zntport.sys [2012.01.26 00:09:07 | 000,017,952 | ---- | C] (Acer, Inc.) -- C:\Windows\System32\drivers\int15_64.sys [2012.01.26 00:09:06 | 000,015,392 | ---- | C] (Acer, Inc.) -- C:\Windows\System32\drivers\int15.sys [2012.01.25 05:05:40 | 000,000,000 | ---D | C] -- C:\Users\Olaf\AppData\Roaming\eType [2012.01.25 05:05:29 | 000,000,000 | ---D | C] -- C:\Program Files\Incredibar.com [2012.01.25 05:04:21 | 000,000,000 | ---D | C] -- C:\Users\Olaf\AppData\Local\TempDIR [2012.01.24 19:59:07 | 000,000,000 | ---D | C] -- C:\ProgramData\PlayMovie [2012.01.24 19:59:05 | 000,000,000 | ---D | C] -- C:\Users\Olaf\AppData\Local\PlayMovie [2012.01.23 16:35:09 | 005,296,128 | ---- | C] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe [2012.01.23 16:35:09 | 001,191,936 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlUpd.exe [2012.01.23 16:35:09 | 000,697,344 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkPgExt.dll [2012.01.23 16:35:09 | 000,532,480 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RTSndMgr.cpl [2012.01.23 16:35:09 | 000,339,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSXT.dll [2012.01.23 16:35:09 | 000,285,216 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkApoApi.dll [2012.01.23 16:35:09 | 000,185,776 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSTSHD.dll [2012.01.23 16:35:09 | 000,167,936 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSHP360.dll [2012.01.23 16:35:09 | 000,135,168 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\System32\SRSWOW.dll [2012.01.23 16:35:09 | 000,126,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\maxxaudioapo.dll [2012.01.23 16:35:09 | 000,029,696 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\System32\RtkCoInst.dll [2012.01.23 16:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.01.23 16:34:51 | 000,520,192 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\RtlExUpd.dll [2012.01.21 14:07:58 | 000,000,000 | ---D | C] -- C:\ProgramData\UAB [2012.01.21 14:07:55 | 000,000,000 | ---D | C] -- C:\Users\Olaf\AppData\Local\PC_Drivers_Headquarters [2012.01.21 14:07:48 | 000,000,000 | ---D | C] -- C:\ProgramData\DriverBoost [2012.01.21 14:07:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverBoost [2012.01.21 14:07:11 | 000,000,000 | ---D | C] -- C:\Program Files\DriverBoost [2012.01.21 14:06:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PriceGong [2012.01.21 14:06:52 | 000,000,000 | ---D | C] -- C:\Program Files\PriceGong [2012.01.21 14:00:10 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM [2012.01.21 14:00:10 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM [2012.01.11 23:53:47 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mciseq.dll [2012.01.11 23:53:46 | 000,066,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll [2012.01.11 23:53:45 | 000,376,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2012.01.11 23:53:44 | 001,314,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2012.01.11 23:53:44 | 000,497,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.02.04 23:08:02 | 003,407,872 | ---- | M] () -- C:\Users\Olaf\ntuser.dat [2012.02.04 22:40:40 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.02.04 22:36:42 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{d953a778-368d-11e1-be6e-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2012.02.04 22:36:42 | 000,065,536 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{d953a778-368d-11e1-be6e-806e6f6e6963}.TM.blf [2012.02.04 22:36:40 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2012.02.04 22:36:40 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2012.02.04 22:34:37 | 000,001,090 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.02.04 22:34:35 | 000,132,776 | ---- | M] () -- C:\ProgramData\nvModes.001 [2012.02.04 22:34:28 | 000,132,776 | ---- | M] () -- C:\ProgramData\nvModes.dat [2012.02.04 22:34:25 | 000,000,000 | ---- | M] () -- C:\Windows\System32\LogConfigTemp.xml [2012.02.04 22:34:12 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.02.04 22:34:12 | 000,003,344 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.02.04 17:10:00 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.02.03 16:05:40 | 001,572,964 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2012.02.03 16:05:40 | 000,676,300 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.02.03 16:05:40 | 000,636,294 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.02.03 16:05:40 | 000,147,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.02.03 16:05:40 | 000,120,722 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.02.02 12:38:49 | 003,866,704 | -H-- | M] () -- C:\Users\Olaf\AppData\Local\IconCache.db [2012.02.01 18:07:00 | 000,002,413 | ---- | M] () -- C:\Windows\System32\lgAxconfig.ini [2012.01.28 20:42:23 | 000,002,195 | ---- | M] () -- C:\Users\Olaf\Documents\iPhone Aktuelle Informationen.rtf [2012.01.26 23:18:13 | 000,001,668 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.01.26 23:08:34 | 000,001,854 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk [2012.01.26 01:57:03 | 000,000,808 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2012.01.26 01:56:48 | 000,001,975 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.01.26 01:22:51 | 000,000,807 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk [2012.01.26 01:12:43 | 000,001,024 | RH-- | M] () -- C:\Windows\System32\NTIOFM4.dll [2012.01.26 01:12:43 | 000,001,024 | RH-- | M] () -- C:\Windows\System32\NTIBUN5.dll [2012.01.26 01:02:05 | 000,001,850 | ---- | M] () -- C:\Users\Olaf\Desktop\Cyberlink PowerDirector.lnk [2012.01.26 00:53:33 | 000,001,024 | RH-- | M] () -- C:\Users\Public\Documents\NTIMPEG2.dll [2012.01.26 00:53:33 | 000,001,024 | RH-- | M] () -- C:\Users\Public\Documents\NTIMP3.dll [2012.01.26 00:21:28 | 000,000,083 | ---- | M] () -- C:\Windows\LManager.UNI [2012.01.26 00:09:08 | 000,001,739 | ---- | M] () -- C:\Users\Public\Desktop\Empowering Technology.lnk [2012.01.25 05:05:32 | 000,000,447 | ---- | M] () -- C:\user.js [2012.01.23 16:35:11 | 000,319,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\DIFxAPI.dll [2012.01.21 14:07:17 | 000,002,140 | ---- | M] () -- C:\Users\Public\Desktop\DriverBoost.lnk [2012.01.21 14:01:13 | 000,001,891 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2012.01.07 04:22:10 | 000,053,248 | ---- | M] () -- C:\Users\Olaf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.28 20:42:23 | 000,002,195 | ---- | C] () -- C:\Users\Olaf\Documents\iPhone Aktuelle Informationen.rtf [2012.01.26 23:18:13 | 000,001,668 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.01.26 23:08:34 | 000,001,854 | ---- | C] () -- C:\Users\Public\Desktop\Safari.lnk [2012.01.26 23:08:34 | 000,001,854 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk [2012.01.26 01:56:48 | 000,001,975 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.01.26 01:55:20 | 000,001,094 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.01.26 01:55:20 | 000,001,090 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.01.26 01:22:51 | 000,000,807 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk [2012.01.26 01:02:05 | 000,001,850 | ---- | C] () -- C:\Users\Olaf\Desktop\Cyberlink PowerDirector.lnk [2012.01.26 00:09:26 | 000,487,424 | ---- | C] () -- C:\Windows\System32\INT15.dll [2012.01.26 00:09:08 | 000,001,739 | ---- | C] () -- C:\Users\Public\Desktop\Empowering Technology.lnk [2012.01.25 05:05:31 | 000,000,447 | ---- | C] () -- C:\user.js [2012.01.23 16:35:11 | 000,001,694 | ---- | C] () -- C:\Windows\RtDefLvl.ini [2012.01.21 14:53:06 | 000,000,553 | ---- | C] () -- C:\Windows\USetup.iss [2012.01.21 14:07:17 | 000,002,140 | ---- | C] () -- C:\Users\Public\Desktop\DriverBoost.lnk [2012.01.21 14:01:13 | 000,001,891 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2012.01.21 14:01:13 | 000,001,804 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk [2012.01.04 03:31:43 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat [2012.01.04 03:31:43 | 000,097,961 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat [2011.10.17 02:24:58 | 003,866,704 | -H-- | C] () -- C:\Users\Olaf\AppData\Local\IconCache.db [2011.09.10 17:13:32 | 000,639,224 | ---- | C] () -- C:\Windows\System32\drivers\sptd.sys [2011.07.02 21:22:40 | 000,017,408 | ---- | C] () -- C:\Users\Olaf\AppData\Local\WebpageIcons.db [2011.06.13 14:49:50 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2011.06.13 14:49:49 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat [2011.06.13 14:49:49 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat [2011.06.13 14:49:49 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat [2011.06.13 14:49:49 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat [2011.06.13 14:49:49 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat [2011.06.13 14:49:49 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat [2011.06.13 14:49:49 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat [2011.06.13 14:49:49 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat [2011.06.13 14:49:49 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat [2011.06.13 14:49:49 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat [2011.06.13 14:49:49 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat [2011.06.13 14:49:49 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat [2011.06.13 14:49:49 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat [2011.06.13 14:49:49 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat [2011.06.13 14:49:49 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat [2011.06.13 14:49:49 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat [2011.06.13 14:49:49 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat [2011.06.13 14:49:48 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat [2011.06.13 14:46:41 | 000,000,027 | ---- | C] () -- C:\Windows\CDE DX4000EFDG.ini [2011.04.12 22:01:12 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll [2011.04.12 22:01:12 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini [2011.03.11 12:43:54 | 000,029,763 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat [2011.03.06 17:46:38 | 000,000,812 | ---- | C] () -- C:\Windows\Brpfx04a.ini [2011.03.06 17:46:38 | 000,000,159 | ---- | C] () -- C:\Windows\brpcfx.ini [2011.03.06 17:46:02 | 000,000,050 | ---- | C] () -- C:\Windows\System32\BRIDF10A.DAT [2011.03.06 17:41:55 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini [2011.03.06 17:33:39 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI [2010.10.13 17:28:26 | 000,230,158 | ---- | C] () -- C:\Windows\hpoins46.dat [2010.10.11 20:08:42 | 000,119,478 | ---- | C] () -- C:\Windows\hpqins00.dat [2010.10.11 19:46:51 | 000,146,190 | ---- | C] () -- C:\Windows\hpoins18.dat [2010.10.11 19:46:41 | 000,006,600 | ---- | C] () -- C:\Windows\hpomdl18.dat [2010.10.05 00:59:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\StarOpen.sys [2010.01.29 22:21:20 | 000,000,532 | ---- | C] () -- C:\Windows\hpomdl46.dat [2009.09.28 20:09:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.28 20:09:45 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.28 20:09:22 | 000,368,640 | ---- | C] () -- C:\Windows\System32\msjetoledb40.dll [2009.08.10 18:10:32 | 000,596,896 | ---- | C] () -- C:\Windows\System32\drivers\UDXTTM6010.sys [2009.08.10 17:50:33 | 000,110,080 | ---- | C] () -- C:\Windows\System32\advd.dll [2009.08.10 17:50:32 | 000,023,040 | ---- | C] () -- C:\Windows\System32\auth.dll [2009.08.10 17:50:26 | 000,237,568 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2009.07.19 20:22:41 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2008.12.20 12:08:45 | 000,015,873 | ---- | C] () -- C:\Windows\System32\Inetde.dll [2008.09.07 16:05:17 | 000,008,704 | ---- | C] () -- C:\Windows\System32\BHARegister.dll [2008.08.17 00:25:43 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI [2008.08.14 13:00:20 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.08.05 23:59:14 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat [2008.07.09 18:16:33 | 000,053,248 | ---- | C] () -- C:\Users\Olaf\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.07.08 15:59:51 | 000,000,000 | ---- | C] () -- C:\Users\Olaf\AppData\Roaming\wklnhst.dat [2008.07.07 21:49:51 | 000,132,776 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008.07.07 21:45:21 | 000,132,776 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008.07.07 19:16:32 | 000,000,680 | ---- | C] () -- C:\Users\Olaf\AppData\Local\d3d9caps.dat [2008.07.07 17:18:10 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe [2008.07.07 17:18:10 | 000,000,057 | ---- | C] () -- C:\Windows\PidList.ini [2008.07.07 17:15:07 | 001,548,099 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll [2008.07.07 17:11:07 | 000,109,376 | ---- | C] () -- C:\Users\Olaf\AppData\Local\GDIPFONTCACHEV1.DAT [2008.03.28 20:22:04 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIOFM4.dll [2008.03.28 20:22:04 | 000,001,024 | RH-- | C] () -- C:\Windows\System32\NTIBUN5.dll [2008.03.28 19:29:19 | 000,204,800 | ---- | C] () -- C:\Windows\System32\SysHook.dll [2008.03.28 19:21:05 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2008.03.28 19:19:46 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\RtkHDAud.dat [2008.03.28 11:58:20 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.01.21 08:16:22 | 001,572,964 | ---- | C] () -- C:\Windows\System32\PerfStringBackup.INI [2008.01.21 08:15:58 | 000,676,300 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 08:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 08:15:58 | 000,147,134 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 08:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2008.01.21 03:24:38 | 000,060,124 | ---- | C] () -- C:\Windows\System32\tcpmon.ini [2008.01.21 03:24:13 | 001,868,944 | ---- | C] () -- C:\Windows\System32\RSA32_16.DLL [2007.11.14 14:17:34 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CogentBioSDK.dll [2007.07.23 08:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2007.07.23 08:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2007.07.23 08:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2007.07.23 08:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2007.04.24 18:32:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll [2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:37 | 000,402,288 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 11:33:01 | 000,636,294 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,120,722 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:24:31 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini [2006.11.02 11:23:31 | 000,000,254 | ---- | C] () -- C:\Windows\win.ini [2006.11.02 11:23:31 | 000,000,219 | ---- | C] () -- C:\Windows\system.ini [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.11.02 08:10:37 | 000,053,536 | ---- | C] () -- C:\Windows\System32\dosx.exe [2006.11.02 08:10:02 | 000,000,718 | ---- | C] () -- C:\Windows\System32\mscdexnt.exe [2006.11.02 08:10:00 | 000,002,842 | ---- | C] () -- C:\Windows\System32\redir.exe [2006.11.02 08:09:59 | 000,069,886 | ---- | C] () -- C:\Windows\System32\edit.com [2006.11.02 08:09:59 | 000,019,694 | ---- | C] () -- C:\Windows\System32\GRAPHICS.COM [2006.11.02 08:09:59 | 000,000,882 | ---- | C] () -- C:\Windows\System32\share.exe [2006.11.02 08:09:59 | 000,000,882 | ---- | C] () -- C:\Windows\System32\fastopen.exe [2006.11.02 08:09:57 | 000,014,710 | ---- | C] () -- C:\Windows\System32\KB16.COM [2006.11.02 08:09:56 | 000,007,052 | ---- | C] () -- C:\Windows\System32\nlsfunc.exe [2006.11.02 08:09:55 | 000,039,274 | ---- | C] () -- C:\Windows\System32\mem.exe [2006.11.02 08:09:55 | 000,001,131 | ---- | C] () -- C:\Windows\System32\LOADFIX.COM [2006.11.02 08:09:53 | 000,011,753 | ---- | C] () -- C:\Windows\System32\setver.exe [2006.11.02 08:09:52 | 000,020,634 | ---- | C] () -- C:\Windows\System32\debug.exe [2006.11.02 08:09:51 | 000,008,424 | ---- | C] () -- C:\Windows\System32\exe2bin.exe [2006.11.02 08:09:50 | 000,012,642 | ---- | C] () -- C:\Windows\System32\edlin.exe [2006.11.02 08:09:49 | 000,050,648 | ---- | C] () -- C:\Windows\System32\COMMAND.COM [2006.11.02 08:09:49 | 000,012,498 | ---- | C] () -- C:\Windows\System32\append.exe [2006.11.02 08:09:45 | 000,027,097 | ---- | C] () -- C:\Windows\System32\country.sys [2006.11.02 08:09:44 | 000,042,809 | ---- | C] () -- C:\Windows\System32\KEY01.SYS [2006.11.02 08:09:44 | 000,042,537 | ---- | C] () -- C:\Windows\System32\KEYBOARD.SYS [2006.11.02 08:09:42 | 000,009,029 | ---- | C] () -- C:\Windows\System32\ANSI.SYS [2006.11.02 08:09:41 | 000,004,768 | ---- | C] () -- C:\Windows\System32\HIMEM.SYS [2006.11.02 08:09:40 | 000,029,274 | ---- | C] () -- C:\Windows\System32\NTDOS412.SYS [2006.11.02 08:09:38 | 000,029,370 | ---- | C] () -- C:\Windows\System32\NTDOS411.SYS [2006.11.02 08:09:35 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS404.SYS [2006.11.02 08:09:31 | 000,029,146 | ---- | C] () -- C:\Windows\System32\NTDOS804.SYS [2006.11.02 08:09:29 | 000,027,866 | ---- | C] () -- C:\Windows\System32\NTDOS.SYS [2006.11.02 08:09:26 | 000,035,536 | ---- | C] () -- C:\Windows\System32\NTIO412.SYS [2006.11.02 08:09:24 | 000,035,776 | ---- | C] () -- C:\Windows\System32\NTIO411.SYS [2006.11.02 08:09:23 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO404.SYS [2006.11.02 08:09:22 | 000,034,672 | ---- | C] () -- C:\Windows\System32\NTIO804.SYS [2006.11.02 08:09:20 | 000,033,952 | ---- | C] () -- C:\Windows\System32\NTIO.SYS [2006.11.02 07:25:08 | 000,013,312 | ---- | C] () -- C:\Windows\System32\win87em.dll [2005.12.15 06:17:00 | 000,159,744 | ---- | C] () -- C:\Windows\System32\EPSPTDV.DLL [2001.12.26 16:12:30 | 000,065,536 | ---- | C] () -- C:\Windows\System32\multiplex_vcd.dll [2001.11.14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll [2001.09.03 23:46:38 | 000,110,592 | ---- | C] () -- C:\Windows\System32\Hmpg12.dll [2001.07.30 16:33:56 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC.dll [2001.07.23 22:04:36 | 000,118,784 | ---- | C] () -- C:\Windows\System32\HMPV2_ENC_MMX.dll ========== LOP Check ========== [2011.11.09 01:34:32 | 000,000,000 | -HSD | M] -- C:\Users\Olaf\AppData\Roaming\.# [2011.09.25 12:49:59 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Abelssoft [2008.07.07 17:32:02 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Acer [2008.03.28 19:43:38 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Acer GameZone Console [2011.07.12 17:52:56 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\BOM [2009.08.10 21:03:04 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\concept design [2011.11.16 18:44:17 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Epson [2012.01.26 00:52:43 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\eSobi [2012.01.25 05:15:10 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\eType [2010.10.11 20:44:17 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Image Zone Express [2008.07.07 21:42:21 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Leadertech [2011.09.21 17:59:17 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Need for Speed World [2011.02.03 22:14:12 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\OpenOffice.org [2009.10.07 18:42:07 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Opera [2011.05.09 06:45:25 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\PC-FAX TX [2012.01.07 04:55:12 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\PowerCinema [2010.10.11 20:44:17 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Printer Info Cache [2008.09.18 23:43:46 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\ProtectDisc [2012.01.07 05:24:44 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\SoftDMA [2011.09.27 17:01:39 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Template [2011.11.09 01:11:30 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\TerraTec [2011.02.07 20:48:30 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\TomTom [2012.01.04 05:12:36 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\TuneUp Software [2010.04.27 16:07:51 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Uniblue [2008.07.07 17:14:37 | 000,000,000 | ---D | M] -- C:\Users\Olaf\AppData\Roaming\Validity [2012.02.04 22:36:40 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.10.26 14:13:46 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2009.03.28 21:35:38 | 000,000,000 | ---D | M] -- C:\5c42dfe0388b8e85b89556e203 [2008.07.07 17:37:21 | 000,000,000 | ---D | M] -- C:\ACER [2008.03.28 20:23:59 | 000,000,000 | ---D | M] -- C:\book [2011.10.09 15:58:36 | 000,000,000 | -HSD | M] -- C:\Boot [2008.07.07 17:27:04 | 000,000,000 | ---D | M] -- C:\CLSetup [2008.03.28 19:44:49 | 000,000,000 | ---D | M] -- C:\Convesoft [2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2008.07.07 17:07:32 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.04.12 22:03:14 | 000,000,000 | ---D | M] -- C:\GD880 [2008.03.28 19:12:56 | 000,000,000 | ---D | M] -- C:\Intel [2011.04.12 22:21:41 | 000,000,000 | ---D | M] -- C:\LGMobileUpgrade [2008.03.28 19:45:25 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.10.08 18:40:36 | 000,000,000 | ---D | M] -- C:\PerfLogs [2008.08.12 22:49:30 | 000,000,000 | ---D | M] -- C:\Phenomedia AG [2012.01.28 20:17:00 | 000,000,000 | R--D | M] -- C:\Program Files [2012.01.24 19:59:07 | 000,000,000 | -H-D | M] -- C:\ProgramData [2008.07.07 17:07:32 | 000,000,000 | -HSD | M] -- C:\Programme [2012.01.28 20:17:14 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2008.07.07 17:10:45 | 000,000,000 | R--D | M] -- C:\Users [2012.02.04 22:40:25 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: AGP440.SYS > [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2007.12.06 02:50:20 | 000,086,408 | ---- | M] (Matsushita Electric Industrial Co., Ltd.) MD5=BC48C980BC5BD5C44BA67A840DBD7C83 -- C:\Program Files\Panasonic\HDWRITER\EventLog.dll [2007.01.12 22:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\Cyberlink\PowerDirector\EventLog.dll < MD5 for: EXPLORER.EXE > [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTOR.SYS > [2007.09.29 22:03:32 | 000,384,024 | ---- | M] (Intel Corporation) MD5=16A4671255CFB842225F0FDB6DBDB414 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys [2007.09.29 21:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\System32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll [2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2011.09.10 17:13:32 | 000,639,224 | ---- | M] () Unable to obtain MD5 -- C:\Windows\system32\drivers\sptd.sys < %systemroot%\System32\config\*.sav > [2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\system32\*.dll /lockedfiles > < %USERPROFILE%\*.* > [2012.02.04 23:08:02 | 003,407,872 | ---- | M] () -- C:\Users\Olaf\ntuser.dat [2012.02.04 23:08:02 | 000,262,144 | -H-- | M] () -- C:\Users\Olaf\ntuser.dat.LOG1 [2008.07.07 17:10:45 | 000,000,000 | -H-- | M] () -- C:\Users\Olaf\ntuser.dat.LOG2 [2012.01.04 05:41:19 | 000,000,000 | -H-- | M] () -- C:\Users\Olaf\NTUSER.DAT_tureg_new.LOG1 [2012.01.04 05:41:19 | 000,000,000 | -H-- | M] () -- C:\Users\Olaf\NTUSER.DAT_tureg_new.LOG2 [2012.01.04 05:41:29 | 003,407,872 | ---- | M] () -- C:\Users\Olaf\NTUSER.DAT_tureg_old [2009.07.27 20:38:36 | 000,065,536 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2009.07.27 20:38:36 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2008.07.07 17:34:37 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms [2012.01.04 05:41:28 | 000,065,536 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{7907de8a-0cb2-11e1-90e4-001de0a17afd}.TM.blf [2012.01.04 05:41:28 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{7907de8a-0cb2-11e1-90e4-001de0a17afd}.TMContainer00000000000000000001.regtrans-ms [2011.11.11 23:27:54 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{7907de8a-0cb2-11e1-90e4-001de0a17afd}.TMContainer00000000000000000002.regtrans-ms [2011.11.10 20:47:44 | 000,065,536 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{a907df76-7ad7-11de-8895-00a0d1a4baf1}.TM.blf [2011.11.10 20:47:44 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{a907df76-7ad7-11de-8895-00a0d1a4baf1}.TMContainer00000000000000000001.regtrans-ms [2009.07.27 20:51:27 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\NTUSER.DAT{a907df76-7ad7-11de-8895-00a0d1a4baf1}.TMContainer00000000000000000002.regtrans-ms [2012.02.04 22:36:42 | 000,065,536 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{d953a778-368d-11e1-be6e-806e6f6e6963}.TM.blf [2012.02.04 22:36:42 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{d953a778-368d-11e1-be6e-806e6f6e6963}.TMContainer00000000000000000001.regtrans-ms [2012.01.04 05:47:32 | 000,524,288 | -HS- | M] () -- C:\Users\Olaf\ntuser.dat{d953a778-368d-11e1-be6e-806e6f6e6963}.TMContainer00000000000000000002.regtrans-ms [2008.07.07 17:10:46 | 000,000,020 | -HS- | M] () -- C:\Users\Olaf\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 ========== Alternate Data Streams ========== @Alternate Data Stream - 88 bytes -> C:\Users\Olaf\Documents\~$ckblatt für Stundenzettel.doc:SummaryInformation @Alternate Data Stream - 88 bytes -> C:\Users\Olaf\Documents\~$ckblatt für Stundenzettel.doc:DocumentSummaryInformation < End of report > |
|
05.02.2012, 11:48
| #2 |
| /// Malware-holic   | windows securitycenter pc gesperrt- 32-bit Vista home auf laptop hi
__________________dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [vasja] C:\Users\Olaf\AppData\Local\Temp\0.37016726452194815.exe (Orb Networks)
:Files
C:\Users\Olaf\AppData\Local\Temp\0.37016726452194815.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Drücke bitte die  + E Taste.
__________________ |
|
| Themen zu windows securitycenter pc gesperrt- 32-bit Vista home auf laptop |
| alternate, autorun, avira, avp.exe, bho, bonjour, conduit, desktop, document, dringend, error, excel.exe, firefox, format, google, helper, home, incredibar toolbar, incredibar.com, installation, kaspersky, launch, logfile, m.exe, montera, nvstor.sys, object, plug-in, problem, realtek, registry, required, scan, studio, tastatur, trojaner, version=1.0, vista, windows |
Linear-Darstellung
