| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Achtung ihr computer wurde gesperrt .Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.03.2012, 20:38
| #1 |
| |  Achtung ihr computer wurde gesperrt . hi ich bin neu hier und ich habe ein Problem. Denn eines der Benutzerkonten auf meinem Laptop wurde von Malware befallen. Einen OTL-Scan hab ich bereits durchgeführt hier sind die Daten OTL.txt: 3.86 Gb Total Physical Memory | 2.72 Gb Available Physical Memory | 70.46% Memory free 7.73 Gb Paging File | 6.45 Gb Available in Paging File | 83.47% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 200.00 Gb Total Space | 41.45 Gb Free Space | 20.72% Space Free | Partition Type: NTFS Drive D: | 263.76 Gb Total Space | 164.37 Gb Free Space | 62.32% Space Free | Partition Type: NTFS Computer Name: MARK-PC | User Name: Mark | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Gast\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashUtil11e_ActiveX.exe (Adobe Systems, Inc.) PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc) PRC - C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Program Files (x86)\Microsoft\BingBar\BingBar.exe (Microsoft Corporation.) PRC - C:\Program Files (x86)\Microsoft\BingBar\BingApp.exe (Microsoft Corporation.) PRC - C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) PRC - C:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe (Fujitsu Technology Solutions) PRC - C:\Program Files (x86)\Fujitsu\AIS Connect\bin\AISMessageForYou.exe (Fujitsu) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED) PRC - C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) PRC - C:\Program Files (x86)\Fujitsu\AIS Connect\bin\qsaMain.exe () ========== Modules (No Company Name) ========== MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\log4net\7f0da5178097cca95ea5d1f5beb84a42\log4net.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\DeskUpdateNotifier\ce50484dcb41f5ccdb4190b16a1ae937\DeskUpdateNotifier.ni.exe () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6c51e152e7404188914c9fa4d8503ff9\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ab87129c2b603f218e4aa5300c9b1bdd\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\9866d1f6178e1cde25642f1ac293ff8d\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\e620323cacb5b6bfd93fd28d263440e4\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\faf4e8730ecbd07570111bb7c3b20565\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll () MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation) SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV:64bit: - (PowerSavingUtilityService) -- C:\Program Files\Fujitsu\PSUtility\PSUService.exe (FUJITSU LIMITED) SRV:64bit: - (WirelessSelectorService) -- C:\Program Files\Fujitsu\WirelessSelector\WSUService.exe () SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation.) SRV - (SeaPort) -- C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corporation) SRV - (TestHandler) -- C:\Program Files (x86)\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe (Fujitsu Technology Solutions) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (UNS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (AISConnect) -- C:\Program Files (x86)\Fujitsu\AIS Connect\bin\qsaMain.exe () ========== Driver Services (SafeList) ========== DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (ANDModem) -- C:\Windows\SysNative\drivers\lgandmodem64.sys (LG Electronics Inc.) DRV:64bit: - (AndDiag) -- C:\Windows\SysNative\drivers\lganddiag64.sys (LG Electronics Inc.) DRV:64bit: - (AndGps) -- C:\Windows\SysNative\drivers\lgandgps64.sys (LG Electronics Inc.) DRV:64bit: - (Andbus) -- C:\Windows\SysNative\drivers\lgandbus64.sys (LG Electronics Inc.) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.) DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.) DRV:64bit: - (HECIx64) Intel(R) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation) DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (AtiPcie) AMD PCI Express (3GIO) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.) DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.) DRV:64bit: - (FUJ02E3) -- C:\Windows\SysNative\drivers\fuj02e3.sys (FUJITSU LIMITED) DRV:64bit: - (FUJ02B1) -- C:\Windows\SysNative\drivers\fuj02b1.sys (FUJITSU LIMITED) DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {664C29FB-9108-4800-8088-5D6CA14EAC1F} IE:64bit: - HKLM\..\SearchScopes\{664C29FB-9108-4800-8088-5D6CA14EAC1F}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {C616DB15-E18D-4946-A5E9-63828EFC5DE8} IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKLM\..\SearchScopes\{C616DB15-E18D-4946-A5E9-63828EFC5DE8}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ts.fujitsu.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes] IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.msn.com/?rd=1&ucc=DE&dcc=DE&opt=0 IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes,DefaultScope = {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=CCS&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=&apn_uid=4AD557DE-0E8A-4741-BC4C-59005612EA2B&apn_sauid=766FE6EF-5EC1-428A-979F-92B7CD2B63A0 IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{514390A7-7DE6-4F7D-9B52-8C5BE7D21DFB}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=2B91DF5B-2A6D-486E-9BB1-51EFE9AE910F&apn_sauid=A59A069B-2ECD-493F-8697-78266DF31165& IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{63A09FF7-D915-4F0D-A46C-79A5B6301ED2}: "URL" = hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{795C0E7B-C3B9-43E6-8275-E1F7EAF1269F}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=827316&p={searchTerms} IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=169&systemid=406&sr=0&q={searchTerms} IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{C616DB15-E18D-4946-A5E9-63828EFC5DE8}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF_deDE440DE440 IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKU\S-1-5-21-1833198258-815051299-995906538-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ts.fujitsu.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes] IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ts.fujitsu.com IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\..\SearchScopes,DefaultScope = {C616DB15-E18D-4946-A5E9-63828EFC5DE8} IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\..\SearchScopes\{C616DB15-E18D-4946-A5E9-63828EFC5DE8}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7FTSF IE - HKU\S-1-5-21-1833198258-815051299-995906538-501\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316" FF - prefs.js..browser.search.selectedEngine: "Search Results" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.searchqu.com/406" FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=169&systemid=406&sr=0&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "SweetIM Search" FF - prefs.js..browser.startup.homepage: "hxxp://home.sweetim.com" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "" FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011/11/06 14:50:16 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/08 00:11:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/01/11 15:24:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/07/17 07:51:23 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 5.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2012/01/11 15:24:14 | 000,000,000 | ---D | M] [2012/01/22 19:11:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mark\AppData\Roaming\mozilla\Extensions [2012/03/15 06:29:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions [2012/01/22 19:10:59 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} [2011/07/20 22:39:00 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011/08/27 15:00:32 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847} [2012/03/15 06:29:44 | 000,000,000 | ---D | M] (Default Manager) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions\DefaultManager@Microsoft [2012/03/08 20:16:17 | 000,000,000 | ---D | M] (Quick Media Converter Ask Toolbar) -- C:\Users\Mark\AppData\Roaming\mozilla\Firefox\Profiles\12db9r8z.default\extensions\toolbar@ask.com [2010/09/28 22:39:14 | 000,002,333 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\askcom.xml [2011/08/14 13:55:16 | 000,000,931 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\conduit.xml [2011/07/30 22:03:07 | 000,002,055 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\daemon-search.xml [2011/11/19 12:37:18 | 000,005,604 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\Linkury Smartbar Search.xml [2011/09/20 19:52:37 | 000,002,506 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\SearchResults.xml [2012/01/22 19:10:57 | 000,002,519 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\Search_Results.xml [2011/08/27 15:00:51 | 000,003,915 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\SweetIM Search.xml [2011/08/27 15:00:30 | 000,003,915 | ---- | M] () -- C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\12db9r8z.default\searchplugins\sweetim.xml [2012/01/22 19:11:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012/03/22 17:45:28 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011/10/24 16:52:02 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2012/01/22 19:11:01 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES (X86)\WINDOWS ILIVID TOOLBAR\DATAMNGR\FIREFOXEXTENSION [2012/01/08 00:11:33 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011/10/16 15:53:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2011/10/16 15:53:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2011/10/16 15:53:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2011/10/16 15:53:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011/09/20 19:52:37 | 000,002,506 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml [2012/01/22 19:10:57 | 000,002,519 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml [2011/10/16 15:53:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2011/10/16 15:53:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009/06/10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc) O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll File not found O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Quick Media Converter Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll File not found O3 - HKLM\..\Toolbar: (Quick Media Converter Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll File not found O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3:64bit: - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\S-1-5-21-1833198258-815051299-995906538-1001\..\Toolbar\WebBrowser: (Quick Media Converter Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKU\S-1-5-21-1833198258-815051299-995906538-501\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) O3 - HKU\S-1-5-21-1833198258-815051299-995906538-501\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1833198258-815051299-995906538-501\..\Toolbar\WebBrowser: (Quick Media Converter Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4:64bit: - HKLM..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\Application Panel\BtnHnd.exe (FUJITSU LIMITED) O4:64bit: - HKLM..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe (FUJITSU LIMITED) O4:64bit: - HKLM..\Run: [PSUTility] C:\Program Files\Fujitsu\PSUtility\TrayManager.exe (FUJITSU LIMITED) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [4StoryPrePatch] C:\Program Files (x86)\Gameforge4D\4Story_DE\PrePatch.exe File not found O4 - HKLM..\Run: [AIS_MessageForYou] C:\Program Files (x86)\Fujitsu\AIS Connect\bin\AISMessageForYou.exe (Fujitsu) O4 - HKLM..\Run: [B2C_AGENT] C:\ProgramData\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe (LG Electronics) O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc) O4 - HKLM..\Run: [DeskUpdateNotifier] c:\Fujitsu\Programs\DeskUpdate\DeskUpdateNotifier.exe (Fujitsu Technology Solutions) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [IndicatorUtility] C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LoadFUJ02E3] C:\Program Files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe (FUJITSU LIMITED) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe File not found O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1833198258-815051299-995906538-1001..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKU\S-1-5-21-1833198258-815051299-995906538-1001..\Run: [EA Core] "C:\Users\Mark\EADM\Core.exe" -silent File not found O4 - HKU\S-1-5-21-1833198258-815051299-995906538-1001..\Run: [SkypePM] C:\Users\Mark\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-1833198258-815051299-995906538-1001..\Run: [Steam] C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk = C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk = C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk = C:\Program Files (x86)\Fujitsu\LaunchCenter\LaunchCenter.exe (Fujitsu Technology Solutions) O4 - Startup: C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Mark\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Mark\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{436A6F0F-B16D-4D96-A214-3FD2C8F5FA70}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FE639678-BDAF-4903-802D-7C26321D90BE}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll (Bandoo Media, inc) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll) - C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll) - C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll (Bandoo Media, inc) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{1e25d49d-afc6-11e0-9404-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{1e25d49d-afc6-11e0-9404-806e6f6e6963}\Shell\AutoRun\command - "" = F:\autorun.exe O33 - MountPoints2\{c6ece840-e78b-11e0-be88-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{c6ece840-e78b-11e0-be88-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe O33 - MountPoints2\{c6ece989-e78b-11e0-be88-4cedde8afcdb}\Shell - "" = AutoRun O33 - MountPoints2\{c6ece989-e78b-11e0-be88-4cedde8afcdb}\Shell\AutoRun\command - "" = E:\setup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012/03/22 19:55:29 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{E8DE86AC-06FF-4A57-ADDF-3327035EA612} [2012/03/22 19:55:17 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{3CA064AA-B32B-4E5A-9CD0-8B8701B34FF0} [2012/03/22 17:45:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012/03/22 17:45:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012/03/22 06:23:38 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{49D30AEF-5395-4277-A166-FCDA066BE838} [2012/03/22 06:23:16 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{479A89A5-8B77-4BDC-B4A1-C3949E8DA9D1} [2012/03/21 16:19:28 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{A015C090-5EE7-4F3D-B9DA-61BBB395E10F} [2012/03/21 16:19:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{7935E58F-86A5-458E-AE06-4B141D468F00} [2012/03/21 14:03:58 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{80AC7C99-B369-4D77-9D45-F7342A8D0197} [2012/03/21 06:32:45 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{C04197DF-099E-4B3F-8215-36D8E12CAA48} [2012/03/20 22:19:16 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{69F51025-925D-4D2A-9F3F-16EC52FF7DD4} [2012/03/20 22:18:54 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{2612CC5D-DD36-4B06-B60A-11903592D220} [2012/03/20 20:48:08 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{A222FA46-10E2-42F0-A323-672AA30BC901} [2012/03/20 17:09:21 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{AF1DC35A-55A4-4E2F-B860-F3540F7DEE47} [2012/03/20 15:32:07 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{CDD7D0EC-962B-40E9-95E3-86141F363157} [2012/03/19 18:04:51 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{01B1FCE5-8E5A-4EF1-8459-37DD0CE5AEB3} [2012/03/19 18:04:28 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{2604B723-A284-49C6-B036-0DE665F46547} [2012/03/18 15:35:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{86EFF965-E9F6-4904-8E93-39DAEE96B16B} [2012/03/18 13:24:39 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{3EEA181D-B5A1-4961-A3CF-BE7FB214E19F} [2012/03/17 18:26:36 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{054E2C87-EBCB-40F2-ABAF-D8EC90323066} [2012/03/17 18:26:25 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{812A5131-0700-4447-9B3F-A8D667F45E80} [2012/03/15 22:07:31 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{2C997154-6AAD-4E2C-8587-433B23B83EEF} [2012/03/15 22:07:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{7EAE0C9A-1222-4B1F-B508-BBD4F4D95B45} [2012/03/15 22:01:25 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{C933ACC3-ABF7-4F0C-B3CE-EB5A47F983CE} [2012/03/15 21:07:30 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{8876FD01-8658-4F62-90B9-622CFF5DA651} [2012/03/15 16:32:17 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Ein Grund zu Kämpfen [2012/03/15 06:29:17 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{A5873CDC-96D4-4810-BD07-686AD2FB9ECB} [2012/03/15 06:29:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{9405C795-688E-4293-9C44-6B1213554F7D} [2012/03/15 06:29:05 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{60C4F91B-F82B-4CEB-A6C9-8BFAC20CC758} [2012/03/14 06:44:20 | 005,559,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2012/03/14 06:44:19 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2012/03/14 06:44:19 | 003,913,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2012/03/14 06:30:10 | 001,544,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2012/03/14 06:24:18 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{9816A94A-C16B-445E-83EB-EA732CA5CA60} [2012/03/13 19:49:13 | 001,031,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcore.dll [2012/03/13 19:49:13 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdpcore.dll [2012/03/13 19:49:12 | 000,149,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpcorekmts.dll [2012/03/13 19:49:12 | 000,077,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdpwsx.dll [2012/03/13 19:49:12 | 000,009,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdrmemptylst.exe [2012/03/13 17:33:58 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{E8C6C2F1-0767-4B33-8FAC-4F2CF91980F7} [2012/03/12 21:57:49 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{E34422F2-11B1-4AC3-AC05-90CB4220ECDD} [2012/03/12 21:57:38 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{18F599B6-3F63-423E-9BEA-648792092AAE} [2012/03/12 12:39:52 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{C6B5E155-2DBC-4062-9B8B-75838325D3C0} [2012/03/12 09:13:34 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{84945DB4-E248-4660-BB08-445A79B02872} [2012/03/12 08:18:10 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{1C35783C-A817-4CE8-B502-28B07D9E5F66} [2012/03/11 13:26:04 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{763B2FD6-BDB5-418D-BFC0-AC0C639F9B38} [2012/03/11 13:25:52 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{F7E2EE9A-3F4B-42CE-B1F7-346D856C9DC6} [2012/03/10 17:01:38 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Rise Against [2012/03/10 17:00:26 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Rap [2012/03/10 14:59:49 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{CE8E8B05-34FB-45F8-827C-4AA7DEC22A7B} [2012/03/10 14:59:31 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{17AC743B-6822-4CD8-9E1D-BCA049DEC2A0} [2012/03/09 18:09:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{BB327397-C5AE-47BD-8E30-D5E81C97107B} [2012/03/09 18:09:01 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{9EC71952-3359-4C58-BFD1-4B6AF60DA449} [2012/03/09 15:53:26 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{A7F8897E-4EDF-4787-82DD-5D7D0D21C3F8} [2012/03/09 15:53:04 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{617DCDD5-364E-4E33-B024-66ECB1BBF349} [2012/03/09 13:41:28 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{581BEFB5-6E90-4879-9BD1-31560E7DE425} [2012/03/09 13:24:08 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{DB71FBC5-20B7-479E-BCA7-9D51E3463F27} [2012/03/09 11:27:06 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\WMTools Downloaded Files [2012/03/09 11:25:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Movie Maker 2.6 [2012/03/09 10:53:50 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{AC36E247-6F15-4191-8DD9-0B45AD4CEE67} [2012/03/09 06:38:21 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Wat [2012/03/09 06:38:21 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Wat [2012/03/09 06:28:36 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\{C70A1C78-F354-416D-8E04-A56DC51B1B22} [2012/03/08 20:37:25 | 000,000,000 | ---D | C] -- C:\Windows\de [2012/03/08 20:23:33 | 000,048,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\fssfltr.sys [2012/03/08 20:23:33 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE [2012/03/08 20:22:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2012/03/08 20:21:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012/03/08 20:20:21 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\Windows Live [2012/03/08 20:16:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickMediaConverter [2012/03/08 20:16:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com [2012/03/08 20:16:07 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\Cocoon Software [2012/03/08 20:16:03 | 000,000,000 | ---D | C] -- C:\Program Files\QuickMediaConverter [2012/03/08 20:15:57 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Local\WDSetup [2012/03/06 17:54:24 | 000,000,000 | ---D | C] -- C:\Users\Mark\Desktop\Mass Effect 3 [2012/03/05 17:58:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge [2012/03/05 17:58:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gameforge [2012/03/03 19:58:20 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core [2012/03/03 19:24:02 | 000,000,000 | ---D | C] -- C:\Users\Mark\Documents\BioWare [2012/03/03 19:01:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dragon Age 2 [2012/03/03 19:01:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\BioWare [2012/03/02 22:04:34 | 000,000,000 | ---D | C] -- C:\Users\Mark\AppData\Roaming\RotMG.Production [2012/03/01 15:25:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2012/03/01 15:25:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LogMeIn Hamachi ========== Files - Modified Within 30 Days ========== [2012/03/22 20:12:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/03/22 20:12:53 | 000,009,696 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/03/22 20:05:13 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/03/22 20:05:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/03/22 20:04:53 | 3111,567,360 | -HS- | M] () -- C:\hiberfil.sys [2012/03/22 19:59:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/03/22 17:45:18 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012/03/14 16:26:11 | 000,018,724 | ---- | M] () -- C:\Users\Mark\Desktop\9h6id5.jpg [2012/03/14 14:20:45 | 000,289,296 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012/03/12 22:48:32 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012/03/12 22:48:32 | 000,697,082 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012/03/12 22:48:32 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012/03/12 22:48:32 | 000,148,346 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012/03/12 22:48:32 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012/03/12 10:32:54 | 000,388,608 | ---- | M] () -- C:\Users\Mark\Desktop\Unbenannt.MSWMM [2012/03/12 10:31:30 | 000,007,680 | ---- | M] () -- C:\Users\Mark\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/03/09 11:24:54 | 007,365,120 | ---- | M] () -- C:\Users\Mark\Desktop\MM26_GER.msi [2012/03/08 20:16:14 | 000,000,956 | ---- | M] () -- C:\Users\Public\Desktop\Quick Media Converter.lnk [2012/03/08 19:30:13 | 000,009,243 | ---- | M] () -- C:\Users\Mark\Desktop\redox.odt [2012/03/08 19:06:45 | 000,014,172 | ---- | M] () -- C:\Users\Mark\Desktop\Chemie.odt [2012/03/08 18:51:43 | 000,549,860 | ---- | M] () -- C:\Users\Mark\Desktop\2.jpg [2012/03/05 17:58:36 | 000,002,219 | ---- | M] () -- C:\Users\Public\Desktop\AION Free-To-Play.lnk [2012/03/02 22:04:08 | 000,000,222 | ---- | M] () -- C:\Users\Mark\Desktop\Realm of the Mad God.url [2012/03/01 15:25:24 | 000,000,932 | ---- | M] () -- C:\Users\Public\Desktop\LogMeIn Hamachi.lnk ========== Files Created - No Company Name ========== [2012/03/14 16:26:18 | 000,018,724 | ---- | C] () -- C:\Users\Mark\Desktop\9h6id5.jpg [2012/03/11 19:46:18 | 000,388,608 | ---- | C] () -- C:\Users\Mark\Desktop\Unbenannt.MSWMM [2012/03/09 11:59:31 | 000,007,680 | ---- | C] () -- C:\Users\Mark\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012/03/09 11:25:47 | 000,002,507 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker 2.6.lnk [2012/03/09 11:24:41 | 007,365,120 | ---- | C] () -- C:\Users\Mark\Desktop\MM26_GER.msi [2012/03/08 20:33:06 | 000,001,311 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012/03/08 20:31:15 | 000,001,380 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012/03/08 20:28:51 | 000,001,464 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2012/03/08 20:27:50 | 000,002,492 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2012/03/08 20:16:14 | 000,000,956 | ---- | C] () -- C:\Users\Public\Desktop\Quick Media Converter.lnk [2012/03/08 19:30:12 | 000,009,243 | ---- | C] () -- C:\Users\Mark\Desktop\redox.odt [2012/03/08 19:06:43 | 000,014,172 | ---- | C] () -- C:\Users\Mark\Desktop\Chemie.odt [2012/03/08 18:51:43 | 000,549,860 | ---- | C] () -- C:\Users\Mark\Desktop\2.jpg [2012/03/05 17:58:36 | 000,002,219 | ---- | C] () -- C:\Users\Public\Desktop\AION Free-To-Play.lnk [2012/03/02 22:04:08 | 000,000,222 | ---- | C] () -- C:\Users\Mark\Desktop\Realm of the Mad God.url [2012/02/22 23:00:23 | 001,356,624 | ---- | C] () -- C:\Users\Mark\Desktop\Unbenannt 1 (2).odp [2011/11/20 14:58:13 | 000,053,248 | ---- | C] () -- C:\Windows\SysWow64\CommonDL.dll [2011/11/20 14:58:13 | 000,002,413 | ---- | C] () -- C:\Windows\SysWow64\lgAxconfig.ini [2011/10/06 21:44:05 | 000,099,548 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat [2011/09/28 17:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat [2011/07/28 15:38:56 | 001,591,234 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011/07/23 16:39:27 | 000,000,000 | ---- | C] () -- C:\Users\Mark\AppData\Local\{7A946740-DEB4-4270-A7C3-CBC130D63BC0} [2011/07/22 21:04:22 | 000,000,000 | ---- | C] () -- C:\Users\Mark\AppData\Local\{E25CC63D-E0FD-48E8-BE78-8664344B4ED2} [2011/07/16 17:12:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011/06/21 16:06:06 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2012/03/09 06:36:27 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\AIS Connect [2012/03/09 10:43:01 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Cocoon Software [2012/02/06 21:26:39 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\.minecraft [2011/08/12 17:43:40 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\AIS Connect [2011/09/20 19:53:14 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Bandoo [2012/03/08 20:16:07 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Cocoon Software [2011/12/22 21:18:11 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant [2012/01/26 19:22:18 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\DAEMON Tools Lite [2012/03/09 10:58:48 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\DVDVideoSoft [2011/07/20 22:38:59 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\DVDVideoSoftIEHelpers [2011/08/27 19:07:02 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Leadertech [2011/08/17 21:27:50 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\LolClient [2011/11/19 12:36:17 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\OpenCandy [2011/07/17 07:27:57 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\OpenOffice.org [2011/07/21 00:48:05 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Origin [2012/03/02 22:04:34 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\RotMG.Production [2011/08/03 14:21:55 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\SEGA Corporation [2011/07/20 16:25:14 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Thunderbird [2011/10/13 20:47:14 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\TS3Client [2011/10/10 13:28:34 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\ts3overlay [2012/01/03 22:37:01 | 000,000,000 | ---D | M] -- C:\Users\Mark\AppData\Roaming\Ubisoft [2012/03/21 06:01:53 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== und hier ist die Extra Logfile: OTL Extras logfile created on: 3/22/2012 8:22:50 PM - Run 2 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\Gast\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.86 Gb Total Physical Memory | 2.72 Gb Available Physical Memory | 70.46% Memory free 7.73 Gb Paging File | 6.45 Gb Available in Paging File | 83.47% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 200.00 Gb Total Space | 41.45 Gb Free Space | 20.72% Space Free | Partition Type: NTFS Drive D: | 263.76 Gb Total Space | 164.37 Gb Free Space | 62.32% Space Free | Partition Type: NTFS Computer Name: MARK-PC | User Name: Mark | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found [HKEY_USERS\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" http [open] -- Reg Error: Key error. https [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP640_series" = Canon MP640 series MP Drivers "{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety "{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector "{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{51692C66-5505-41B8-92A7-548C69FB867C}" = Wireless Selector "{5633497C-9D4F-847D-0CBC-120FE63AC71C}" = ccc-utility64 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel "{7254349B-460B-488F-B4DB-A96100C5C48B}" = Power Saving Utility "{8877487B-50A1-5629-093F-DD2FE43ECA3C}" = ATI Catalyst Install Manager "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety "{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources "{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources "{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter "{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client "{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service "{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility "{EC314CDF-3521-482B-A21C-65AC95664814}" = Fujitsu MobilityCenter Extension Utility "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX 64-bit "CCleaner" = CCleaner "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack "SynTPDeinstKey" = Synaptics Pointing Device Driver [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator "{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{06C19FF4-1117-1C23-E513-68CD22C83340}" = CCC Help French "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{13DA4FDF-2714-9E95-C096-48ABEC308CD3}" = ccc-core-static "{173B24B7-D682-DF0E-0BF7-7FFC41505D3B}" = CCC Help Portuguese "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1 "{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger "{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{220F7FC9-7E80-4920-9579-81D88A57FA6C}" = Catalyst Control Center - Branding "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 29 "{2A3A4BD6-6CE0-4E2A-80D2-1D0FF6ACBFBA}" = LG United Mobile Driver "{2DDC57D4-594D-4F30-8D81-27FDB2243644}_is1" = Deus EX Human Revolution Version v1.1 "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar "{456C12A5-B6D6-342E-39BE-48B45A865A51}" = CCC Help Japanese "{46A28DBB-6784-A5F4-0107-1AE13EE75A0E}" = CCC Help Norwegian "{47DD8D29-E32D-B1D3-464F-076F7C6A3AF1}" = CCC Help Russian "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync "{5B3523BD-FB03-1B42-88DC-0414EA6981A7}" = CCC Help Korean "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{669D41B0-07AA-6963-E82C-D003C2656E3F}" = CCC Help Greek "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{76CF32EE-8EB7-9FEC-1CA9-9F95DBBB4AF5}" = CCC Help Italian "{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core "{78DC5634-DB02-7AC4-A642-BE19342BAE80}" = CCC Help Thai "{80B0B731-5FAE-475D-8844-20F46373780D}" = SystemDiagnostics "{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends "{91F1C40C-04BE-22D1-9D20-A3073B6C39F0}" = CCC Help Dutch "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9B5B7D0E-62FD-56EE-03C4-7E32C6151F1F}" = CCC Help Chinese Standard "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail "{A1194237-547A-461d-BD44-B97B1574A7DA}" = SweetIM Toolbar for Internet Explorer 4.1 "{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer "{A81A974F-8A22-43E6-9243-5198FF758DA1}" = SweetIM for Messenger 3.6 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch "{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail "{B1E035A6-F03E-426F-82F0-BAC56FF873DC}" = AIS Connect "{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6 "{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070 "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call "{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility "{C12C8B9C-D80B-12DC-14A0-D4C969A25430}" = CCC Help Finnish "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C52F48D1-E719-8F33-FB14-21312C24B445}" = Catalyst Control Center Localization All "{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections "{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX "{CB3C31E5-7F13-F970-D5E6-D4C8DF7B3D01}" = CCC Help Swedish "{CDC037BF-E428-E57D-0117-8AB97CED4BF6}" = CCC Help Turkish "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64 "{D0FF774C-0B91-67EF-0CC7-5196D00DFEFD}" = CCC Help English "{D13347CD-B657-0824-5808-7E96984CD89D}" = Catalyst Control Center InstallProxy "{D37FE0E3-B1A9-4E41-AB5D-DA62E04D2C42}" = Alpha Protocol "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D74BD8A8-6EBC-D5ED-242C-A06CB3E98500}" = CCC Help German "{DD66089A-F868-B0F2-0390-C49606A474AF}" = Catalyst Control Center Graphics Previews Vista "{DE515AE2-690C-5F39-707B-A180CF3F67FE}" = CCC Help Hungarian "{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh "{DFC161B9-13DD-B0E0-A2FE-212736B4A2F0}" = CCC Help Polish "{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2 "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E1845F1C-068C-F8F4-D31D-D3540D47C453}" = Adobe Download Assistant "{E2494AD8-314D-44F8-B39C-4358A60DC184}" = LogMeIn Hamachi "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger "{E6098043-1183-4580-89EF-423CBF807188}" = pdfforge Toolbar v4.6 "{EAA783DE-2EF3-A422-1CBA-5E0FA3C8111C}" = CCC Help Danish "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8 "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F112F66E-25CA-42DD-983C-6118EB38F606}" = Microsoft Games for Windows - LIVE "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F204734A-5030-8B1A-8890-7AC0816606AF}" = CCC Help Spanish "{F2E23139-3404-4E3C-9855-7724415D62A5}" = Dragon Age II "{F3C33609-31A4-52DA-6EB1-E24892EB5970}" = CCC Help Czech "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FBD8BABD-CBBF-4E1D-C3B2-6DBD2A08C0CD}" = CCC Help Chinese Traditional "{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR "Adobe AIR" = Adobe AIR "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "AIS Connect" = AIS Connect "com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant "DAEMON Tools Lite" = DAEMON Tools Lite "DeskUpdate_is1" = DeskUpdate 4.11 "DivX Setup" = DivX-Setup "DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.8.815 "InstallShield_{51692C66-5505-41B8-92A7-548C69FB867C}" = Wireless Selector "InstallShield_{6226477E-444F-4DFE-BA19-9F4F7D4565BC}" = LifeBook Application Panel "InstallShield_{6A9EF6CF-7630-4E33-AE22-7D70F3AF4B05}" = AION Free-To-Play "InstallShield_{7254349B-460B-488F-B4DB-A96100C5C48B}" = Power Saving Utility "InstallShield_{BA0CC975-682B-4678-A35C-05E607F36387}" = Fujitsu Hotkey Utility "InstallShield_{E8A5B78F-4456-4511-AB3D-E7BFFB974A7A}" = Fujitsu System Extension Utility "InstallShield_{EC314CDF-3521-482B-A21C-65AC95664814}" = Fujitsu MobilityCenter Extension Utility "LogMeIn Hamachi" = LogMeIn Hamachi "LOLReplay" = LOLReplay "Minecraft Cracked" = Minecraft Cracked "Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de) "Mozilla Thunderbird (5.0)" = Mozilla Thunderbird (5.0) "NCLauncher_GameForge" = NC Launcher (GameForge) "Origin" = Origin "StarCraft II" = StarCraft II "Steam App 200210" = Realm of the Mad God "Steam App 20570" = Warhammer® 40,000™: Dawn of War® II – Chaos Rising™ "Steam App 56400" = Warhammer® 40,000®: Dawn of War® II – Retribution™ "Steam App 6370" = Bloodline Champions "VLC media player" = VLC media player 1.1.11 "Windows Searchqu Toolbar" = Windows iLivid Toolbar "WinLiveSuite" = Windows Live Essentials "WinRAR archiver" = WinRAR 4.01 (32-Bit) ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1833198258-815051299-995906538-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "QUICKMEDIACONVERTER" = Quick Media Converter "TeamSpeak 3 Client" = TeamSpeak 3 Client ========== Last 10 Event Log Errors ========== Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt! < End of report > |
|
22.03.2012, 20:44
| #2 |
| /// Malware-holic   | Achtung ihr computer wurde gesperrt . hi
__________________dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKU\S-1-5-21-1833198258-815051299-995906538-1001..\Run: [SkypePM] C:\Users\Mark\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
:Files
C:\Users\Mark\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
__________________ |
|
22.03.2012, 21:46
| #3 |
| | Achtung ihr computer wurde gesperrt . All processes killed
__________________========== OTL ========== Registry value HKEY_USERS\S-1-5-21-1833198258-815051299-995906538-1001\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM not found. File C:\Users\Mark\AppData\Local\Skype\SkypePM.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Gast ->Flash cache emptied: 0 bytes User: Journal User: Mark ->Flash cache emptied: 0 bytes User: Public User: RegBack User: systemprofile User: TxR Total Flash Files Cleaned = 0.00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Gast ->Temp folder emptied: 16384 bytes ->Temporary Internet Files folder emptied: 2346324 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Journal User: Mark ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 2502472521 bytes ->Java cache emptied: 1716609 bytes ->FireFox cache emptied: 56174215 bytes ->Flash cache emptied: 0 bytes User: Public User: RegBack User: systemprofile User: TxR %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 78539996 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67765 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 2,519.00 mb OTL by OldTimer - Version 3.2.39.2 log created on 03222012_212805 Files\Folders moved on Reboot... File move failed. C:\Users\Gast\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot. File\Folder C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T9VOQXHR\ads[1].htm not found! File\Folder C:\Users\Gast\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\T9VOQXHR\ads[2].htm not found! Registry entries deleted on Reboot... |
|
23.03.2012, 16:29
| #4 |
| /// Malware-holic | Achtung ihr computer wurde gesperrt . hi, Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Achtung ihr computer wurde gesperrt . |
| adobe, bandoo, bho, bingbar, canon, computer, conduit, converter, defender, desktop, error, firefox, flash player, format, gesperrt, helper, ihr computer wurde gesperrt, install.exe, internet, internet explorer, logfile, malware, mozilla thunderbird, mp3, object, pdfforge toolbar, plug-in, realtek, registry, rundll, searchqu toolbar, searchscopes, security, smartbar, software, teamspeak, usb 2.0, windows |
Linear-Darstellung
