S.M.A.R.T. HDD bzw. Win32/Kryptik.AGML

doradxo · 05.06.2012, 19:35

Hallo zusammen,

irgendwie hat sich der Win 7 (32 Bit) Rechner meiner Eltern mit den im Titel genannten Schädlingen infiziert. Bei Systemstart poppte nur das Fake Programm Smart HDD auf sowie 30 aufeinanderfolgende Errormeldungen. Startmenü sowie C: und D: waren leergefegt, so auch der Desktop.

Ich habe jetzt über die Ordnereinstellungen von Windows alle versteckten Dateien wieder sichtbar machen können und siehe da, alle Dateien sind wieder da, weisen aber das Attribut "versteckt" auf. Nach einem Neustart tritt aber die ganze Prozedur wieder auf und auch die Dateien sind wieder weg.

Ich habe den ESET Online Scanner als Admin gestartet und jegliche Antivir und Firewalls ausgestellt. Das log findet ihr anbei. Die automatische Löschung habe ich auch ausgestellt. Kann mal jemand drüber schauen und mir sagen ob ich das löschen darf?

Der Trojaner ist wohl erst seit heute bekannt wie ich hier lesen konnte. Bei Google gibt es momentan nur sehr wenige Treffer zu dieser Variante. Vielen Dank im Vorraus!

defogger.log:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 20:20 on 05/06/2012 (Papa)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Malwarebytes Log:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.04.04.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Papa :: PAPA-PC [Administrator]

05.06.2012 17:00:09
mbam-log-2012-06-05 (17-00-09).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 283306
Laufzeit: 47 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

ESET Log:

Code:

ATTFilter

C:\ProgramData\AKfPlKyjpi5W3O.exe	a variant of Win32/Kryptik.AGML trojan
C:\ProgramData\vfecjqYPEFsxGU.exe	a variant of Win32/Kryptik.AGML trojan
C:\Users\All Users\AKfPlKyjpi5W3O.exe	a variant of Win32/Kryptik.AGML trojan
C:\Users\All Users\vfecjqYPEFsxGU.exe	a variant of Win32/Kryptik.AGML trojan
C:\Users\Papa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHXWZ9PS\JDownloaderSetup_3IC[1].exe	a variant of Win32/InstallCore.P application
C:\Users\Papa\AppData\Local\Temp\is1070216317\MyBabylonTB.exe	Win32/Toolbar.Babylon application

OTL.txt Log:

Code:

ATTFilter

OTL logfile created on: 05.06.2012 20:30:09 - Run 1
OTL by OldTimer - Version 3.2.46.1     Folder = D:\-= DOWNLOAD =-\FIREFOX DOWNLOADS
 Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,37 Mb Total Physical Memory | 361,28 Mb Available Physical Memory | 35,30% Memory free
2,00 Gb Paging File | 0,80 Gb Available in Paging File | 39,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 1,96 Gb Free Space | 4,02% Space Free | Partition Type: NTFS
Drive D: | 184,05 Gb Total Space | 44,17 Gb Free Space | 24,00% Space Free | Partition Type: NTFS
Drive E: | 27,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.05 20:25:01 | 000,596,480 | ---- | M] (OldTimer Tools) -- D:\-= DOWNLOAD =-\FIREFOX DOWNLOADS\OTL.exe
PRC - [2012.05.08 20:44:42 | 000,086,224 | -H-- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 20:44:40 | 000,348,624 | -H-- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 20:44:40 | 000,110,032 | -H-- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 20:44:40 | 000,080,336 | -H-- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.25 18:45:52 | 000,924,600 | -H-- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe
PRC - [2012.04.04 07:53:50 | 000,063,928 | -H-- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.02.02 15:32:52 | 000,018,432 | -H-- | M] () -- C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFoxUpdater.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.05.13 17:03:34 | 004,283,256 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Messenger\msnmsgr.exe
PRC - [2011.05.13 15:49:42 | 000,025,456 | -H-- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Contacts\wlcomm.exe
PRC - [2011.03.28 21:31:16 | 000,193,920 | -H-- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 21:31:14 | 001,713,536 | -H-- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.10.06 13:39:27 | 002,002,728 | -H-- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009.07.14 03:14:41 | 000,354,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\StikyNot.exe
PRC - [2009.04.14 16:43:42 | 000,604,704 | -H-- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE
PRC - [2009.01.26 16:31:10 | 001,153,368 | -H-- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.25 18:45:52 | 001,952,696 | -H-- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll
MOD - [2011.12.04 18:40:31 | 008,527,008 | -H-- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2011.07.18 23:04:08 | 000,296,448 | -H-- | M] () -- C:\Programme\Notepad++\NppShell_04.dll
MOD - [2011.03.02 13:40:51 | 000,140,288 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.05.08 20:44:42 | 000,086,224 | -H-- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 20:44:40 | 000,110,032 | -H-- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.25 18:45:53 | 000,129,976 | -H-- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 07:53:50 | 000,063,928 | -H-- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.02.02 15:32:52 | 000,018,432 | -H-- | M] () [Auto | Running] -- C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFoxUpdater.exe -- (ReminderFoxUpdater)
SRV - [2011.03.28 21:31:14 | 001,713,536 | -H-- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.11.20 23:29:48 | 000,128,848 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2010.11.20 23:29:32 | 000,068,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\Mcx2Svc.dll -- (Mcx2Svc)
SRV - [2010.10.06 13:39:27 | 002,002,728 | -H-- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess)
SRV - [2009.07.14 03:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\athr.sys -- (athr)
DRV - [2012.06.05 17:44:26 | 000,042,960 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\hyxdvlzh.sys -- (hyxdvlzh)
DRV - [2012.05.08 20:44:42 | 000,137,928 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 20:44:42 | 000,083,392 | -H-- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.19 17:56:15 | 000,036,000 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.11.20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 23:29:12 | 000,246,784 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2010.11.20 23:29:03 | 000,175,360 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 23:29:03 | 000,112,640 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010.11.20 23:29:03 | 000,077,184 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010.11.20 23:29:03 | 000,062,464 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010.11.20 23:29:03 | 000,040,704 | -H-- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 23:29:03 | 000,028,032 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 23:29:03 | 000,027,264 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.11.20 23:29:03 | 000,025,600 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt)
DRV - [2010.11.20 23:29:03 | 000,017,920 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 23:29:03 | 000,005,632 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.07.08 15:17:56 | 000,603,240 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.06.17 16:14:27 | 000,028,520 | -H-- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 03:20:28 | 000,022,096 | -H-- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.14 00:09:17 | 004,194,816 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.07.14 00:02:53 | 000,048,128 | -H-- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SiSGB6.sys -- (SiSGbeLH)
DRV - [2009.06.19 04:45:02 | 004,172,832 | -H-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
 
 
 
 
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=15003
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3F 65 A3 19 9E B2 CC 01  [binary data]
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=&src=crm&q={searchTerms}&locale=
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.25 18:45:53 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.12.04 18:18:03 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions
[2012.05.18 21:46:04 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\g19lbimn.default\extensions
[2010.02.04 16:45:40 | 000,002,254 | -H-- | M] () -- C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\g19lbimn.default\searchplugins\askcom.xml
[2012.01.10 13:04:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.06 02:19:41 | 000,634,964 | -H-- | M] () (No name found) -- C:\USERS\PAPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G19LBIMN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.05.18 21:46:04 | 000,045,066 | -H-- | M] () (No name found) -- C:\USERS\PAPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G19LBIMN.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
[2012.04.25 18:45:52 | 000,097,208 | -H-- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.10 13:04:24 | 000,001,392 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 13:04:24 | 000,002,252 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.10 13:04:24 | 000,001,153 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 13:04:23 | 000,006,805 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 13:04:23 | 000,001,178 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 13:04:23 | 000,001,105 | -H-- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | -H-- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ReminderFox) - {7C9B39E6-6606-4ED2-8A3F-36E39C78CBDC} - C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFox.dll (Tom Mutdosch)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [vfecjqYPEFsxGU.exe] C:\ProgramData\vfecjqYPEFsxGU.exe ()
O4 - HKU\S-1-5-21-229958436-3033542292-740978725-1001..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{912531D1-61FC-42AA-8642-E1626A7CD00D}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAE7AF95-9DE3-4248-8CA3-C99FD1B8FB94}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.05 20:24:38 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe.part
[2012.06.05 19:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.05 16:56:39 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.05 16:56:37 | 000,022,344 | -H-- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.05 16:56:35 | 000,000,000 | -H-D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.05 16:54:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{567F4701-CD60-4A3B-82DC-3AFF260CE38C}
[2012.06.05 16:54:05 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{72552B9F-4DAA-4449-81A5-6B6F207BF0F0}
[2012.06.05 16:40:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{342C47B4-85A1-453A-B58D-784A91570916}
[2012.06.05 16:40:02 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{416BA68D-00E5-4111-AA53-77FB8275CDD7}
[2012.06.05 16:22:13 | 000,000,000 | -H-D | C] -- C:\Windows\pss
[2012.06.05 16:21:34 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{E0C4FA3E-A49D-4B16-889B-F8F22ADA2CFE}
[2012.06.05 16:21:18 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{38C21B59-41FD-452E-88ED-5180354F6B00}
[2012.06.05 16:12:13 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{B7BCB83D-941B-4324-AC39-0379C9E0A64A}
[2012.06.05 16:11:58 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{14CA174B-BBF7-4456-86A1-36F866B96EF2}
[2012.06.05 16:03:46 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes
[2012.06.05 16:03:35 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes
[2012.06.05 15:47:51 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{5E8B2EAD-9A30-4BDB-B062-632718FFD8B7}
[2012.06.05 15:47:37 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{DF0B0C8A-6EB2-4313-B098-FDDAA669B242}
[2012.06.04 20:53:59 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{AE0C8901-128B-4BF4-BC22-F7DA5C34BD6F}
[2012.06.04 20:53:44 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{96463A6C-25AB-4750-AF84-414984C0EA7D}
[2012.06.04 20:31:16 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{04CF649D-F25B-439E-92C7-7B97E463E93B}
[2012.06.04 20:31:01 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{E671A195-DC30-4C08-9DF7-E226595C82CA}
[2012.06.04 20:20:54 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Data Recovery
[2012.06.04 20:20:16 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{1F355A69-86AE-4C0B-A9E8-571371875EA2}
[2012.06.04 20:19:54 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{6DD15C57-58BF-4183-8BFE-A646A1716BB5}
[2012.06.04 10:44:21 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{58B87E9C-DA9D-40D4-AEEE-5278D8C99B4F}
[2012.06.04 10:44:03 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{EE61A34B-BE4E-4C81-A5F2-1FF96907F309}
[2012.06.03 09:55:31 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{1A29B715-5FB8-4185-90F9-566B1D7BC1DB}
[2012.06.03 09:55:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{AFDAB24F-1AB3-4156-A35B-3FD62790F75A}
[2012.06.02 11:05:20 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{BFEF408C-4C13-4B10-8AFD-F0D9ADD5C233}
[2012.06.02 11:05:06 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{5A1FA7C4-6628-4A1D-AB7D-F9A6D51AF932}
[2012.06.01 12:54:27 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{D8DBDB1F-58DC-407D-85E1-E3EE13DD2E41}
[2012.06.01 12:54:15 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{47AFAC0D-CB99-4BA9-A093-E9A3A86A1BCE}
[2012.05.31 10:56:28 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2CEBC841-F9E2-4B0D-8232-9064BF61CBA1}
[2012.05.31 10:56:15 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{4F089928-2E0A-4A26-9807-87B63C990E25}
[2012.05.30 07:38:44 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{F5AE28B3-6DE3-48D3-8FF5-421302085DDA}
[2012.05.30 07:38:32 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{6623ABA8-D3AE-4AC2-9213-29C4C9949FD7}
[2012.05.29 17:42:37 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{1D634638-028C-4118-B2D8-5A4504F5F2A4}
[2012.05.29 17:42:26 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{19121182-309B-4B64-8981-77A4D198A6BE}
[2012.05.29 11:38:04 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{45A6CE6A-C470-41A8-B618-700AC2FD6C3C}
[2012.05.29 11:37:51 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{6AA138F5-451C-492E-8D44-B51AD8ED3793}
[2012.05.28 12:38:05 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7118A9DF-58AC-4F5B-901D-5788AC12FE50}
[2012.05.28 12:37:50 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{3C6DD5B9-D211-4288-BEAC-5655B0FF0F41}
[2012.05.28 11:03:03 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\constant
[2012.05.28 10:21:13 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{DEFCA69D-7C8F-4127-98FF-C007DAD21B42}
[2012.05.28 10:21:01 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{FD29CFEB-2843-46A7-8644-2FBB5DB8E2AF}
[2012.05.27 19:37:14 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{147FD708-6CCF-4D72-ACEB-DDE0571283B9}
[2012.05.27 19:37:01 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{A8036F5E-19D1-43BA-8ADA-3ECC19BB0190}
[2012.05.27 13:30:35 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7F797455-42E2-4E09-A1BF-16C652FF3BF4}
[2012.05.27 13:30:22 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2A55F9A4-3670-481F-ACC4-A6301BB76665}
[2012.05.26 20:49:33 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7AFE2D5E-CB94-4825-A152-64ADCE5004CF}
[2012.05.26 20:49:20 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{10ECD97D-BC58-4128-8420-9327EE2D1B3C}
[2012.05.26 13:30:52 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{BA89A8F3-CBC6-4BAB-BB8A-268691FB4FFC}
[2012.05.26 13:30:39 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{634593C5-F5CD-4A72-B75C-030FD3E11251}
[2012.05.25 13:12:29 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{53053DF1-2A69-47F8-97EC-23D792C32311}
[2012.05.25 13:12:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{14FB3BC9-74F0-4512-B1FB-58E01A5EE743}
[2012.05.24 17:36:54 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{CAF704B4-D5DB-45BF-B8C7-F42657B2875D}
[2012.05.24 17:36:41 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{F97248C0-6CE9-401A-A51E-951E04D73E19}
[2012.05.24 13:34:13 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{FDC99826-0B7F-44A8-86A9-A5342071121F}
[2012.05.24 13:33:57 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{1891A197-5A71-4057-B736-7F24A1580494}
[2012.05.23 14:54:19 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{493527C3-CC2B-4EC4-8528-DA82AB280721}
[2012.05.23 14:54:05 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{9C124CCD-430F-4CD6-873B-486B77F1AE2A}
[2012.05.23 12:12:06 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{0C02B509-FC0E-479B-9DF8-8EA79361507C}
[2012.05.23 12:11:43 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2718D657-B738-46E2-9038-03C9FA35638D}
[2012.05.22 22:10:44 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{212F6CDF-37D9-4A9E-93C4-02E79DBE0683}
[2012.05.22 22:10:28 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7DA3DDE4-6D9E-40FD-8006-5E5FAE9DB281}
[2012.05.22 17:08:36 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{15C137FF-0571-451F-A26A-C50412589253}
[2012.05.22 17:08:24 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{EF064E51-57BB-47B8-8A03-4581779867C5}
[2012.05.22 11:24:52 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7237FBDF-F919-4624-8C62-4EFDD33FC6B3}
[2012.05.22 11:24:38 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{88DB296A-544B-4CF5-948E-4539568B9CB5}
[2012.05.21 08:42:57 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{CEE6460F-F765-4515-8744-57D607B3FDD3}
[2012.05.21 08:42:45 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{AC2C7175-326F-4D3E-B1CD-34F8692C4BEA}
[2012.05.20 20:41:53 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{3FB0EE10-D415-4956-BC39-7DC28527EF50}
[2012.05.20 20:41:35 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{1C2EB092-6F6B-40F2-9EDC-43185C493646}
[2012.05.20 11:08:25 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{3C0CFCE6-C484-47E3-B8AD-58D0544A7A1A}
[2012.05.20 11:08:08 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{6351F482-77E5-40DF-BF23-E8690BE998D9}
[2012.05.19 11:07:06 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{6F834B9E-A37C-4CEB-87EA-C97E244A4957}
[2012.05.19 11:06:54 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{EA450B07-26B6-4D2D-BB8E-2A4F574AEBC6}
[2012.05.18 15:45:27 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\Konwerter NewCamd  to CCcam
[2012.05.18 10:29:26 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{DBB231FF-A2BC-4C98-B939-E2BDBAFC062B}
[2012.05.18 10:29:14 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{94E32B42-EBA9-4F3D-AFD9-D1CB22AC247F}
[2012.05.18 08:14:02 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{7B3923B4-242E-46AE-8CB1-416B0F5C9E2D}
[2012.05.18 08:13:48 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{5C69526C-3970-4F34-AA3A-8B045ECD05D4}
[2012.05.17 09:32:34 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{FB6BBD76-4C7D-4B12-9392-7B5C5AE42216}
[2012.05.17 09:32:21 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{E01EC915-0029-4469-94CA-B8CD81CEC5C8}
[2012.05.16 17:16:59 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\www.coolstream.to
[2012.05.16 17:12:42 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\OscamConfigCreator_12.10.10
[2012.05.16 16:47:47 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.05.16 16:47:47 | 000,000,000 | -H-D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.05.16 16:47:43 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Notepad++
[2012.05.16 16:47:43 | 000,000,000 | -H-D | C] -- C:\Program Files\Notepad++
[2012.05.16 09:10:03 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{76A0036B-1D34-4648-91C2-B55471AD4909}
[2012.05.16 09:09:50 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{43DE9C3D-52BF-41BA-A656-5F6CA0BAEFB8}
[2012.05.15 20:11:12 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{D28DB45E-3DD6-4225-B832-8FBC6402F6C7}
[2012.05.15 20:10:58 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{8E138424-282F-4D1C-99B0-8B29D31AD305}
[2012.05.15 12:09:28 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{36D0E92C-6880-4057-8FC0-D858055B25A7}
[2012.05.15 12:09:07 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{C237307C-C2BE-4938-8760-0B3A4117B197}
[2012.05.14 20:16:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\control
[2012.05.14 18:29:40 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{00DA534E-7568-4222-8847-14807009FF83}
[2012.05.14 18:29:28 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{4681A1E4-6EAF-428A-A3C4-2009A89387D9}
[2012.05.14 08:43:53 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2FD44F2E-7582-49D1-9EEF-CAB7F9ECB28D}
[2012.05.14 08:43:41 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{C7743720-4100-4064-AEE7-6873E56B7CD2}
[2012.05.13 09:44:46 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2888B1D6-1B00-4A7B-B601-6433FAF23F02}
[2012.05.13 09:44:34 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{24896A5B-9899-447E-A9B6-C604BF5558D9}
[2012.05.12 14:13:39 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{8C6E7227-1470-420C-B35A-5768825D0047}
[2012.05.12 14:13:27 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{A7CDB154-8A1E-46C9-BEC5-95F9A767C5C8}
[2012.05.11 11:55:52 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{FA1856F8-2AC0-4B2E-A3D0-C2AB5B930A64}
[2012.05.11 11:55:39 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{68EA464E-60CD-4FA5-A60E-5815BC108D9D}
[2012.05.11 07:11:32 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{C31897F2-C6B0-4BBC-A3DE-B5D4F6A12FDD}
[2012.05.11 07:11:17 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{EAB16400-8B16-4C96-BA68-620B8372449A}
[2012.05.10 21:01:57 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2A2268B9-69D3-48DA-9054-1E5E16316859}
[2012.05.10 21:01:44 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{2749DA1D-38E6-42AD-8C21-D62760B75A66}
[2012.05.10 15:15:47 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\Oscam Tuts
[2012.05.10 14:12:50 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{EA894941-49A7-4459-8E23-CDB5F09BB52E}
[2012.05.10 14:12:38 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{79D18CB7-81A5-49DC-A288-22C620880C9A}
[2012.05.09 11:55:02 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{C3C119F8-EF5E-47AB-8EDD-88FEF39C2E67}
[2012.05.09 11:54:49 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{0DEB016B-80F9-4C36-88F3-13CCB9E36473}
[2012.05.08 11:23:33 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{605C2D74-043B-411A-8864-EB370AE81A46}
[2012.05.08 11:23:19 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{4946F50B-9A5D-4ADB-9BE7-6DD942E9125E}
[2012.05.07 20:46:09 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{B813995E-56AC-4589-9FFE-8C6B2122A05D}
[2012.05.07 20:45:47 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{0EC76FF7-9265-4420-B0A6-9705A658C34F}
[2012.05.07 09:05:00 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Desktop\Neuer Ordner
[2012.05.07 07:51:28 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{32A967F8-8206-4264-A96D-45155F7AE044}
[2012.05.07 07:51:13 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Local\{73C93595-2C92-4075-80C4-91FEFCE8A3B6}
[2011.12.04 18:18:45 | 385,086,637 | -H-- | C] (Microsoft Corporation) -- C:\Program Files\Microsoft Office Word 2007.exe
[2011.12.04 18:06:30 | 029,032,448 | -H-- | C] (Driver-Soft Inc.) -- C:\Program Files\Driver Genius Professional Edition.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.05 20:24:45 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe.part
[2012.06.05 20:20:35 | 000,000,000 | ---- | M] () -- C:\Users\Papa\defogger_reenable
[2012.06.05 20:03:06 | 000,024,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.05 20:03:06 | 000,024,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.05 18:49:00 | 000,000,266 | -H-- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012.06.05 16:56:40 | 000,001,067 | -H-- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.05 16:53:15 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.05 16:53:07 | 804,806,656 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.04 20:20:55 | 000,000,184 | -H-- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3Or
[2012.06.04 20:20:55 | 000,000,000 | -H-- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3O
[2012.06.04 20:20:51 | 000,000,256 | -H-- | M] () -- C:\ProgramData\AKfPlKyjpi5W3O
[2012.06.04 20:20:38 | 000,250,368 | -H-- | M] () -- C:\ProgramData\AKfPlKyjpi5W3O.exe
[2012.06.04 20:03:39 | 000,343,040 | -H-- | M] () -- C:\ProgramData\vfecjqYPEFsxGU.exe
[2012.06.03 18:25:33 | 000,653,928 | -H-- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.03 18:25:33 | 000,615,810 | -H-- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.03 18:25:33 | 000,129,800 | -H-- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.03 18:25:33 | 000,106,190 | -H-- | M] () -- C:\Windows\System32\perfc009.dat
[2012.05.30 13:01:34 | 000,033,290 | -H-- | M] () -- C:\Users\Papa\Desktop\00694177.jpg
[2012.05.30 12:57:48 | 000,051,173 | -H-- | M] () -- C:\Users\Papa\Desktop\00686994.jpg
[2012.05.30 12:53:04 | 000,034,979 | -H-- | M] () -- C:\Users\Papa\Desktop\00694178.jpg
[2012.05.16 16:47:47 | 000,001,021 | -H-- | M] () -- C:\Users\Papa\Desktop\Notepad++.lnk
[2012.05.13 09:43:00 | 000,265,640 | -H-- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.05.08 20:44:42 | 000,137,928 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2012.05.08 20:44:42 | 000,083,392 | -H-- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
 
========== Files Created - No Company Name ==========
 
[2012.06.05 20:20:35 | 000,000,000 | ---- | C] () -- C:\Users\Papa\defogger_reenable
[2012.06.05 16:56:40 | 000,001,067 | -H-- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.04 20:20:55 | 000,000,184 | -H-- | C] () -- C:\ProgramData\-AKfPlKyjpi5W3Or
[2012.06.04 20:20:55 | 000,000,000 | -H-- | C] () -- C:\ProgramData\-AKfPlKyjpi5W3O
[2012.06.04 20:20:50 | 000,000,256 | -H-- | C] () -- C:\ProgramData\AKfPlKyjpi5W3O
[2012.06.04 20:20:38 | 000,250,368 | -H-- | C] () -- C:\ProgramData\AKfPlKyjpi5W3O.exe
[2012.06.04 20:06:11 | 000,343,040 | -H-- | C] () -- C:\ProgramData\vfecjqYPEFsxGU.exe
[2012.05.30 13:01:32 | 000,033,290 | -H-- | C] () -- C:\Users\Papa\Desktop\00694177.jpg
[2012.05.30 12:57:45 | 000,051,173 | -H-- | C] () -- C:\Users\Papa\Desktop\00686994.jpg
[2012.05.30 12:52:51 | 000,034,979 | -H-- | C] () -- C:\Users\Papa\Desktop\00694178.jpg
[2012.05.18 16:20:02 | 000,627,200 | -H-- | C] () -- C:\Users\Papa\Desktop\cccam2oscam.exe
[2012.05.16 16:47:47 | 000,001,021 | -H-- | C] () -- C:\Users\Papa\Desktop\Notepad++.lnk
[2011.12.14 23:05:14 | 000,000,193 | -H-- | C] () -- C:\Windows\WORDPAD.INI
[2011.12.13 18:33:27 | 000,299,008 | RH-- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2011.12.04 18:49:03 | 000,154,144 | -H-- | C] () -- C:\Windows\System32\RTLCPAPI.dll
[2011.12.04 17:55:25 | 000,000,000 | -H-- | C] () -- C:\Windows\ativpsrm.bin
[2011.12.04 17:55:25 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.04.12 04:17:04 | 000,653,928 | -H-- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 04:17:04 | 000,295,922 | -H-- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 04:17:04 | 000,129,800 | -H-- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 04:17:04 | 000,038,104 | -H-- | C] () -- C:\Windows\System32\perfd007.dat
[2010.11.20 23:29:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2010.11.20 23:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
 
========== LOP Check ==========
 
[2012.01.31 15:20:15 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Canneverbe Limited
[2012.02.19 17:54:25 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\elsterformular
[2011.12.19 19:09:22 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\GHISLER
[2012.05.16 16:49:16 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Notepad++
[2012.03.02 13:59:06 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\SatChannelListEditor
[2011.12.04 18:33:29 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\TeamViewer
[2012.04.24 23:24:30 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\uTorrent
[2011.12.22 14:03:47 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Windows Live Writer
[2012.06.05 18:49:00 | 000,000,266 | -H-- | M] () -- C:\Windows\Tasks\AutoKMS.job
[2012.03.08 15:25:40 | 000,032,578 | -H-- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 708 bytes -> C:\Windows\System32\drivers\hyxdvlzh.sys:changelist

< End of report >

OTL Extras.txt:

Code:

ATTFilter

OTL Extras logfile created on: 05.06.2012 20:30:09 - Run 1
OTL by OldTimer - Version 3.2.46.1     Folder = D:\-= DOWNLOAD =-\FIREFOX DOWNLOADS
 Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,37 Mb Total Physical Memory | 361,28 Mb Available Physical Memory | 35,30% Memory free
2,00 Gb Paging File | 0,80 Gb Available in Paging File | 39,87% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 1,96 Gb Free Space | 4,02% Space Free | Partition Type: NTFS
Drive D: | 184,05 Gb Total Space | 44,17 Gb Free Space | 24,00% Space Free | Partition Type: NTFS
Drive E: | 27,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08750196-3CC6-4D5A-8541-807CF32CCBE2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{149081B1-34F9-49F6-88AA-BF4D6F2EFECD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{194632DE-93CB-44FB-B182-6DF5295C898C}" = lport=139 | protocol=6 | dir=in | app=system | 
"{1B8EBD82-77A1-4613-8991-5FD592D14160}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{39AEA0EF-FEAB-4B06-B1C4-938F61B50E92}" = rport=138 | protocol=17 | dir=out | app=system | 
"{58C95A33-08C1-4AB1-80FB-EFDADA8B33D3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{5ED0CB75-9E76-43C8-AFD7-EBF0EBD5BEB3}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{61B47479-8D4E-4C3F-A6C6-183D9817607C}" = rport=139 | protocol=6 | dir=out | app=system | 
"{635B5A3C-F0DC-44D0-ABF2-3F9EC6FE8614}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{65F1F451-5A20-4C14-BAD3-24B6532CF839}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6A12C738-FFD7-40B2-BD2C-ACF140B1E39D}" = rport=5445 | protocol=17 | dir=out | name=torchlight | 
"{6B582AAD-82E6-4E9C-9977-34249787B11F}" = lport=5445 | protocol=17 | dir=in | name=torchlight | 
"{6BB5FEB7-3EB4-4465-815B-A7E2F4802EC8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{6C4B3A06-2171-400C-9E3E-322ACC29ABC8}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{81268419-BA44-4CB6-A784-67D23F930AB3}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{8BECA14D-9E7F-4629-8278-0C996474576A}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{9B1F0F0F-0F77-48C4-B8CE-0B2982A99516}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A2D1106C-446C-46A8-A16D-136E7BD55D75}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B3226F1D-A310-4BFC-97C7-337607F9D700}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{B4382A6E-5532-4C24-85E7-57C4D076E81C}" = rport=445 | protocol=6 | dir=out | app=system | 
"{BACDB6F3-F3F5-4438-8A95-3F16D788537D}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{DB796145-EAD4-40BF-B526-BE09B1CA8346}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{DC12DEA7-1F75-4B12-8FB0-2533F9E4F7B9}" = rport=137 | protocol=17 | dir=out | app=system | 
"{DD7AB207-32AD-4C58-B79D-3ACD14CA013F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{E7B4B44E-CE58-4EF8-8DD7-6009812BFD6D}" = lport=138 | protocol=17 | dir=in | app=system | 
"{ECB99A3C-1105-4346-8694-E70124CF3983}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EDB2605D-0E3C-4D58-B18D-6C897E7E990F}" = lport=445 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D9AEC9A-13E4-4A04-A8EA-15543E05942D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{18404F1D-F987-4728-A4A0-406021E9A6E8}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{19C742D9-45B7-4C21-A72D-3CD416845047}" = protocol=6 | dir=out | app=system | 
"{258C348A-8787-47B5-95DB-AD80B494D85F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{2E486E88-C4A8-48D1-BA20-75EADFA2F323}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{3337A4A3-D434-4D47-9443-A8C5529C5C4D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{3C334766-A094-43EE-9232-4DC61BC36152}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | 
"{405783DD-908B-4C94-A53B-D67BB204F8F2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4EC0D44B-DC4B-4EC2-BEA8-36FC24ADC737}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{540F2FC1-31DF-456F-8931-EC2F326F29CA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{5436305D-2AD8-405C-9F90-7806CDA2961E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7BDBBEF0-D820-4234-B970-3896DB0833CE}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{7F0C8079-E976-4383-B6D9-F24D90FD423B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{81D9CE17-03FE-4E7F-B841-0675B876FF78}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{851B2702-A416-40F9-820B-ED68B2DCCE09}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{8809A5F0-A4B8-4DF1-9CB7-E6A1A43A723D}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe | 
"{915A7A17-6085-4321-A70B-F8619582F200}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{A1499B85-E42A-43D4-8425-27E5145256F8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ACA10A36-8593-4B59-B28E-5B2DACAAECFB}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{C5C06865-1866-42F1-826E-807E84A89A4C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{D458B139-99C6-405F-A67C-C65A8A2BEF36}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D7902127-FF98-4F2D-BA68-0B37DF450879}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | 
"{F4EDE601-1FA1-4543-82F7-D566946DB818}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | 
"{FAA5DE16-9318-4436-8213-0614C0FF4A66}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{423FA830-F41E-49D4-A3F4-9DA3200D2A46}C:\users\papa\desktop\neuer ordner\dcc_e2.exe" = protocol=6 | dir=in | app=c:\users\papa\desktop\neuer ordner\dcc_e2.exe | 
"TCP Query User{4B108DFA-783D-425A-97A3-A62FCBDAD671}C:\users\papa\desktop\golden media\enigma 2\dcc.e2\dcc_e2.exe" = protocol=6 | dir=in | app=c:\users\papa\desktop\golden media\enigma 2\dcc.e2\dcc_e2.exe | 
"TCP Query User{5A4FAFD5-C2E9-4A0C-946F-E50E635479E5}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{6C0CCD47-E6A8-4DBD-831A-89D8D4742A7A}C:\program files\totalcmd\totalcmd.exe" = protocol=6 | dir=in | app=c:\program files\totalcmd\totalcmd.exe | 
"TCP Query User{7E787C23-9A4E-465B-B95A-1487D5D4A45C}C:\users\papa\desktop\control\dcc_e2.exe" = protocol=6 | dir=in | app=c:\users\papa\desktop\control\dcc_e2.exe | 
"TCP Query User{801107E1-0AE7-4E99-B070-8F45E46EA090}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"TCP Query User{B4FB96C8-8776-485D-A4F8-84B60E823736}C:\program files\dreamboxedit\dreamboxedit.exe" = protocol=6 | dir=in | app=c:\program files\dreamboxedit\dreamboxedit.exe | 
"TCP Query User{BDB7D921-5F71-45CA-8C0B-3117AFA3339E}C:\program files\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\program files\winamp\winamp.exe | 
"TCP Query User{C204F9CA-F624-4F74-95AC-6A321C939E94}C:\program files\dbox_ifa\dbox_ifa.exe" = protocol=6 | dir=in | app=c:\program files\dbox_ifa\dbox_ifa.exe | 
"TCP Query User{E4BC4605-0D3A-4632-8C18-84A3D66C72DB}C:\program files\seteditpingulux\seteditpingulux.exe" = protocol=6 | dir=in | app=c:\program files\seteditpingulux\seteditpingulux.exe | 
"TCP Query User{F69B6393-45D3-4953-BEE6-BE91DEB9756F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{253F143C-4104-480B-B834-7409763769BE}C:\program files\seteditpingulux\seteditpingulux.exe" = protocol=17 | dir=in | app=c:\program files\seteditpingulux\seteditpingulux.exe | 
"UDP Query User{3944460A-62F2-4C06-81C3-BC78A13870ED}C:\users\papa\desktop\neuer ordner\dcc_e2.exe" = protocol=17 | dir=in | app=c:\users\papa\desktop\neuer ordner\dcc_e2.exe | 
"UDP Query User{45D221BA-9906-41C7-86CA-529B02A5AAC2}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | 
"UDP Query User{5DBB44C3-AFB8-400B-ABB8-E7EAD01021EA}C:\program files\totalcmd\totalcmd.exe" = protocol=17 | dir=in | app=c:\program files\totalcmd\totalcmd.exe | 
"UDP Query User{61B0C25F-C450-4CEA-9564-AD77AE93E215}C:\program files\dreamboxedit\dreamboxedit.exe" = protocol=17 | dir=in | app=c:\program files\dreamboxedit\dreamboxedit.exe | 
"UDP Query User{7BD9BB7E-75E5-4FA9-AC10-CCA08D238D29}C:\users\papa\desktop\golden media\enigma 2\dcc.e2\dcc_e2.exe" = protocol=17 | dir=in | app=c:\users\papa\desktop\golden media\enigma 2\dcc.e2\dcc_e2.exe | 
"UDP Query User{7FD99939-B3EA-4A97-AD69-134BF4D22177}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{884A111F-9FF6-4E33-8A60-6DC436B58E7B}C:\users\papa\desktop\control\dcc_e2.exe" = protocol=17 | dir=in | app=c:\users\papa\desktop\control\dcc_e2.exe | 
"UDP Query User{AF529DA0-D9B1-4FE3-A8C3-5765AAE1C236}C:\program files\dbox_ifa\dbox_ifa.exe" = protocol=17 | dir=in | app=c:\program files\dbox_ifa\dbox_ifa.exe | 
"UDP Query User{D6CDE880-9E5A-4EF0-953E-1EDD884E7DD3}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | 
"UDP Query User{F80682A2-4EA8-4892-8C40-6858D7E14B42}C:\program files\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\program files\winamp\winamp.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{549CE1BD-88E4-4C5E-BF75-B155624714CC}" = Belkin USB Wireless Adaptor
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9604A3B3-9417-46B3-9DEA-64DF3B2DD92C}" = PDF-XChange Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF9041ED-60C9-36ED-9DB9-F55AAD993865}" = Visual C++ 9.0 ATL (x86) WinSXS MSM
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DFE7195F-54B3-49AD-B8CA-D1DE33369DCC}" = SatChannelListEditor
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E7382773-CBE8-33A9-862E-C2337CD0F359}" = Visual C++ 9.0 ATL (x86) WinSXS MSM
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"DBOX2 Image-Flashing-Assistent_is1" = DBOX2 Image-Flashing-Assistent 3.4.2
"dreamboxEDIT" = DreamBoxEdit -- The one and only settings editor for your Dreambox
"Edision Toolbox v1.0" = Edision Toolbox v1.0
"ElsterFormular 13.0.0.8086p" = ElsterFormular
"EnigmEdit" = EnigmEdit (remove only)
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{549CE1BD-88E4-4C5E-BF75-B155624714CC}" = Belkin USB Wireless Adaptor
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MozBackup" = MozBackup 1.5.1
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Notepad++" = Notepad++
"Samsung DSR9500 Studio_is1" = Samsung DSR9500 Studio 1.4
"SetEditPingulux" = SetEditPingulux (remove only)
"SetEditVantage" = SetEditVantage (remove only)
"SopCast" = SopCast 3.2.9
"TeamViewer 5" = TeamViewer 5
"Totalcmd" = Total Commander (Remove or Repair)
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.11
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.00 (32-bit)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 13:04:55 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 14:04:57 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 14:04:57 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 14:04:57 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
Error - 03.06.2012 14:04:57 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Die Daten sind unzulässig.  .
 
[ System Events ]
Error - 01.06.2012 06:53:03 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 02.06.2012 05:03:45 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 02.06.2012 07:39:33 | Computer Name = Papa-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 02.06.2012 19:28:41 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet:
   %%1115
 
Error - 03.06.2012 03:53:59 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 03.06.2012 03:55:04 | Computer Name = Papa-PC | Source = WMPNetworkSvc | ID = 866300
Description = 
 
Error - 04.06.2012 04:42:45 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 04.06.2012 08:15:40 | Computer Name = Papa-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 04.06.2012 14:18:44 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
Error - 04.06.2012 14:29:56 | Computer Name = Papa-PC | Source = Microsoft-Windows-Kernel-Processor-Power | ID = 6
Description = Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden 
im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich
 an den Computerhersteller, um aktualisierte Firmware zu erhalten.
 
 
< End of report >

cosinus · 08.06.2012, 10:43

Zitat:

Datenbank Version: v2012.04.04.08

Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen neuen Vollscan machen.

doradxo · 08.06.2012, 15:37

Merkwürdig...nunja hier das neue Log:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.08.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Papa :: PAPA-PC [Administrator]

08.06.2012 15:31:28
mbam-log-2012-06-08 (15-31-28).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 276209
Laufzeit: 39 Minute(n), 38 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

cosinus · 08.06.2012, 17:20

Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.

doradxo · 08.06.2012, 17:56

Hallo cosinus,

erstmal ein großes Danke dafür das Du antwortest! Leider habe ich keine älteren Logs, da ich Malwarebytes reinstallieren musste weil ich beim Update ständig eine Fehlermeldung bekam.

Dort sind seit dem 5.6.12 5 Logs vorhanden, allerdings nur mit diesem Fund

Code:

ATTFilter

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Oder halt ohne jeglichen Fund.

Mehr wird da momentan nicht gefunden...

cosinus · 08.06.2012, 17:59

Sieh mal bitte richtig (manuell) nach. Auch in anderen Userprofilen falls vorhanden.
Damit du die Ordner auch siehst das hier VORHER umsetzen!! => http://www.trojaner-board.de/59624-a...-sichtbar.html

Hauptlogs nach Scans (Quick, Full oder Flash):

XP:
C:\Dokumente und Einstellungen\(USER)\Anwendungsdaten\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt
Vista, Windows 7, 2008:
C:\Users\(USER)\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-yyyy-mm-dd.txt

doradxo · 08.06.2012, 18:04

Leider die selben Logs wie auch im Programm selbst. Alle 5 Logs mit den beiden selben Funden wie oben beschrieben.

cosinus · 08.06.2012, 18:22

Ok, vllt wären da ja doch noch Logs gewesen

Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

doradxo · 08.06.2012, 18:44

1. Soweit schon. In die Dienste unter Verwaltung komme ich nicht rein/wird mir nichts angezeigt. Auch das SMART HDD Programm öffnet sich nicht mehr.

2. Startmenü komplett leergefegt. Deshalb kann ich zb. auch nicht in Paint um Screenshots zu machen

Habe die Voll-Scans im "normalen" Windows Modus durchgeführ. Hätte ich die im abgesichertem Modus (+ Netzwerktreiber) durchführen sollen oder macht das keinen Unterschied?

Danke!

cosinus · 08.06.2012, 18:56

Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )

Vista und 7 User müssen das Tool per Rechtsklick als Administrator ausführen!

Es kann sein, dass man die Startmenüeinträge unter "Alle Programme" und darunter nicht mehr wiederbekommt ohne Backup!

doradxo · 08.06.2012, 19:38

Super, hat wunderbar geklappt, alles wieder da!

Code:

ATTFilter

Unhide by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
  hxxp://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 06/08/2012 08:27:39 PM
Windows Version: Windows 7

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 84581 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 32298 files processed.

The C:\Users\Papa\AppData\Local\Temp\smtmp\ folder does not exist!!
Unhide cannot restore your missing shortcuts!!
Please see this topic in order to learn how to restore default
Start Menu shortcuts: hxxp://www.bleepingcomputer.com/forums/topic405109.html

Searching for Windows Registry changes made by FakeHDD rogues.
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System
  * DisableTaskMgr policy was found and deleted!
 - Checking HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop
  * HidNoChangingWallPaperden policy was found and deleted!
 - Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  * Start_ShowControlPanel was set to 0! It was set back to 1!
  * Start_ShowHelp was set to 0! It was set back to 1!
  * Start_ShowMyDocs was set to 0! It was set back to 1!
  * Start_ShowMyMusic was set to 0! It was set back to 1!
  * Start_ShowMyPics was set to 0! It was set back to 1!
  * Start_ShowPrinters was set to 0! It was set back to 1!
  * Start_ShowRun was set to 0! It was set back to 1!
  * Start_ShowSetProgramAccessAndDefaults was set to 0! It was set back to 1!
  * Start_ShowRecentDocs was set to 0! It was set back to 2!
  * Start_ShowNetConn was set to 0! It was set back to 1!
  * Start_ShowNetPlaces was set to 0! It was set back to 1!
  * Start_TrackDocs was set to 0! It was set back to 1!
  * Start_TrackProgs was set to 0! It was set back to 1!
  * Start_ShowUser was set to 0! It was set back to 1!
  * Start_ShowMyGames was set to 0! It was set back to 1!

Restarting Explorer.exe in order to apply changes.

Program finished at: 06/08/2012 08:29:37 PM
Execution time: 0 hours(s), 1 minute(s), and 58 seconds(s)

Was kommt als nächstes? Viren löschen?

cosinus · 08.06.2012, 19:55

Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:

ATTFilter

 hier steht das Log

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Setze oben mittig den Haken bei Scanne alle Benutzer
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

Code:

ATTFilter

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf .
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

doradxo · 10.06.2012, 18:52

Sorry für das Warten

Code:

ATTFilter

OTL logfile created on: 10.06.2012 15:40:23 - Run 3
OTL by OldTimer - Version 3.2.46.1     Folder = C:\Users\Papa\Desktop
 Enterprise Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1023,37 Mb Total Physical Memory | 623,38 Mb Available Physical Memory | 60,91% Memory free
2,00 Gb Paging File | 1,18 Gb Available in Paging File | 59,04% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 8,64 Gb Free Space | 17,70% Space Free | Partition Type: NTFS
Drive D: | 184,05 Gb Total Space | 43,30 Gb Free Space | 23,53% Space Free | Partition Type: NTFS
Drive E: | 27,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.05 20:25:01 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe
PRC - [2012.05.08 20:44:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.08 20:44:40 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 20:44:40 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 20:44:40 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.02.02 15:32:52 | 000,018,432 | ---- | M] () -- C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFoxUpdater.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.03.28 21:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.10.06 13:39:27 | 002,002,728 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe
PRC - [2009.07.14 03:14:41 | 000,354,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\StikyNot.exe
PRC - [2009.07.14 03:14:24 | 000,157,184 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2009.04.14 16:43:42 | 000,604,704 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Windows\SOUNDMAN.EXE
PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.07.18 23:04:08 | 000,296,448 | ---- | M] () -- C:\Programme\Notepad++\NppShell_04.dll
MOD - [2011.03.02 13:40:51 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.05.08 20:44:42 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.08 20:44:40 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.04.25 18:45:53 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 07:53:50 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.02.02 15:32:52 | 000,018,432 | ---- | M] () [Auto | Running] -- C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFoxUpdater.exe -- (ReminderFoxUpdater)
SRV - [2011.03.28 21:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.11.20 23:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2010.11.20 23:29:48 | 000,128,848 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing)
SRV - [2010.11.20 23:29:32 | 000,068,096 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\Mcx2Svc.dll -- (Mcx2Svc)
SRV - [2010.10.06 13:39:27 | 002,002,728 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 03:15:41 | 000,075,264 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\mprdim.dll -- (RemoteAccess)
SRV - [2009.07.14 03:15:33 | 000,300,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\ipnathlp.dll -- (SharedAccess)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\athr.sys -- (athr)
DRV - [2012.05.08 20:44:42 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012.05.08 20:44:42 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.19 17:56:15 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.11.20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 23:29:12 | 000,246,784 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\udfs.sys -- (udfs)
DRV - [2010.11.20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - [2010.11.20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV - [2010.11.20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010.11.20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.11.20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt)
DRV - [2010.11.20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.07.08 15:17:56 | 000,603,240 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su)
DRV - [2010.06.17 16:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.07.14 03:20:28 | 000,022,096 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\crcdisk.sys -- (crcdisk)
DRV - [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ws2ifsl.sys -- (ws2ifsl)
DRV - [2009.07.14 01:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | System | Running] -- C:\Windows\System32\drivers\serial.sys -- (Serial)
DRV - [2009.07.14 00:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.07.14 00:02:53 | 000,048,128 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SiSGB6.sys -- (SiSGbeLH)
DRV - [2009.06.19 04:45:02 | 004,172,832 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVAC.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
 
 
 
 
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.ask.com/?l=dis&o=15003
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3F 65 A3 19 9E B2 CC 01  [binary data]
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=&src=crm&q={searchTerms}&locale=
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.04.25 18:45:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011.12.04 18:18:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions
[2012.05.18 21:46:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\g19lbimn.default\extensions
[2010.02.04 16:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\g19lbimn.default\searchplugins\askcom.xml
[2012.01.10 13:04:29 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.06 02:19:41 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\PAPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G19LBIMN.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.05.18 21:46:04 | 000,045,066 | ---- | M] () (No name found) -- C:\USERS\PAPA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\G19LBIMN.DEFAULT\EXTENSIONS\{EF522540-89F5-46B9-B6FE-1829E2B572C6}.XPI
[2012.04.25 18:45:52 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.10 13:04:24 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 13:04:24 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.01.10 13:04:24 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 13:04:23 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 13:04:23 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 13:04:23 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (ReminderFox) - {7C9B39E6-6606-4ED2-8A3F-36E39C78CBDC} - C:\Users\Papa\AppData\LocalLow\ReminderFox\IE\ReminderFox.dll (Tom Mutdosch)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [SoundMan] C:\Windows\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-229958436-3033542292-740978725-1001..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{912531D1-61FC-42AA-8642-E1626A7CD00D}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FAE7AF95-9DE3-4248-8CA3-C99FD1B8FB94}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - State: "bootini" - 2
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.10 08:57:36 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{39DFE7CC-F179-40D3-AB17-84EF3D5BB858}
[2012.06.10 08:57:24 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{961262F1-ABE8-49C8-A9A5-40608AFBC9DA}
[2012.06.09 21:27:19 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{685F6346-1AE4-43C6-AF1C-A5A1964928A7}
[2012.06.09 21:27:06 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5E8E935F-B78F-4348-AEC9-0CC5B5D68D2A}
[2012.06.09 11:27:41 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{39DD5FB5-D2E0-490A-BB0A-39F4AC3F1D9B}
[2012.06.09 11:27:22 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{008F0399-2AB5-4A6D-ABB6-9C57396BF057}
[2012.06.08 20:37:24 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{02C10E11-6DF0-45CF-9213-61A5271B98B0}
[2012.06.08 20:37:07 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{CF062DDE-D9A0-42B7-9381-2E8F81421E81}
[2012.06.08 15:50:21 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\vlc
[2012.06.08 15:49:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012.06.08 15:29:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.08 15:29:56 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.08 15:29:12 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.06.08 15:23:20 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{F99E458B-FF81-46A2-A826-1FA5C340ED8E}
[2012.06.08 15:23:06 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5E45C827-A1E5-4F26-8432-DE815709FAEE}
[2012.06.06 15:51:43 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2170E591-2EB0-4F5A-9E09-0D04692810CB}
[2012.06.06 15:51:28 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{CE1EDE98-1D34-4ED6-86D0-89A5E09B297D}
[2012.06.06 12:59:11 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5AEFC125-A989-4226-91EB-9BE3F248AC59}
[2012.06.06 12:58:55 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{A62E8B6F-B341-43DD-BA51-FF1DBFF10B8E}
[2012.06.05 20:39:10 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{8754FD24-2089-4440-8AA6-D6A56352158D}
[2012.06.05 20:38:58 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{3B0A1F8E-2E55-427B-8FD2-C9ED54633922}
[2012.06.05 20:25:01 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe
[2012.06.05 19:05:04 | 000,399,264 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Papa\Desktop\unhide.exe
[2012.06.05 19:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.06.05 16:56:35 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.05 16:54:17 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{567F4701-CD60-4A3B-82DC-3AFF260CE38C}
[2012.06.05 16:54:05 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{72552B9F-4DAA-4449-81A5-6B6F207BF0F0}
[2012.06.05 16:40:17 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{342C47B4-85A1-453A-B58D-784A91570916}
[2012.06.05 16:40:02 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{416BA68D-00E5-4111-AA53-77FB8275CDD7}
[2012.06.05 16:22:13 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2012.06.05 16:21:34 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{E0C4FA3E-A49D-4B16-889B-F8F22ADA2CFE}
[2012.06.05 16:21:18 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{38C21B59-41FD-452E-88ED-5180354F6B00}
[2012.06.05 16:12:13 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{B7BCB83D-941B-4324-AC39-0379C9E0A64A}
[2012.06.05 16:11:58 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{14CA174B-BBF7-4456-86A1-36F866B96EF2}
[2012.06.05 16:03:46 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes
[2012.06.05 16:03:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.05 15:47:51 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5E8B2EAD-9A30-4BDB-B062-632718FFD8B7}
[2012.06.05 15:47:37 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{DF0B0C8A-6EB2-4313-B098-FDDAA669B242}
[2012.06.04 20:53:59 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{AE0C8901-128B-4BF4-BC22-F7DA5C34BD6F}
[2012.06.04 20:53:44 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{96463A6C-25AB-4750-AF84-414984C0EA7D}
[2012.06.04 20:31:16 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{04CF649D-F25B-439E-92C7-7B97E463E93B}
[2012.06.04 20:31:01 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{E671A195-DC30-4C08-9DF7-E226595C82CA}
[2012.06.04 20:20:16 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{1F355A69-86AE-4C0B-A9E8-571371875EA2}
[2012.06.04 20:19:54 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{6DD15C57-58BF-4183-8BFE-A646A1716BB5}
[2012.06.04 10:44:21 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{58B87E9C-DA9D-40D4-AEEE-5278D8C99B4F}
[2012.06.04 10:44:03 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{EE61A34B-BE4E-4C81-A5F2-1FF96907F309}
[2012.06.03 09:55:31 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{1A29B715-5FB8-4185-90F9-566B1D7BC1DB}
[2012.06.03 09:55:17 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{AFDAB24F-1AB3-4156-A35B-3FD62790F75A}
[2012.06.02 11:05:20 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{BFEF408C-4C13-4B10-8AFD-F0D9ADD5C233}
[2012.06.02 11:05:06 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5A1FA7C4-6628-4A1D-AB7D-F9A6D51AF932}
[2012.06.01 12:54:27 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{D8DBDB1F-58DC-407D-85E1-E3EE13DD2E41}
[2012.06.01 12:54:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{47AFAC0D-CB99-4BA9-A093-E9A3A86A1BCE}
[2012.05.31 10:56:28 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2CEBC841-F9E2-4B0D-8232-9064BF61CBA1}
[2012.05.31 10:56:15 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{4F089928-2E0A-4A26-9807-87B63C990E25}
[2012.05.30 07:38:44 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{F5AE28B3-6DE3-48D3-8FF5-421302085DDA}
[2012.05.30 07:38:32 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{6623ABA8-D3AE-4AC2-9213-29C4C9949FD7}
[2012.05.29 17:42:37 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{1D634638-028C-4118-B2D8-5A4504F5F2A4}
[2012.05.29 17:42:26 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{19121182-309B-4B64-8981-77A4D198A6BE}
[2012.05.29 11:38:04 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{45A6CE6A-C470-41A8-B618-700AC2FD6C3C}
[2012.05.29 11:37:51 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{6AA138F5-451C-492E-8D44-B51AD8ED3793}
[2012.05.28 12:38:05 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7118A9DF-58AC-4F5B-901D-5788AC12FE50}
[2012.05.28 12:37:50 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{3C6DD5B9-D211-4288-BEAC-5655B0FF0F41}
[2012.05.28 11:03:03 | 000,000,000 | ---D | C] -- C:\Users\Papa\Desktop\constant
[2012.05.28 10:21:13 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{DEFCA69D-7C8F-4127-98FF-C007DAD21B42}
[2012.05.28 10:21:01 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{FD29CFEB-2843-46A7-8644-2FBB5DB8E2AF}
[2012.05.27 19:37:14 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{147FD708-6CCF-4D72-ACEB-DDE0571283B9}
[2012.05.27 19:37:01 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{A8036F5E-19D1-43BA-8ADA-3ECC19BB0190}
[2012.05.27 13:30:35 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7F797455-42E2-4E09-A1BF-16C652FF3BF4}
[2012.05.27 13:30:22 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2A55F9A4-3670-481F-ACC4-A6301BB76665}
[2012.05.26 20:49:33 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7AFE2D5E-CB94-4825-A152-64ADCE5004CF}
[2012.05.26 20:49:20 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{10ECD97D-BC58-4128-8420-9327EE2D1B3C}
[2012.05.26 13:30:52 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{BA89A8F3-CBC6-4BAB-BB8A-268691FB4FFC}
[2012.05.26 13:30:39 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{634593C5-F5CD-4A72-B75C-030FD3E11251}
[2012.05.25 13:12:29 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{53053DF1-2A69-47F8-97EC-23D792C32311}
[2012.05.25 13:12:17 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{14FB3BC9-74F0-4512-B1FB-58E01A5EE743}
[2012.05.24 17:36:54 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{CAF704B4-D5DB-45BF-B8C7-F42657B2875D}
[2012.05.24 17:36:41 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{F97248C0-6CE9-401A-A51E-951E04D73E19}
[2012.05.24 13:34:13 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{FDC99826-0B7F-44A8-86A9-A5342071121F}
[2012.05.24 13:33:57 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{1891A197-5A71-4057-B736-7F24A1580494}
[2012.05.23 14:54:19 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{493527C3-CC2B-4EC4-8528-DA82AB280721}
[2012.05.23 14:54:05 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{9C124CCD-430F-4CD6-873B-486B77F1AE2A}
[2012.05.23 12:12:06 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{0C02B509-FC0E-479B-9DF8-8EA79361507C}
[2012.05.23 12:11:43 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2718D657-B738-46E2-9038-03C9FA35638D}
[2012.05.22 22:10:44 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{212F6CDF-37D9-4A9E-93C4-02E79DBE0683}
[2012.05.22 22:10:28 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7DA3DDE4-6D9E-40FD-8006-5E5FAE9DB281}
[2012.05.22 17:08:36 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{15C137FF-0571-451F-A26A-C50412589253}
[2012.05.22 17:08:24 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{EF064E51-57BB-47B8-8A03-4581779867C5}
[2012.05.22 11:24:52 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7237FBDF-F919-4624-8C62-4EFDD33FC6B3}
[2012.05.22 11:24:38 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{88DB296A-544B-4CF5-948E-4539568B9CB5}
[2012.05.21 08:42:57 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{CEE6460F-F765-4515-8744-57D607B3FDD3}
[2012.05.21 08:42:45 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{AC2C7175-326F-4D3E-B1CD-34F8692C4BEA}
[2012.05.20 20:41:53 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{3FB0EE10-D415-4956-BC39-7DC28527EF50}
[2012.05.20 20:41:35 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{1C2EB092-6F6B-40F2-9EDC-43185C493646}
[2012.05.20 11:08:25 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{3C0CFCE6-C484-47E3-B8AD-58D0544A7A1A}
[2012.05.20 11:08:08 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{6351F482-77E5-40DF-BF23-E8690BE998D9}
[2012.05.19 11:07:06 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{6F834B9E-A37C-4CEB-87EA-C97E244A4957}
[2012.05.19 11:06:54 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{EA450B07-26B6-4D2D-BB8E-2A4F574AEBC6}
[2012.05.18 15:45:27 | 000,000,000 | ---D | C] -- C:\Users\Papa\Desktop\Konwerter NewCamd  to CCcam
[2012.05.18 10:29:26 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{DBB231FF-A2BC-4C98-B939-E2BDBAFC062B}
[2012.05.18 10:29:14 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{94E32B42-EBA9-4F3D-AFD9-D1CB22AC247F}
[2012.05.18 08:14:02 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{7B3923B4-242E-46AE-8CB1-416B0F5C9E2D}
[2012.05.18 08:13:48 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{5C69526C-3970-4F34-AA3A-8B045ECD05D4}
[2012.05.17 09:32:34 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{FB6BBD76-4C7D-4B12-9392-7B5C5AE42216}
[2012.05.17 09:32:21 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{E01EC915-0029-4469-94CA-B8CD81CEC5C8}
[2012.05.16 17:16:59 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\www.coolstream.to
[2012.05.16 17:12:42 | 000,000,000 | ---D | C] -- C:\Users\Papa\Desktop\OscamConfigCreator_12.10.10
[2012.05.16 16:47:47 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.05.16 16:47:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
[2012.05.16 16:47:43 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Roaming\Notepad++
[2012.05.16 16:47:43 | 000,000,000 | ---D | C] -- C:\Program Files\Notepad++
[2012.05.16 09:10:03 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{76A0036B-1D34-4648-91C2-B55471AD4909}
[2012.05.16 09:09:50 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{43DE9C3D-52BF-41BA-A656-5F6CA0BAEFB8}
[2012.05.15 20:11:12 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{D28DB45E-3DD6-4225-B832-8FBC6402F6C7}
[2012.05.15 20:10:58 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{8E138424-282F-4D1C-99B0-8B29D31AD305}
[2012.05.15 12:09:28 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{36D0E92C-6880-4057-8FC0-D858055B25A7}
[2012.05.15 12:09:07 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{C237307C-C2BE-4938-8760-0B3A4117B197}
[2012.05.14 20:16:17 | 000,000,000 | ---D | C] -- C:\Users\Papa\Desktop\control
[2012.05.14 18:29:40 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{00DA534E-7568-4222-8847-14807009FF83}
[2012.05.14 18:29:28 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{4681A1E4-6EAF-428A-A3C4-2009A89387D9}
[2012.05.14 08:43:53 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2FD44F2E-7582-49D1-9EEF-CAB7F9ECB28D}
[2012.05.14 08:43:41 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{C7743720-4100-4064-AEE7-6873E56B7CD2}
[2012.05.13 09:44:46 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{2888B1D6-1B00-4A7B-B601-6433FAF23F02}
[2012.05.13 09:44:34 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{24896A5B-9899-447E-A9B6-C604BF5558D9}
[2012.05.12 14:13:39 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{8C6E7227-1470-420C-B35A-5768825D0047}
[2012.05.12 14:13:27 | 000,000,000 | ---D | C] -- C:\Users\Papa\AppData\Local\{A7CDB154-8A1E-46C9-BEC5-95F9A767C5C8}
[2011.12.04 18:18:45 | 385,086,637 | ---- | C] (Microsoft Corporation) -- C:\Program Files\Microsoft Office Word 2007.exe
[2011.12.04 18:06:30 | 029,032,448 | ---- | C] (Driver-Soft Inc.) -- C:\Program Files\Driver Genius Professional Edition.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.10 14:58:56 | 000,024,192 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.10 14:58:56 | 000,024,192 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.10 08:56:45 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2012.06.10 08:56:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.10 08:56:06 | 804,806,656 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.08 15:49:59 | 000,001,056 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.08 15:29:57 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.05 20:25:01 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Papa\Desktop\OTL.exe
[2012.06.05 20:20:35 | 000,000,000 | ---- | M] () -- C:\Users\Papa\defogger_reenable
[2012.06.05 19:05:04 | 000,399,264 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Papa\Desktop\unhide.exe
[2012.06.04 20:20:55 | 000,000,184 | ---- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3Or
[2012.06.04 20:20:55 | 000,000,000 | ---- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3O
[2012.06.04 20:20:51 | 000,000,256 | ---- | M] () -- C:\ProgramData\AKfPlKyjpi5W3O
[2012.06.03 18:25:33 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.03 18:25:33 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.03 18:25:33 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.03 18:25:33 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.05.16 16:47:47 | 000,001,021 | ---- | M] () -- C:\Users\Papa\Desktop\Notepad++.lnk
[2012.05.13 09:43:00 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.08 15:49:13 | 000,001,056 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2012.06.08 15:29:57 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.06.05 20:20:35 | 000,000,000 | ---- | C] () -- C:\Users\Papa\defogger_reenable
[2012.06.04 20:20:55 | 000,000,184 | ---- | C] () -- C:\ProgramData\-AKfPlKyjpi5W3Or
[2012.06.04 20:20:55 | 000,000,000 | ---- | C] () -- C:\ProgramData\-AKfPlKyjpi5W3O
[2012.06.04 20:20:50 | 000,000,256 | ---- | C] () -- C:\ProgramData\AKfPlKyjpi5W3O
[2012.05.18 16:20:02 | 000,627,200 | ---- | C] () -- C:\Users\Papa\Desktop\cccam2oscam.exe
[2012.05.16 16:47:47 | 000,001,021 | ---- | C] () -- C:\Users\Papa\Desktop\Notepad++.lnk
[2011.12.14 23:05:14 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011.12.13 18:33:27 | 000,299,008 | R--- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2011.12.04 18:49:03 | 000,154,144 | ---- | C] () -- C:\Windows\System32\RTLCPAPI.dll
[2011.12.04 17:55:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2011.12.04 17:55:25 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2011.04.12 04:17:04 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 04:17:04 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 04:17:04 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 04:17:04 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2010.11.20 23:29:34 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2010.11.20 23:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
 
========== LOP Check ==========
 
[2012.01.31 15:20:15 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Canneverbe Limited
[2012.02.19 17:54:25 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\elsterformular
[2011.12.19 19:09:22 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\GHISLER
[2012.05.16 16:49:16 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Notepad++
[2012.03.02 13:59:06 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\SatChannelListEditor
[2011.12.04 18:33:29 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\TeamViewer
[2012.06.06 18:33:29 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\uTorrent
[2011.12.22 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Windows Live Writer
[2012.06.10 08:56:45 | 000,000,266 | ---- | M] () -- C:\Windows\Tasks\AutoKMS.job
[2012.06.09 11:26:22 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.04.25 17:46:47 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Adobe
[2011.12.04 18:21:30 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Avira
[2012.01.31 15:20:15 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Canneverbe Limited
[2012.01.24 21:57:15 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\dvdcss
[2012.02.19 17:54:25 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\elsterformular
[2011.12.19 19:09:22 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\GHISLER
[2011.12.04 18:01:12 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Identities
[2011.12.04 18:40:38 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Macromedia
[2012.06.05 16:03:46 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Malwarebytes
[2011.04.12 04:22:24 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Media Center Programs
[2012.04.25 17:46:47 | 000,000,000 | --SD | M] -- C:\Users\Papa\AppData\Roaming\Microsoft
[2011.12.04 18:18:03 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Mozilla
[2011.12.04 18:44:22 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Nero
[2012.05.16 16:49:16 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Notepad++
[2012.03.02 13:59:06 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\SatChannelListEditor
[2011.12.04 18:33:29 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\TeamViewer
[2012.06.06 18:33:29 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\uTorrent
[2012.06.09 13:41:35 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\vlc
[2012.06.09 11:43:13 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Winamp
[2011.12.22 14:03:47 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\Windows Live Writer
[2011.12.04 18:30:04 | 000,000,000 | ---D | M] -- C:\Users\Papa\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2009.06.25 19:07:56 | 000,333,541 | ---- | M] () -- C:\Users\Papa\AppData\Roaming\Nero\Uninstall.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2010.11.20 23:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 23:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 23:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 23:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2010.11.20 23:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 23:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2010.11.20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 23:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 23:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 23:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 23:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 23:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
<           >

< End of report >

cosinus · 10.06.2012, 20:18

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

ATTFilter

:OTL
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://de.ask.com/?l=dis&o=15003
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3F 65 A3 19 9E B2 CC 01  [binary data]
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-229958436-3033542292-740978725-1001\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=SPC2&o=&src=crm&q={searchTerms}&locale=
[2010.02.04 16:45:40 | 000,002,254 | ---- | M] () -- C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\g19lbimn.default\searchplugins\askcom.xml
O2 - BHO: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Sopcast Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask.com)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
[2012.06.04 20:20:55 | 000,000,184 | ---- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3Or
[2012.06.04 20:20:55 | 000,000,000 | ---- | M] () -- C:\ProgramData\-AKfPlKyjpi5W3O
[2012.06.04 20:20:51 | 000,000,256 | ---- | M] () -- C:\ProgramData\AKfPlKyjpi5W3O
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

doradxo · 10.06.2012, 21:03

Code:

ATTFilter

All processes killed
========== OTL ==========
HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Programme\Ask.com\GenericAskToolbar.dll moved successfully.
HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\ not found.
C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\g19lbimn.default\searchplugins\askcom.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Programme\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\S-1-5-21-229958436-3033542292-740978725-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
C:\ProgramData\-AKfPlKyjpi5W3Or moved successfully.
C:\ProgramData\-AKfPlKyjpi5W3O moved successfully.
C:\ProgramData\AKfPlKyjpi5W3O moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Papa
->Temp folder emptied: 437622 bytes
->Temporary Internet Files folder emptied: 4337512 bytes
->Java cache emptied: 334775 bytes
->FireFox cache emptied: 261858683 bytes
->Flash cache emptied: 3528 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 1525878 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11138 bytes
RecycleBin emptied: 429262526 bytes
 
Total Files Cleaned = 665,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Papa
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.46.1 log created on 06102012_215745

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

08.06.2012, 17:20	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	S.M.A.R.T. HDD bzw. Win32/Kryptik.AGML Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt? Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind. __________________ Logfiles bitte immer in CODE-Tags posten

08.06.2012, 18:22	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	S.M.A.R.T. HDD bzw. Win32/Kryptik.AGML Ok, vllt wären da ja doch noch Logs gewesen Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? __________________ Logfiles bitte immer in CODE-Tags posten

S.M.A.R.T. HDD bzw. Win32/Kryptik.AGML

Log-Analyse und Auswertung: S.M.A.R.T. HDD bzw. Win32/Kryptik.AGML