|
Log-Analyse und Auswertung: Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & VideoWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.08.2012, 01:14 | #1 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Hallo, seit drei Tagen kann ich nicht mehr an meinem Netbook (msi U100 mit Intel Atom N270 1,6GHz, 1GB RAM, Win XP) arbeiten. Der CPU ist dauerhaft zwischen 30% und 100% ausgelastet. Auslagerungsdatei liegt immer bei ca. 500MB. Mauscursor ruckelt oft, Videos und Sounds haken, springen oder laufen in Zeitlupe. Vor allem Cubase ist nicht mehr nutzbar. Gestern gab es zweimal Bluescreen bei Überlastung. Evtl. habe ich mir was von einer externen Festplatte oder aus dem Netz gefangen?! Folgendes habe ich bisher getan: - Virencheck mit avast! Ergebnis: negativ - Trojanersuche mit "stinger": negativ - alle unnötigen Programme/Dienste per "msconfig" dauerhaft beendet. - chipset treiber und realtek hd treiber aktualisiert - Lüfter kontrolliert und gesäubert - mit everest temperaturen geprüft (alles zwischen 35 und 50 Grad) ..habe jetzt nur noch 35 Prozesse am Laufen und es gibt keine Verbesserung. Vielleicht ist ja etwas unten in der Hijackthis-Analyse erkennbar. Gruß, musiker0815 |
05.08.2012, 13:33 | #2 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Bitte keine Hijackthis-Logfiles posten!!!
__________________Zitat:
Bitte erstmal routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
07.08.2012, 14:16 | #3 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Hallo und vielen Dank für die ersten Anweisungen!
__________________Hier schonmal der Vollscan von Malwarebytes: Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.06.05 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 a :: AAA [Administrator] 06.08.2012 11:04:36 mbam-log-2012-08-06 (11-04-36).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 259734 Laufzeit: 2 Stunde(n), 26 Minute(n), 58 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings|ProxyServer (PUM.Bad.Proxy) -> Daten: http=127.0.0.1:50727 -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\Dokumente und Einstellungen\a\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\41\56ff0529-2c0c216b (Trojan.Zbot.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Temp\ms0cfg32.exe (Trojan.Zbot.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\RECYCLER\S-1-5-21-2892847056-2553114750-292287643-1005\Dc1.exe (PUP.Adware.MediaGet) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) ps.: Das MediaGet-Programm kam mit einem GratisDownload eines Festplattenwiederherstellungsprogramms. Habs versehentlich installiert, weil ich dachte, dass es das eigentliche Programm sei. Habe es gleich wieder gelöscht. ESET-Scan folgt!! Und hier kommt nun der ESET-Scan: Code:
ATTFilter ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=53b7689286a3ec4b8795317bd6a7416b # end=stopped # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-07 01:46:16 # local_time=2012-08-07 03:46:16 (+0100, Westeuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 584 584 0 0 # scanned=29180 # found=2 # cleaned=0 # scan_time=4505 C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0001\opr00061.tmp JS/Kryptik.MI trojan (unable to clean) 00000000000000000000000000000000 I C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Temp\jar_cache4924472886758242653.tmp multiple threats (unable to clean) 00000000000000000000000000000000 I ESETSmartInstaller@High as downloader log: all ok # version=7 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6583 # api_version=3.0.2 # EOSSerial=53b7689286a3ec4b8795317bd6a7416b # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=true # unsafe_checked=false # antistealth_checked=true # utc_time=2012-08-08 09:08:04 # local_time=2012-08-08 11:08:04 (+0100, Westeuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=512 16777215 100 0 0 0 0 0 # compatibility_mode=8192 67108863 100 0 65577 65577 0 0 # scanned=45830 # found=2 # cleaned=0 # scan_time=9216 C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0001\opr00061.tmp JS/Kryptik.MI trojan (unable to clean) 00000000000000000000000000000000 I C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Temp\jar_cache4924472886758242653.tmp multiple threats (unable to clean) 00000000000000000000000000000000 I |
08.08.2012, 15:33 | #4 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt? Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________ Logfiles bitte immer in CODE-Tags posten |
08.08.2012, 16:44 | #5 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Hallo Arne, es war der erste Scan mit Malwarebytes. Es gibt nur den, den ich gepostet habe. Gruß, Musiker0815 |
09.08.2012, 13:19 | #6 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren Downloade Dir bitte AdwCleaner auf deinen Desktop.
__________________ --> Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video |
09.08.2012, 13:59 | #7 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & VideoCode:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/09/2012 at 14:57:02 # Updated 01/08/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : a - AAA # Running from : C:\Dokumente und Einstellungen\a\Eigene Dateien\Downloads\adwcleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Found : HKCU\Software\DataMngr Key Found : HKCU\Software\ilivid Key Found : HKCU\Software\SweetIm Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1 Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1 Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1 Key Found : HKLM\SOFTWARE\SweetIM Key Found : HKLM\SOFTWARE\Wise Solutions ***** [Registre - GUID] ***** Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A} Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. -\\ Opera v11.64.1403.0 File : C:\Dokumente und Einstellungen\a\anwendungsdaten\Opera\Opera\operaprefs.ini [OK] File is clean. ************************* AdwCleaner[R1].txt - [2553 octets] - [09/08/2012 14:57:02] ########## EOF - C:\AdwCleaner[R1].txt - [2681 octets] ########## |
10.08.2012, 18:18 | #8 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
__________________ Logfiles bitte immer in CODE-Tags posten |
10.08.2012, 23:11 | #9 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & VideoCode:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/11/2012 at 00:00:02 # Updated 01/08/2012 by Xplode # Operating system : Microsoft Windows XP Service Pack 3 (32 bits) # User : a - AAA # Running from : C:\Dokumente und Einstellungen\a\Eigene Dateien\Downloads\adwcleaner.exe # Option [Delete] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** Key Deleted : HKCU\Software\DataMngr Key Deleted : HKCU\Software\ilivid Key Deleted : HKCU\Software\SweetIm Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1 Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1 Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1 Key Deleted : HKLM\SOFTWARE\SweetIM Key Deleted : HKLM\SOFTWARE\Wise Solutions ***** [Registre - GUID] ***** Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F3FEE66E-E034-436A-86E4-9690573BEE8A} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F3FEE66E-E034-436A-86E4-9690573BEE8A} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EEE6C35B-6118-11DC-9C72-001320C79847}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}] ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.6001.18702 [OK] Registry is clean. -\\ Opera v11.64.1403.0 File : C:\Dokumente und Einstellungen\a\anwendungsdaten\Opera\Opera\operaprefs.ini [OK] File is clean. ************************* AdwCleaner[R1].txt - [2682 octets] - [09/08/2012 14:57:02] AdwCleaner[S1].txt - [292 octets] - [10/08/2012 23:59:22] AdwCleaner[S2].txt - [2720 octets] - [11/08/2012 00:00:02] ########## EOF - C:\AdwCleaner[S2].txt - [2848 octets] ########## |
11.08.2012, 17:48 | #10 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Hätte da mal zwei Fragen bevor es weiter geht 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?
__________________ Logfiles bitte immer in CODE-Tags posten |
11.08.2012, 20:32 | #11 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Guten Abend, 1.) Geht der normale Modus von Windows (wieder) uneingeschränkt? Der normale Modus von Windows ist weiterhin eingeschränkt: Schon beim Hochfahren ist die Windowsmelodie nicht flüssig. Videos und Vidoes im Netz laufen teils mit einigen Knacksern. Sobald ich einen weiteren Tab (oder weiteres Programm) öffne, reicht die Kapazität nicht mehr aus. Gestern gab es zum 3ten Mal innerhalb weniger Tage Bluescreen. Hauptproblem ist wohl die CPU-Auslastung. Verantwortlich dafür ist laut Taskmanager wohl "services.exe". CPU-Auslastung ist immer ca.5% über sevices.exe. Sevices.exe geht momentan teilweise bis 36% hoch. Vll bringt diese Info etwas. 2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden? Es ist alles vorhanden und keine leeren Ordner unter "alle Programme". Die Hälfte aller Ordner haben dort jedoch nur eine Art Windows Ordnersymbol. Aber alles ist zu öffnen. Allerdings ist bei ca. jedem zweiten Systemstart auf die komplette untere Desktopleiste inkl. "Startsymbol" unten links nicht mit Mousecurser zuzugreifen. Dies ist allerdings schon vor Monaten immer mal wieder für eine Woche aufgetreten und dann wieder einige Wochen nicht. |
11.08.2012, 21:29 | #12 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start wininit.exe userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
11.08.2012, 22:42 | #13 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video OTL Logfile: Code:
ATTFilter OTL logfile created on: 11.08.2012 22:38:22 - Run 1 OTL by OldTimer - Version 3.2.57.0 Folder = C:\Dokumente und Einstellungen\a\Eigene Dateien\Downloads Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1013,23 Mb Total Physical Memory | 655,88 Mb Available Physical Memory | 64,73% Memory free 3,83 Gb Paging File | 3,58 Gb Available in Paging File | 93,55% Paging File free Paging file location(s): C:\pagefile.sys 3000 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 39,07 Gb Total Space | 9,76 Gb Free Space | 24,99% Space Free | Partition Type: NTFS Drive D: | 106,07 Gb Total Space | 105,79 Gb Free Space | 99,73% Space Free | Partition Type: NTFS Computer Name: AAA | User Name: a | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.11 22:30:11 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\a\Eigene Dateien\Downloads\OTL.exe PRC - [2012.07.03 18:21:30 | 004,273,976 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastUI.exe PRC - [2012.07.03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe PRC - [2012.01.18 14:02:04 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2012.08.11 19:43:37 | 001,792,512 | ---- | M] () -- C:\Programme\AVAST Software\Avast\defs\12081101\algo.dll MOD - [2006.11.27 09:50:22 | 000,117,760 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\lxcrpp5c.dll ========== Win32 Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2012.07.30 09:10:17 | 000,113,120 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.03 18:21:29 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Programme\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus) SRV - [2010.05.08 13:48:36 | 000,229,376 | ---- | M] () [Disabled | Stopped] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService\DCService.exe -- (DCService.exe) SRV - [2010.03.04 23:38:00 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess) SRV - [2008.06.09 17:26:52 | 000,159,744 | ---- | M] () [Disabled | Stopped] -- C:\Programme\System Control Manager\MSIService.exe -- (Micro Star SCM) SRV - [2008.04.14 14:00:00 | 000,105,472 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\system32\p2pgasvc.dll -- (p2pgasvc) SRV - [2008.04.14 14:00:00 | 000,036,864 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\iprip.dll -- (Iprip) SRV - [2006.12.11 18:12:06 | 000,537,520 | ---- | M] ( ) [Disabled | Stopped] -- C:\WINDOWS\system32\lxcrcoms.exe -- (lxcr_device) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfusb.sys -- (Tosrfusb) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tosrfsnd.sys -- (TosRfSnd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfnds.sys -- (tosrfnds) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\Tosrfhid.sys -- (Tosrfhid) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\tosrfcom.sys -- (Tosrfcom) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\tosrfbnp.sys -- (tosrfbnp) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosrfbd.sys -- (tosrfbd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\tosporte.sys -- (tosporte) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\cmnsusbser.sys -- (cmnsusbser) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - [2012.07.03 18:21:54 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2012.07.03 18:21:53 | 000,721,000 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2012.07.03 18:21:53 | 000,353,688 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2012.07.03 18:21:53 | 000,097,608 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2012.07.03 18:21:53 | 000,035,928 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr) DRV - [2012.07.03 18:21:53 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2012.07.03 18:21:52 | 000,025,256 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2012.06.19 16:54:20 | 006,141,584 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2010.04.09 15:24:12 | 000,063,616 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys -- (huawei_enumerator) DRV - [2010.03.25 10:08:30 | 000,105,728 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard) DRV - [2010.03.20 11:56:04 | 000,101,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev) DRV - [2010.03.20 10:28:00 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet) DRV - [2010.02.11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009.11.12 14:48:56 | 000,005,504 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2008.08.05 20:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2008.07.10 19:33:40 | 000,306,176 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\rtl8187Se.sys -- (rtl8187Se) DRV - [2008.06.11 05:23:07 | 000,106,368 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2008.06.11 05:23:01 | 000,156,160 | R--- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTS5121.sys -- (RSUSBSTOR) DRV - [2008.05.19 22:49:14 | 000,625,792 | R--- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rt2860.sys -- (RT80x86) DRV - [2008.04.09 03:45:42 | 001,309,504 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416) DRV - [2006.01.04 15:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msi.com.tw IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msi.com.tw IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msi.com.tw IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msi.com.tw IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AA 52 4F 5E 5E CE CC 01 [binary data] IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 50727 FF - prefs.js..network.proxy.type: 4 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Programme\AVAST Software\Avast\WebRep\FF [2012.07.06 14:16:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.07.30 09:10:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.03 21:54:06 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Extensions [2012.05.02 22:21:04 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions [2011.09.03 21:54:06 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.05.02 03:17:51 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\searchplugins\sweetim.xml [2012.05.08 10:51:42 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.09.03 21:53:49 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\distribution\extensions [2011.09.03 21:53:49 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.07.30 09:10:19 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.02.23 19:19:19 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.02.23 19:19:19 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.02.23 19:19:19 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.02.23 19:19:19 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.02.23 19:19:19 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.02.23 19:19:19 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM..\Run: [avast] C:\Programme\AVAST Software\Avast\avastUI.exe (AVAST Software) O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL (Lexmark International Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-2892847056-2553114750-292287643-1005 Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.08.25 13:41:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () - F:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2008.03.10 02:34:52 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () O33 - MountPoints2\{6acf6438-61b2-11e1-8ac8-002185b6779c}\Shell\Open\command - "" = C:\Programme\VideoLAN\VLC\vlc.exe -- [2011.04.12 02:45:30 | 000,107,520 | ---- | M] () O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell\AutoRun\command - "" = G:\Setup.EXE O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - C:\WINDOWS\system32\iprip.dll (Microsoft Corporation) NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found MsConfig - Services: "NMSAccess" MsConfig - Services: "MozillaMaintenance" MsConfig - Services: "Micro Star SCM" MsConfig - Services: "lxcr_device" MsConfig - Services: "JavaQuickStarterService" MsConfig - Services: "idsvc" MsConfig - Services: "gupdatem" MsConfig - Services: "gupdate" MsConfig - Services: "DCService.exe" MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE - (Microsoft Corporation) MsConfig - StartUpFolder: C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^SilkQuit Meter.lnk - C:\Programme\valecam\SilkQuit\SilkQuit.exe - (none) MsConfig - StartUpReg: Adobe ARM - hkey= - key= - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: Alcmtr - hkey= - key= - C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) MsConfig - StartUpReg: HotKeysCmds - hkey= - key= - File not found MsConfig - StartUpReg: lxcrmon.exe - hkey= - key= - C:\Programme\Lexmark 2400 Series\lxcrmon.exe () MsConfig - StartUpReg: MGSysCtrl - hkey= - key= - C:\Programme\System Control Manager\MGSysCtrl.exe (Mirco-Star International CO., LTD.) MsConfig - State: "system.ini" - 0 MsConfig - State: "win.ini" - 0 MsConfig - State: "bootini" - 0 MsConfig - State: "services" - 2 MsConfig - State: "startup" - 2 ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015C} - Microsoft DirectX ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7 ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.UnInstall.PerUser ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - rundll32.exe C:\WINDOWS\system32\Setup\FxsOcm.dll,XP_UninstallProvider ActiveX: {ACC563BC-4266-43f0-B6ED-9D38C4202C7E} - ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework ActiveX: {C3C986D6-06B1-43BF-90DD-BE30756C00DE} - RevokedRootsUpdate ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.0 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Macromedia Shockwave Flash ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /HideWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.dvacm - C:\PROGRA~1\GEMEIN~1\ULEADS~1\vio\dvacm.acm File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: VIDC.FMVC - C:\WINDOWS\System32\fmcodec.DLL (Fox Magic Software) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.08.11 21:39:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security Task Manager [2012.08.11 21:39:39 | 000,000,000 | ---D | C] -- C:\Programme\Security Task Manager [2012.08.10 23:23:29 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\a\Startmenü\Programme\Verwaltung [2012.08.08 23:49:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM [2012.08.08 23:42:56 | 002,815,592 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE [2012.08.08 18:54:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\a\Desktop\schuh [2012.08.06 10:48:36 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Malwarebytes [2012.08.06 10:47:12 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.08.06 10:47:07 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.08.06 10:47:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.08.06 10:47:00 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.08.04 01:13:36 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys [2012.08.04 01:11:52 | 000,000,000 | ---D | C] -- C:\Programme\stinger [2012.08.03 22:59:50 | 000,359,016 | ---- | C] (Realtek Semiconductor Crop.) -- C:\WINDOWS\vncutil.exe [2012.08.03 22:59:37 | 000,122,880 | ---- | C] (Realtek Semiconductor) -- C:\WINDOWS\RtkAudioService.exe [2012.08.03 22:59:17 | 001,684,736 | ---- | C] (Creative) -- C:\WINDOWS\System32\drivers\Ambfilt.sys [2012.08.03 22:29:48 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\a\Desktop\cccleanergesicherteregistryeinträge [2012.08.03 22:26:31 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\a\Recent [2012.08.03 22:17:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\eSupport.com [2012.08.01 20:35:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2012.07.23 19:12:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mobile Partner [2012.07.23 19:11:37 | 000,069,504 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_jucdcacm.sys [2012.07.23 19:11:37 | 000,063,616 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_jubusenum.sys [2012.07.23 19:11:37 | 000,046,336 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_jucdcecm.sys [2012.07.23 19:11:37 | 000,025,088 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_juextctrl.sys [2012.07.23 19:11:35 | 000,861,696 | ---- | C] (DiBcom SA) -- C:\WINDOWS\System32\drivers\mod7700.sys [2012.07.23 19:11:35 | 000,117,504 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewusbnet.sys [2012.07.23 19:11:35 | 000,105,728 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewusbmdm.sys [2012.07.23 19:11:35 | 000,024,448 | ---- | C] (Huawei Tech. Co., Ltd.) -- C:\WINDOWS\System32\drivers\ewdcsc.sys [2012.07.23 19:11:35 | 000,011,136 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_usbenumfilter.sys [2012.07.23 19:11:32 | 000,101,504 | ---- | C] (Huawei Technologies Co., Ltd.) -- C:\WINDOWS\System32\drivers\ew_hwusbdev.sys [2012.07.23 19:10:57 | 000,000,000 | ---D | C] -- C:\Programme\Mobile Partner [2012.07.22 17:53:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\a\Desktop\textzeug [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.11 22:28:01 | 000,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.08.11 22:25:55 | 000,000,308 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job [2012.08.11 22:24:31 | 000,001,076 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.08.11 22:23:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.08.11 22:23:23 | 1062,526,976 | -HS- | M] () -- C:\hiberfil.sys [2012.08.11 22:19:31 | 000,000,211 | RHS- | M] () -- C:\boot.ini [2012.08.11 04:52:27 | 000,090,624 | ---- | M] () -- C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.08.06 10:47:13 | 000,000,766 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.04 01:13:36 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\WINDOWS\stinger.sys [2012.08.01 22:46:27 | 000,006,326 | ---- | M] () -- C:\WINDOWS\silkquit.ini [2012.07.23 19:12:03 | 000,000,736 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mobile Partner.lnk [2012.07.21 00:37:01 | 000,278,152 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2012.07.19 13:22:10 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [2 C:\Dokumente und Einstellungen\All Users\*.tmp files -> C:\Dokumente und Einstellungen\All Users\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.08 23:43:10 | 000,025,548 | ---- | C] () -- C:\WINDOWS\System32\drivers\RTAIODAT.DAT [2012.08.06 10:47:13 | 000,000,766 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.23 19:12:03 | 000,000,736 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mobile Partner.lnk [2012.07.14 22:44:14 | 008,244,608 | ---- | C] () -- C:\Dokumente und Einstellungen\a\Desktop\morgen ist auch ein schöner tag-01.mp3 [2012.05.08 10:26:22 | 000,006,326 | ---- | C] () -- C:\WINDOWS\silkquit.ini [2012.05.04 23:34:35 | 000,005,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2012.02.17 17:16:36 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012.02.03 15:33:17 | 000,002,778 | ---- | C] () -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\wklnhst.dat [2012.02.03 15:17:54 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2012.01.09 01:10:16 | 000,000,692 | ---- | C] () -- C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\FASTWiz.html [2011.08.08 16:45:12 | 000,090,624 | ---- | C] () -- C:\Dokumente und Einstellungen\a\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.27 23:39:21 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2011.05.18 18:34:14 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcrvs.dll [2011.05.18 18:34:08 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll [2011.05.18 18:33:27 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll [2011.05.18 18:33:27 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll [2011.05.18 18:33:26 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll [2011.05.18 18:30:08 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\LXCRhcp.dll [2011.05.18 18:30:08 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\LXCRinst.dll [2011.05.18 18:30:07 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll [2011.05.18 18:30:07 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll [2011.05.18 18:30:06 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll [2011.05.18 18:30:06 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll [2011.05.18 18:30:05 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpmui.dll [2011.05.18 18:30:05 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll [2011.05.18 18:30:05 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll [2011.05.18 18:30:04 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll [2011.05.18 18:30:03 | 000,385,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrih.exe [2011.05.18 18:30:01 | 000,537,520 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcoms.exe [2011.05.18 18:30:01 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll [2011.05.18 18:30:00 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll [2011.05.16 13:40:17 | 000,000,036 | -H-- | C] () -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\swk.ini [2011.05.14 00:08:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat ========== LOP Check ========== [2012.01.08 02:47:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\64176 [2012.05.04 23:35:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Canneverbe Limited [2012.04.29 04:00:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\FileZilla [2011.08.08 00:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Jens Lorek [2011.08.23 22:55:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Opera [2011.05.13 21:42:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Propellerhead Software [2011.09.03 22:59:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Quake3 [2011.05.13 14:01:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Steinberg [2012.03.09 00:24:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\XSManager [2012.03.14 15:32:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AVAST Software [2012.05.04 23:35:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited [2012.07.23 19:14:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DatacardService [2011.05.13 21:36:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Propellerhead Software [2012.08.11 22:08:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan [2012.04.13 11:32:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\b\Anwendungsdaten\Opera [2011.05.13 13:08:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\XSManager [2012.08.11 22:25:55 | 000,000,308 | -H-- | M] () -- C:\WINDOWS\Tasks\avast! Emergency Update.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2012.01.08 02:47:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\64176 [2011.05.29 17:00:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Adobe [2012.05.04 23:35:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Canneverbe Limited [2012.01.08 22:04:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\CyberLink [2012.07.28 18:14:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\dvdcss [2011.05.18 18:54:02 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\FaxCtr [2012.04.29 04:00:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\FileZilla [2012.03.04 04:54:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Help [2008.08.25 13:41:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Identities [2008.08.25 15:52:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\InstallShield [2011.08.08 00:16:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Jens Lorek [2011.05.13 20:20:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Macromedia [2012.08.06 10:48:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Malwarebytes [2012.04.23 15:17:01 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Microsoft [2011.09.03 21:54:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla [2011.08.23 22:55:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Opera [2011.05.13 21:42:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Propellerhead Software [2011.09.03 22:59:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Quake3 [2011.05.13 14:01:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Steinberg [2011.07.05 16:47:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Sun [2012.08.07 03:56:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\vlc [2012.04.30 20:23:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\WinRAR [2012.03.09 00:24:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\XSManager < %APPDATA%\*.exe /s > [2011.05.13 20:20:46 | 003,119,264 | ---- | M] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe [2011.08.08 00:15:56 | 000,034,494 | R--- | M] () -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Microsoft\Installer\{15C82F5E-6EA9-44FE-A0FC-B6D08A684037}\_6FEFF9B68218417F98F549.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:AGP440.sys < MD5 for: ATAPI.SYS > [2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.04.14 14:00:00 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\I386\sp3.cab:atapi.sys [2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\ATAPI.SYS [2005.03.25 15:00:00 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=9CAB5B612E3AF65810F276BA051D56CD -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\ATAPI.SYS [2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\dllcache\atapi.sys [2008.04.14 00:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2008.04.14 14:00:00 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\dllcache\eventlog.dll [2008.04.14 14:00:00 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll < MD5 for: IASTOR.SYS > [2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\IASTOR.SYS [2008.02.14 13:31:26 | 000,310,808 | ---- | M] (Intel Corporation) MD5=ACF3EC4273521B83AD9EFE56C11B4626 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\IASTOR.SYS < MD5 for: NETLOGON.DLL > [2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\dllcache\netlogon.dll [2008.04.14 14:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\NETLOGON.DLL [2005.03.25 15:00:00 | 000,419,328 | ---- | M] (Microsoft Corporation) MD5=9DA343027F3B72029AB499D3F7FFACAA -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\NETLOGON.DLL < MD5 for: SCECLI.DLL > [2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\dllcache\scecli.dll [2008.04.14 14:00:00 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\SCECLI.DLL [2005.03.25 15:00:00 | 000,190,976 | ---- | M] (Microsoft Corporation) MD5=71FB876580530E7B0429312A8BCE5E04 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\SCECLI.DLL < MD5 for: USER32.DLL > [2005.03.25 15:00:00 | 000,588,288 | ---- | M] (Microsoft Corporation) MD5=0CB15B516E6B6E1E7C84BBC5CCB20C7A -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\USER32.DLL [2005.03.25 15:00:00 | 000,588,288 | ---- | M] (Microsoft Corporation) MD5=0CB15B516E6B6E1E7C84BBC5CCB20C7A -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\USER32.DLL [2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\dllcache\user32.dll [2008.04.14 14:00:00 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\USERINIT.EXE [2005.03.25 15:00:00 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=29A1877F2D0EACFF20B6507A3C00F31B -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\USERINIT.EXE [2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\dllcache\userinit.exe [2008.04.14 14:00:00 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\WINLOGON.EXE [2005.03.25 15:00:00 | 000,508,928 | ---- | M] (Microsoft Corporation) MD5=325FD6D25FC1D77C363E87B445C8B023 -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\WINLOGON.EXE [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\dllcache\winlogon.exe [2008.04.14 14:00:00 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2008.04.14 14:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys [2005.03.25 15:00:00 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=9CBE3E8E270DB450066E050A01C86AAC -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\I386\SYSTEM32\DRIVERS\WS2IFSL.SYS [2005.03.25 15:00:00 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=9CBE3E8E270DB450066E050A01C86AAC -- C:\WINDOWS\RE_DRIVE\recoverycd_iso\STAGE\MININT\SYSTEM32\DRIVERS\WS2IFSL.SYS < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.08.25 15:32:04 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2008.08.25 15:32:04 | 001,069,056 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2008.08.25 15:32:03 | 000,446,464 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < End of report > |
12.08.2012, 13:16 | #14 |
/// Winkelfunktion /// TB-Süch-Tiger™ | Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 50727 FF - prefs.js..network.proxy.type: 4 FF - user.js - File not found [2011.09.03 21:54:06 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.05.02 03:17:51 | 000,003,915 | ---- | M] () -- C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\searchplugins\sweetim.xml [2011.09.03 21:53:49 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.08.25 13:41:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () - F:\AutoRun.exe -- [ CDFS ] O32 - AutoRun File - [2008.03.10 02:34:52 | 000,000,047 | R--- | M] () - F:\AUTORUN.INF -- [ CDFS ] O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\Shell\AutoRun\command - "" = I:\AutoRun.exe O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\Shell\AutoRun\command - "" = F:\AutoRun.exe -- [2010.05.08 21:48:36 | 000,126,976 | R--- | M] () O33 - MountPoints2\{6acf6438-61b2-11e1-8ac8-002185b6779c}\Shell\Open\command - "" = C:\Programme\VideoLAN\VLC\vlc.exe -- [2011.04.12 02:45:30 | 000,107,520 | ---- | M] () O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\Shell\AutoRun\command - "" = E:\.\Setup.exe AUTORUN=1 O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\Shell\AutoRun\command - "" = G:\Setup.EXE O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell - "" = AutoRun O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\Shell\AutoRun\command - "" = E:\AutoRun.exe :Files C:\Dokumente und Einstellungen\a\Anwendungsdaten\64176 C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache :Commands [purity] [emptytemp] [emptyflash] [resethosts] Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
13.08.2012, 19:54 | #15 |
| Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & VideoCode:
ATTFilter All processes killed ========== OTL ========== Prefs.js: "127.0.0.1" removed from network.proxy.http Prefs.js: 50727 removed from network.proxy.http_port Prefs.js: 4 removed from network.proxy.type C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully. C:\Dokumente und Einstellungen\a\Anwendungsdaten\Mozilla\Firefox\Profiles\o352t62k.default\searchplugins\sweetim.xml moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\META-INF folder moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults\preferences folder moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\defaults folder moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components folder moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\chrome folder moved successfully. C:\Programme\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} folder moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully. Registry value HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found. Registry value HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. Registry value HKEY_USERS\S-1-5-21-2892847056-2553114750-292287643-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully! C:\AUTOEXEC.BAT moved successfully. File F:\AutoRun.exe not found. File F:\AUTORUN.INF not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd30-d2ce-11e1-8b32-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd37-d2ce-11e1-8b32-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0e36fd3c-d2ce-11e1-8b32-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{124dee58-d677-11e1-8b36-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{124dee58-d677-11e1-8b36-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{124dee58-d677-11e1-8b36-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{124dee58-d677-11e1-8b36-002185b6779c}\ not found. File F:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f66-a5ed-11e1-8b06-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6a-a5ed-11e1-8b06-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13bd7f6c-a5ed-11e1-8b06-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400a-6edd-11e1-8ada-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ee7400c-6edd-11e1-8ada-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{200c3682-dcbb-11e0-8a72-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{200c3682-dcbb-11e0-8a72-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{200c3682-dcbb-11e0-8a72-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{200c3682-dcbb-11e0-8a72-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a66-3a49-11e1-8aa5-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{363d6a6a-3a49-11e1-8aa5-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3778d550-69d8-11e1-8ad2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3778d550-69d8-11e1-8ad2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3778d550-69d8-11e1-8ad2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3778d550-69d8-11e1-8ad2-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{432283f2-7206-11e1-8add-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{432283f2-7206-11e1-8add-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{432283f2-7206-11e1-8add-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{432283f2-7206-11e1-8add-002185b6779c}\ not found. File I:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015482-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015482-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015482-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015482-d4e9-11e1-8b34-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015486-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015486-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4f015486-d4e9-11e1-8b34-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4f015486-d4e9-11e1-8b34-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922003-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922003-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922003-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922003-bd81-11e1-8b1c-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922005-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922005-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922005-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922005-bd81-11e1-8b1c-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922009-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922009-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62922009-bd81-11e1-8b1c-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{62922009-bd81-11e1-8b1c-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{641e567b-8326-11e1-8ae2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{641e567b-8326-11e1-8ae2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{641e567b-8326-11e1-8ae2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{641e567b-8326-11e1-8ae2-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6611df61-8d46-11e1-8aeb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6611df61-8d46-11e1-8aeb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6611df61-8d46-11e1-8aeb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6611df61-8d46-11e1-8aeb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69f1da54-521d-11e1-8abb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69f1da54-521d-11e1-8abb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69f1da54-521d-11e1-8abb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69f1da54-521d-11e1-8abb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6a9a2be1-a367-11e0-8a5f-002185b6779c}\ not found. File F:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6acf6438-61b2-11e1-8ac8-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6acf6438-61b2-11e1-8ac8-002185b6779c}\ not found. C:\Programme\VideoLAN\VLC\vlc.exe moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c46-6ee0-11e1-8adb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c47-6ee0-11e1-8adb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c48-6ee0-11e1-8adb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6fa07c53-6ee0-11e1-8adb-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8e6c6224-8d54-11e1-8aed-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9589842c-3ba8-11e1-8aa7-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8b775b8-bfb4-11e1-8b1f-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cb3e7dd5-bf30-11e1-8b1d-002185b6779c}\ not found. File E:\.\Setup.exe AUTORUN=1 not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd6868f7-9386-11e0-8a56-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd6868f7-9386-11e0-8a56-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cd6868f7-9386-11e0-8a56-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cd6868f7-9386-11e0-8a56-002185b6779c}\ not found. File G:\Setup.EXE not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7757ad7-6683-11e1-8acd-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7757ad7-6683-11e1-8acd-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d7757ad7-6683-11e1-8acd-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d7757ad7-6683-11e1-8acd-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5d8-4085-11e1-8ab2-002185b6779c}\ not found. File E:\AutoRun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{edecd5dc-4085-11e1-8ab2-002185b6779c}\ not found. File E:\AutoRun.exe not found. ========== FILES ========== C:\Dokumente und Einstellungen\a\Anwendungsdaten\64176 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\sesn folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\revocation\g_0000 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\revocation folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0003 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0002 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0001 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache\g_0000 folder moved successfully. C:\Dokumente und Einstellungen\b\Lokale Einstellungen\Anwendungsdaten\Opera\Opera\cache folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: a ->Temp folder emptied: 58035388 bytes ->Temporary Internet Files folder emptied: 7122804 bytes ->Java cache emptied: 676201 bytes ->FireFox cache emptied: 313425896 bytes ->Opera cache emptied: 11294359 bytes ->Flash cache emptied: 3134528 bytes User: All Users User: b ->Temp folder emptied: 29207180 bytes ->Temporary Internet Files folder emptied: 585578 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 8472116 bytes ->Flash cache emptied: 765 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 2676103 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 296151 bytes RecycleBin emptied: 1827959 bytes Total Files Cleaned = 417,00 mb [EMPTYFLASH] User: a ->Flash cache emptied: 0 bytes User: All Users User: b ->Flash cache emptied: 0 bytes User: Default User User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully OTL by OldTimer - Version 3.2.57.0 log created on 08132012_203332 Files\Folders moved on Reboot... C:\WINDOWS\temp\Perflib_Perfdata_78c.dat moved successfully. PendingFileRenameOperations files... File C:\WINDOWS\temp\Perflib_Perfdata_78c.dat not found! Registry entries deleted on Reboot... |
Themen zu Hohe CPU-Auslastung, schlechte Performance, vor allem bei Sounds & Video |
100%, auslagerungsdatei, avast, bluescreen, check, cpu, cpu-auslastung, cubase, ergebnis, festplatte, hijack, hohe, intel, lüfter, nicht mehr, performance, platte, prozesse, ram, realtek, ruckel, schlechte performance, stinger, treiber, trojanersuche, video, win, win xp |