| |
| |||||||
Log-Analyse und Auswertung: Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
04.08.2012, 16:35
| #1 |
 |  Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Hallo, ich habe hier einen Rechner, der durch die "Bundespolizei" gesperrt wurde. Screenshot passt zu botfrei.de V1.13 Nun habe ich den PC im abgesicherten Modus gestartet und einen Scan mit Malewarebytes durchgeführt und der Trojaner Trojan.Phex.THAGen7 sowie PUP.ToolbarDownloader wurden gefunden. Alle 4 Funde des Vollscans sind nun gelöscht und in Quarantäne verschoben. Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.04.04 Windows 7 Service Pack 1 x64 FAT32 (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 9.0.8112.16421 Karl :: KARL-PC [Administrator] Schutz: Deaktiviert 04.08.2012 14:05:20 mbam-log-2012-08-04 (15-51-13).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 399445 Laufzeit: 53 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|hwzuvtcuacmqrie (Trojan.Phex.THAGen7) -> Daten: C:\ProgramData\hwzuvtcu.exe -> Keine Aktion durchgeführt. Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 3 C:\ProgramData\hwzuvtcu.exe (Trojan.Phex.THAGen7) -> Keine Aktion durchgeführt. C:\Users\Karl\0.6031144694117136.exe (Trojan.Phex.THAGen7) -> Keine Aktion durchgeführt. C:\Users\Karl\Downloads\SoftonicDownloader_fuer_google-earth.exe (PUP.ToolbarDownloader) -> Keine Aktion durchgeführt. (Ende) Jetzt scannte ich den Rechner mit OTL und wollte gerne wissen, ob der Trojaner weiteren Schaden angerichtet hat, der noch behoben werden muss. OTL.txt Code:
ATTFilter OTL logfile created on: 04.08.2012 16:59:22 - Run 1 OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Karl\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 6,00 Gb Total Physical Memory | 4,71 Gb Available Physical Memory | 78,49% Memory free 12,00 Gb Paging File | 10,91 Gb Available in Paging File | 90,92% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 1397,16 Gb Total Space | 1348,44 Gb Free Space | 96,51% Space Free | Partition Type: NTFS Drive I: | 7,48 Gb Total Space | 7,23 Gb Free Space | 96,65% Space Free | Partition Type: FAT32 Computer Name: KARL-PC | User Name: Karl | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Karl\Desktop\OTL.exe (OldTimer Tools) ========== Modules (No Company Name) ========== ========== Win32 Services (SafeList) ========== SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirWebService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (FNETTBOH_305) -- C:\Windows\SysNative\drivers\FNETTBOH_305.SYS (FNet Co., Ltd.) DRV:64bit: - (FNETURPX) -- C:\Windows\SysNative\drivers\FNETURPX.SYS (FNet Co., Ltd.) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.) DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation) DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (ATI Technologies, Inc.) DRV:64bit: - (AsrAppCharger) -- C:\Windows\SysNative\drivers\AsrAppCharger.sys (Windows (R) Win 7 DDK provider) DRV:64bit: - (VIAHdAudAddService) -- C:\Windows\SysNative\drivers\viahduaa.sys (VIA Technologies, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (Null) -- C:\Windows\SysWow64\NULL () DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.startfenster.com IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C9 7B 1A B8 1A BE CC 01 [binary data] IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "SweetIM Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.startfenster.com" FF - prefs.js..keyword.URL: "hxxp://search.sweetim.com/search.asp?src=2&q=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p=" FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.11.29 17:28:04 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 19:44:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.11.29 17:28:04 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 19:44:21 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.11.29 16:19:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karl\AppData\Roaming\mozilla\Extensions [2012.05.02 12:56:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Karl\AppData\Roaming\mozilla\Firefox\Profiles\zxsw15yn.default\extensions [2012.04.11 10:51:28 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Karl\AppData\Roaming\mozilla\Firefox\Profiles\zxsw15yn.default\extensions\plugin@yontoo.com [2012.04.11 10:52:02 | 000,003,916 | ---- | M] () -- C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\searchplugins\sweetim.xml [2012.03.20 05:53:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2011.11.29 16:18:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions [2011.11.29 16:18:21 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.04.11 10:51:59 | 000,162,686 | ---- | M] () (No name found) -- C:\USERS\KARL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZXSW15YN.DEFAULT\EXTENSIONS\{EEE6C361-6118-11DC-9C72-001320C79847}.XPI [2012.07.18 19:44:21 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.03.09 08:33:27 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.09 08:33:27 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.03.09 08:33:27 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.03.09 08:33:27 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.09 08:33:27 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.09 08:33:27 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC) O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4:64bit: - HKLM..\Run: [RunDLLEntry] C:\Windows\SysNative\AmbRunE.DLL (Creative Technology Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [XFastUsb] C:\Program Files (x86)\XFastUsb\XFastUsb.exe (FNet Co., Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - Startup: C:\Users\Karl\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html () O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html () O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{985E3E20-4F22-492E-877D-5DB5B54A4C34}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.08.04 16:58:53 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Karl\Desktop\OTL.exe [2012.08.04 14:03:16 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Roaming\Malwarebytes [2012.08.04 14:02:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.04 14:02:55 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.08.04 14:02:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.08.04 14:02:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.04 13:31:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FBDCD6C4-48B8-441E-84FD-6F6C810D2E1B} [2012.08.02 15:11:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2FE25A42-7485-4726-906A-464DE8E69805} [2012.08.02 15:11:01 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{52CC1694-FBF3-4F29-8A5C-30C2469BC57D} [2012.08.02 15:09:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B2E9F650-F806-49F0-90DD-A6B4AF181845} [2012.08.02 15:08:52 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FD884AFE-C67A-430E-B7C3-752B5E0BC9B9} [2012.08.02 14:54:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{66218252-E83F-4FDD-B287-7C76664FBCF3} [2012.08.02 14:53:41 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B75EC19C-4205-4EA9-8B40-304A0FD6B8A8} [2012.08.02 14:20:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{844161B5-7FD3-4CC7-8235-9732E3E45DCE} [2012.08.02 14:19:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9AAD1816-647A-4F01-885B-8BAA4899B029} [2012.08.02 14:18:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F1B00B5B-EDF6-49C5-ACCC-70DE94BDEAEE} [2012.08.02 14:17:57 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{ACE605C4-6E5B-491B-BC6D-2CD3CB2124CC} [2012.08.02 14:15:54 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2483A9BE-D6FE-4D34-BE03-5AD93A3AD9BD} [2012.08.02 14:15:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B5C27250-7A0A-494A-836A-7228BB70E0AC} [2012.08.02 12:55:00 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{94117008-FE4C-42ED-BD52-2A497DCEE7FA} [2012.08.02 12:54:37 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EEFA8A98-21A5-44C8-92DA-D32E195DFDC3} [2012.08.02 12:49:57 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{984FC439-ED28-489C-9962-F8EB3709ECDA} [2012.08.02 12:49:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{24CB40F2-423A-41C1-A818-645C1293FEFB} [2012.08.02 12:03:54 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6133B6A2-9960-4799-A361-79D0E8D2B601} [2012.08.02 12:03:42 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{596CE0F8-DFC1-4C9C-82F7-B38E8411D338} [2012.08.02 11:39:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C832A661-D527-4E16-A4FA-D66F53321387} [2012.08.02 11:38:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{84BCFBEE-B1AE-4CB7-8B47-C7D7FC030F99} [2012.08.02 09:24:23 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{21D0C917-03D4-4E4A-9408-A1494BD6D9B9} [2012.08.02 09:20:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{30FA43D5-7335-427D-B27F-4E90A577C3E6} [2012.08.02 09:20:04 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{84ECC520-4D88-4E0A-BDD4-ACE6B84B4EBC} [2012.08.02 09:18:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2A341498-2792-4AE7-B856-A61B45327B47} [2012.08.02 09:17:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BADEABAE-EF30-42AA-A3FF-130EBF4DB448} [2012.08.02 09:13:54 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C101AD0C-E0EB-407E-87BE-68D728034EFC} [2012.08.02 09:13:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{95FA36C3-C2A4-4F7A-A6BB-E21644BD9C1D} [2012.08.02 09:10:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{826A3294-2A18-48C9-B0C2-116862C6E0A7} [2012.08.02 09:10:30 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{145E1E33-185F-4D2D-BDB8-06A9A061AA79} [2012.08.02 09:09:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3854D416-9C30-4DC1-A4C4-A1344150C9FD} [2012.08.02 09:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\cjtcdkkyaxfpcez [2012.08.02 07:42:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C214C3A2-1474-41E2-9CA2-3098733DDEC8} [2012.08.02 07:41:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D6A2BE1C-16CB-4326-8F8A-1CBC3D6E53B2} [2012.08.02 07:40:37 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F07B842B-0988-40AE-84AD-47E3427235DA} [2012.08.02 07:38:53 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BABFCB39-4A97-4849-9D1C-15D049D46444} [2012.08.02 04:58:43 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{121EA4BA-38F7-424B-B87F-D5FC22D99024} [2012.08.02 04:54:36 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C0EA329A-80AC-4706-AD02-15739DAB83DB} [2012.08.02 04:54:04 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6E5993B2-0D3B-4B23-A8A3-F0EF9D2B3EE8} [2012.08.02 04:53:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{50302636-E788-4C44-8459-AB82DD1F5574} [2012.08.02 04:52:36 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{871CA33A-6B42-47A6-803D-B5A851C6259F} [2012.08.01 10:54:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{137B98A0-1F48-4EEA-9BFB-0572E304EFD1} [2012.08.01 10:54:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F3DA3B65-A917-4187-B55A-77CA21F4D4DF} [2012.08.01 04:53:25 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5AE68165-02DE-4103-B121-999D3A629550} [2012.08.01 04:52:52 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D92BD7BC-E185-42EC-9B38-66013697BE46} [2012.08.01 03:16:17 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E7B96131-6187-4A8A-91F8-B4CF2B4DC0ED} [2012.08.01 03:14:42 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C0A459F2-9532-40A6-B78D-28FF25658210} [2012.08.01 02:01:16 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B5F43AB6-7438-407C-9F12-366495BBA04D} [2012.08.01 02:00:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{11C00233-8CA8-4147-99A7-A70F0128B637} [2012.07.31 18:29:17 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8D50930C-5569-48B4-9E7B-C360FBC0FDCB} [2012.07.31 18:28:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CA985A8D-A3A1-402A-9133-1220FD5BBB4C} [2012.07.31 18:27:48 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C1313E0D-BC13-4951-AF46-DFC2A7A92818} [2012.07.31 18:26:17 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A32DBD79-3395-4C50-9686-F174D9513E32} [2012.07.31 18:24:42 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{97CC7F41-C0BE-4CD5-A020-8B911ECCE4E0} [2012.07.31 05:00:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{35C4A2D9-B0C5-4B3E-9AAE-78A896B6CB7B} [2012.07.31 04:56:41 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E08B6821-E26E-4AB4-A834-7D66B15AE594} [2012.07.31 04:53:53 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4E95FA1F-D7A1-48E7-960D-5FF651400FFD} [2012.07.31 04:51:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{14B5B5BF-45FF-49F6-8343-934E1515D92C} [2012.07.31 04:50:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4415A890-4546-4A37-B067-7A9920AF3135} [2012.07.30 08:37:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F1FFA796-159A-46D8-A08E-623546AC2EEE} [2012.07.30 08:37:09 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{37C6BA21-691A-4BB2-80A9-553EF4D04EA1} [2012.07.30 04:58:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9443B9B2-BC7C-4AA2-AB0F-A39C3C3E96E6} [2012.07.30 04:57:54 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{791DD3DC-D566-4D0C-AAA7-ACD56F047EB9} [2012.07.30 04:56:16 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0D86DDFA-5826-46F7-8723-BA586CF842B2} [2012.07.30 04:54:47 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C4EF6C86-1A93-4CDC-8816-111FBC28844F} [2012.07.29 21:39:33 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FF878939-2905-47A9-8A2E-101E3726C385} [2012.07.29 21:39:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0CC435EE-0BC1-4580-A066-0632459966B3} [2012.07.29 09:22:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EFFEC674-119E-4846-B44F-530D141ECA47} [2012.07.29 09:22:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A0D04FB9-829D-4563-8FAC-67F88F6D12FD} [2012.07.28 12:37:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{862C4F30-8564-4958-9791-F690FAD49623} [2012.07.28 12:36:41 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1BFFA048-8CA6-44E1-903C-2A413ADD723C} [2012.07.28 04:50:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D454CC78-A0B5-4FBE-8C9B-708D4DF0CEFB} [2012.07.28 04:50:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C4432055-5517-4F2D-86A6-361E19DB0E75} [2012.07.27 21:27:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5AB6239B-A3B9-4731-91E8-568CEF3A6FCE} [2012.07.27 21:26:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{394F642C-158E-43C4-920B-19C3DB470138} [2012.07.27 21:25:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8F898462-3876-46E0-B9F3-A7CEDAE37605} [2012.07.27 18:14:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{86AAD21E-4E9C-4861-8FA8-61991775FB79} [2012.07.27 18:14:04 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{039F8FC2-5733-4EC2-A8F6-54B17BEF60BC} [2012.07.27 18:12:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4F166941-CD81-41FD-95D8-F10F72DA7F6E} [2012.07.27 18:12:34 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9E9444C9-D777-4D51-B2A1-F678E57F92B1} [2012.07.27 18:11:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{60324BC5-86D6-4BA1-B64E-7C610072689B} [2012.07.27 12:10:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{520B0BA6-E636-4A2B-BED5-474D21BC9D83} [2012.07.27 12:09:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{62A4AE8E-6AE4-4095-BA6D-ADFA9F75EE2D} [2012.07.27 04:50:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{51B37C0B-B70A-4D55-9216-439D8EE28CCE} [2012.07.27 04:50:25 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{17E07B36-D4C0-4BAB-BED2-625B646D34F7} [2012.07.27 04:48:44 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EFE89219-D5AB-4FC7-A8F8-99FE5DDF0C70} [2012.07.26 16:39:10 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{709EB547-009C-4744-AADE-69EF4FA78372} [2012.07.26 16:38:37 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{92814241-B0A8-4559-A563-8694E27160FB} [2012.07.26 16:36:51 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{59AE1461-6B89-48CE-A593-504DB9A0C5FC} [2012.07.26 16:35:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{34F43988-A06E-475E-8C35-09E5D5E90B9A} [2012.07.26 16:34:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{63F89672-1041-4C36-8764-AEB4E6654833} [2012.07.26 16:32:30 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2CCD62E0-3B11-4DD0-BC10-35FF0299CFC3} [2012.07.26 16:32:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AD0D971B-B19A-4079-A5EF-754E5B58EBFD} [2012.07.26 16:30:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{869EFAC0-0638-415B-9F27-A0BE75027147} [2012.07.26 16:29:01 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BA3E884D-2A01-4CC8-B2A9-11872483D175} [2012.07.26 12:16:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{DD5ECBA2-D9CD-4492-9425-2F5F4B2C74F6} [2012.07.26 12:15:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0457D75A-37DE-4F92-891C-DD8465FA4139} [2012.07.26 12:14:21 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0EB0D1DA-AD69-4FD3-B6C9-F9A7341E3EF7} [2012.07.26 12:08:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{04356920-9767-4832-8ABF-7C478B6B45F0} [2012.07.26 12:07:33 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9EBDAF7D-AAFF-47B0-B97E-914A51F5AD3E} [2012.07.26 04:48:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BABC988C-C4F0-4DAF-8767-F6F44B8E62C3} [2012.07.26 04:48:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F8979AE3-F89C-4E37-9452-376434DA95B0} [2012.07.25 23:25:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{95120546-CDC5-4936-B330-E8E7107875A8} [2012.07.25 23:24:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{809C4BC5-5431-4023-BC11-20096641A0B3} [2012.07.25 23:22:55 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AA330155-D7C7-49CE-9CD2-6819041BAA3B} [2012.07.25 23:22:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{54953942-FB9C-42F9-BFEF-C9978FBA9FBE} [2012.07.25 23:20:57 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2B59D8CD-F23E-4712-876D-15259024BB4C} [2012.07.25 20:35:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5D0F3369-8567-4BE9-AFD4-E0A31A07C182} [2012.07.25 20:35:30 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{06FF4B64-94D3-402C-A347-02A52998BB20} [2012.07.25 16:02:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{09518942-84B4-4B9A-A8B8-4813890E7D03} [2012.07.25 16:02:06 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A9C8F504-C572-4D58-B480-428441D1422E} [2012.07.25 16:00:44 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{48240A5F-C20A-4457-969F-D2BF3178C300} [2012.07.25 15:59:12 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0FA3EECF-3E9C-494D-92A3-FCD4E7E5F6AA} [2012.07.25 15:57:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{603A1C25-3EC8-4644-873C-A970047CEE09} [2012.07.25 15:56:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B7FDCF4C-314F-45B8-B5FF-CB4D8A91BB0A} [2012.07.25 15:54:22 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A592FCF0-E590-46D9-8222-FBDB8434B505} [2012.07.25 13:14:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2F389D4B-894A-4A27-AD8E-B117FD19BDF4} [2012.07.25 13:14:28 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{113BAA9F-1B1E-45F0-96F1-DD18B879BCA7} [2012.07.25 04:48:34 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BE434A54-01C6-42EF-AC06-BA28EC9C79E1} [2012.07.25 04:47:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{180EC3F8-D88C-4F69-8871-9030A124343C} [2012.07.24 23:34:18 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D2D01E52-810D-424D-A038-03F996F5DA6A} [2012.07.24 23:33:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7E3BAF23-1ADC-4F0C-8CF9-64EBD5017B5A} [2012.07.24 09:45:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CFA7D2F0-52AA-4F81-AA79-4F5FBDECDB37} [2012.07.24 09:45:31 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A4B55574-3FC9-4696-8BAB-95CD5E343702} [2012.07.24 09:44:20 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{86A2C573-4480-4F6D-9CCD-81355545F255} [2012.07.24 06:26:43 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F7F676B4-34AD-4880-8319-602F4BBA6689} [2012.07.24 06:26:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0F01D414-47FC-4C92-B5BC-34A47A955CF1} [2012.07.24 04:55:06 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B10504D2-2A96-4297-B55D-E08E1448FCF7} [2012.07.24 04:54:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7EC5129F-F1F6-4AD7-9BD9-7A05DD1E63C8} [2012.07.23 19:10:09 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3732DF8D-8B81-4AD4-AD5C-33D6479A41D4} [2012.07.23 19:09:57 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{861FF1D9-9FC8-4C4D-8D19-585E6B7853D0} [2012.07.23 19:08:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5CB86B39-6484-4ED5-B066-7605D2073251} [2012.07.23 19:06:49 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{347ECD5F-72A3-44B5-BE2C-3B2137BB519B} [2012.07.23 16:11:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{87DD22AE-6914-4ECB-AECE-04BF8D946CED} [2012.07.23 16:11:31 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4A90D4B0-9535-4D77-8200-FEF9876A361A} [2012.07.23 16:08:23 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{30A48353-BBBC-449F-A844-F5E0D0289FCE} [2012.07.23 16:07:52 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{ECC2FA3F-CA1E-44A6-B4DF-F51748C0BB2B} [2012.07.23 16:04:53 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6DD75D39-4E43-441C-9386-92081252F57F} [2012.07.23 16:04:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C0D96A89-81AB-45AD-A04F-866244DE2C25} [2012.07.23 16:03:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5845C607-A06F-4770-8555-B772F6AD1273} [2012.07.23 16:02:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0805040A-BCB2-47BE-9A4B-2E6A451DF955} [2012.07.23 16:01:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{42B58121-9B13-43A6-924D-6F653867C294} [2012.07.23 16:00:41 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7AF9918C-3B83-4E72-A8AE-A66051C37309} [2012.07.23 15:57:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6086D785-F682-4C3B-A92A-3BBB0698C63E} [2012.07.23 15:57:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E49F1564-2E8A-4F0B-95C1-84AE8121F58B} [2012.07.23 09:40:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{78F0FC4F-7109-4E7B-A2C6-D9C0FAE15413} [2012.07.23 09:39:42 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{74414BD1-D75F-4DCC-B682-08F83AB4BCE3} [2012.07.23 09:37:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{68359F04-4CB7-4A4F-8C5B-EC743982E618} [2012.07.23 09:36:06 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8F4AFAC3-68D1-43AE-9CB2-9BD152B625B5} [2012.07.23 04:49:51 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{930663AF-8061-40B8-8113-F640DAF84A04} [2012.07.23 04:49:22 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{48D78E85-62EB-4572-A2A1-4C5D1DE8BB83} [2012.07.22 20:37:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4C0672EC-3454-474B-8980-09A84AD023B5} [2012.07.22 20:37:09 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8331DBFB-2C31-4CAC-B454-5A44BF08608E} [2012.07.22 20:35:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FC27D5D2-5129-4096-B463-0A60F7B77C42} [2012.07.22 20:35:09 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{86D4DCE0-B639-4729-B7AE-81CF884D37EF} [2012.07.22 13:20:10 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C66E4CBB-1FCB-4A83-904E-43F3445D6130} [2012.07.22 13:19:34 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{05D401B4-9ECF-4D38-83CD-D430D18AA1BB} [2012.07.22 10:53:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{552538AD-C422-4522-8D81-08BBAB0B7407} [2012.07.22 10:52:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8B656A3F-0840-40FD-B0D3-FBF1C46C51BA} [2012.07.22 10:51:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E6353CE9-4088-4917-B148-B19A1E1FDBF5} [2012.07.22 07:16:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8B21CBF3-7702-4019-B091-5AC052A5EF2B} [2012.07.22 07:15:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CEE4A9EE-B233-4EF2-98A2-47EC430D24D7} [2012.07.21 16:12:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{BEFBAEF6-EB6F-4DE9-8646-364FFDE1BD0A} [2012.07.21 16:11:33 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5407F220-3198-4E43-9FDF-43F5FACD5413} [2012.07.21 11:37:07 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{31EE38BE-36BB-41F7-B3D0-EF8E1DC0163E} [2012.07.21 11:36:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AE14BA5D-9C27-4BBC-8E2B-F799E01278A9} [2012.07.21 07:19:49 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0CE84EBB-1A74-43DB-A29D-AC7229DFBEEB} [2012.07.21 07:19:17 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AA2222A6-238F-4E8A-A7FC-E6AA71650C15} [2012.07.21 07:16:37 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{06194E1B-85F6-401A-857D-B6C3AEA3375C} [2012.07.20 08:18:38 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{09BF1479-D250-4F97-8EC7-868F4BFA8AF6} [2012.07.20 08:18:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{72312BC6-6D2B-46D5-ABBA-6FC4D8B4F4A0} [2012.07.20 08:18:14 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2012.07.20 06:28:20 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F3D96C72-06C9-4904-87BC-74E3537524A7} [2012.07.20 06:27:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8FF1572B-6C39-489D-9F0D-0E97714CFB5C} [2012.07.20 06:26:30 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E8E181A2-8849-44D0-8C81-E0EBCE5BE8EE} [2012.07.20 06:25:22 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0A8A5B3D-38AC-42CC-B564-A339681221CC} [2012.07.20 06:24:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6D137CAE-1AB9-4818-A4AD-1BB024854330} [2012.07.19 16:46:53 | 000,000,000 | R--D | C] -- C:\Users\Karl\Documents\Notes [2012.07.19 16:45:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{96901992-7F2A-473C-B1CE-0B421C772CE2} [2012.07.19 16:45:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7C5626F8-6994-4BFC-A97E-D98C3B939440} [2012.07.19 07:32:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AF32AA7A-CB60-4128-91A1-66E89D63D2C2} [2012.07.19 07:32:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{07BCDB52-9F6C-464B-B7FB-3E2F77CC5F30} [2012.07.19 07:31:23 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5C2A4181-08F1-4F0A-8128-8B1740C2AD4D} [2012.07.19 07:06:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1D697C8B-0D49-4FE3-B110-70355BBB3FA9} [2012.07.19 07:05:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7CC15D25-1C1F-4920-A105-DB25208FD8CD} [2012.07.18 06:44:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{65C44449-E65E-4708-AE9B-EF4597FC7EA4} [2012.07.18 06:44:12 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1F64867E-8B8F-42F1-A8BC-676D4E0DB4D8} [2012.07.18 06:42:53 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{375AFCE0-7C6C-482F-A2CA-17365E9FD3D4} [2012.07.18 06:42:16 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B898FD77-0CA4-4CE6-A462-EF826244C8C0} [2012.07.17 15:32:51 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{6512157E-74DD-421C-A8E1-3280A96B8D40} [2012.07.17 15:32:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{257948EF-5A71-4800-95EC-C03C7B6BA626} [2012.07.17 10:57:44 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{388CA9E0-34F2-4EA1-8632-85197C86ABC6} [2012.07.17 10:57:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F354602F-767E-4AB7-A075-0D88B1C1C743} [2012.07.17 08:54:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A2CE37B4-EB86-4E72-B3D2-4B417936DBE1} [2012.07.17 08:53:50 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1E4CF983-CE1D-4CD4-AB92-FA48CB42C257} [2012.07.17 07:14:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{36BBE9D2-E236-4F9F-94F7-4A6DBDD46F1A} [2012.07.17 07:13:30 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1A899BF2-FB80-47D9-9E3C-32BA740C9586} [2012.07.17 07:10:21 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{624B2431-91AB-4972-8AD5-460869D371AD} [2012.07.17 07:09:52 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1E166856-F835-4CA3-A418-2F9BFCCF00D9} [2012.07.16 21:18:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{993A305B-7977-4D71-A775-B792B5C75073} [2012.07.16 21:17:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{72620442-396F-4821-A473-DDB2BB0C5356} [2012.07.16 16:21:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{DB330FBA-DD1C-4D48-9EAC-E6A3F330519E} [2012.07.16 16:20:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{83E31ABE-D94F-4179-8226-C424F8919DE6} [2012.07.16 16:18:51 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C589DA3C-F6F6-4439-915B-68EC70B00690} [2012.07.16 16:17:28 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{76F60E53-B3BF-4DAD-8C78-DD42F632CA20} [2012.07.16 16:13:31 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CC70D416-ACD1-4723-A68C-85AE1A13B2E1} [2012.07.16 16:13:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E463D1BF-3D3F-4FC0-BBD2-76D72EC9C910} [2012.07.16 06:31:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A033E99C-E638-4897-A6BB-C0EA71545A58} [2012.07.16 06:30:51 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7FF9F55A-4215-4B2F-80FF-E8E147B8FC12} [2012.07.15 13:34:28 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{ED8F819F-4854-4194-A782-131D56353FD4} [2012.07.15 13:33:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{612B09A3-E2ED-443A-BC61-CECC67923354} [2012.07.15 06:53:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{DC3C0D57-565B-4F1E-8759-698FD54EB13B} [2012.07.15 06:53:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CC51D4A2-3A1A-4DCD-B5AE-730D871451AF} [2012.07.15 06:50:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CE4D792F-A567-4065-B555-A844F08923DD} [2012.07.15 02:28:33 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EBD53AC0-EDAD-4BF6-8661-D97A15AB1545} [2012.07.15 02:28:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{63CC3CB9-178C-4996-97EA-1AB407B588FB} [2012.07.15 02:26:49 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E87A1C28-B322-4DD2-8ED5-084E8B8D738B} [2012.07.15 02:24:20 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E5706AC8-28EA-439E-93FB-B5F40841F4CA} [2012.07.15 02:23:50 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E6D801E9-1C8D-4206-8459-CB8F9AA9F171} [2012.07.14 23:25:01 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{93D7CF3F-07A4-48BD-94FF-C1EC8CD1C3D1} [2012.07.14 23:24:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{219DEE09-8A5E-41E1-BCD8-AF166067B400} [2012.07.14 23:23:05 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0CBB44FB-5084-4C21-9A10-1A5C710B2940} [2012.07.14 23:21:34 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3CABBDB1-F575-48CD-A32D-7A49DE1FC722} [2012.07.14 06:29:40 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C25E0F92-6EA5-457B-9942-92BA84BA3002} [2012.07.14 06:29:11 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9FB512C4-810E-468E-9695-325AF16803EF} [2012.07.13 14:16:21 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A925A21B-19B8-40FC-97BB-3BFB7830789C} [2012.07.13 14:15:50 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{65F8B13A-F0C0-4F4A-8FA8-79FC9FBD7854} [2012.07.13 11:24:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F3C03B5B-6207-4894-A948-6C82D9B8D4C1} [2012.07.13 11:24:11 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{828EF5C8-6359-4A2E-9AA2-7E57B536EE0A} [2012.07.13 08:08:42 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{DDD73938-8A5E-4D67-A473-4F8D9A703DF6} [2012.07.13 08:08:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FCBDAB44-1F15-49A8-B296-A40B71873F86} [2012.07.13 08:05:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A91A7B9D-B209-40D4-8341-709CC38696A8} [2012.07.13 08:04:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C599EDA7-2740-41EC-A32A-B049105DB95C} [2012.07.13 08:01:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{58ABF5A9-0505-46C1-A9AC-83D0ABF58E4F} [2012.07.13 08:00:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0ABA2B74-4B41-48C0-A96E-FFD34D445510} [2012.07.12 12:22:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{38F98C72-7909-4193-AD3E-1F63C9ADABF4} [2012.07.12 12:21:48 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8E2EB11C-4558-4B3B-907B-2EA3A1EEC406} [2012.07.12 07:31:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3E0EFF77-0907-4E8D-B1E7-D1D104026E92} [2012.07.12 07:30:34 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{0AE989AA-8914-4EB4-8259-B0C4866A23A2} [2012.07.11 11:52:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B5491239-7F9F-4D74-9ACD-525494B85ED4} [2012.07.11 11:48:33 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3F1FE153-F391-4990-BF2A-6E7A40738686} [2012.07.11 11:48:04 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{77721E28-77C5-47AF-B5A2-2251BE043037} [2012.07.11 11:46:20 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{05F7ACA2-DFD5-47D4-8C34-503773B8BBA0} [2012.07.11 11:44:10 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1B7CF1E4-B906-4C23-906D-5B87B1651681} [2012.07.11 11:43:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5BDAC4AE-2D91-4AD4-8DA6-A90BCB592291} [2012.07.11 10:06:40 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.07.11 10:06:40 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.07.11 10:06:39 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.07.11 10:06:39 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.07.11 10:06:39 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.07.11 10:06:39 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.07.11 10:06:38 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.07.11 10:06:38 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.07.11 10:06:37 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.07.11 10:06:37 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.07.11 10:06:37 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.07.11 10:06:37 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.07.11 10:06:37 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.07.11 07:36:24 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012.07.11 07:36:24 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012.07.11 07:36:21 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.07.11 07:36:20 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012.07.11 07:36:19 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012.07.11 07:30:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{359C25D3-AA5A-441D-9211-B3DCCF699751} [2012.07.11 07:29:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{1C742169-0734-402E-8192-82E05E311741} [2012.07.10 19:26:06 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B902B047-1889-4D68-9398-E8163429FE4F} [2012.07.10 19:25:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{530B5773-72EF-4FBE-84BD-F5FE413DF6B9} [2012.07.10 12:39:07 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D70F5C51-9951-4513-8B46-DE109EBED50A} [2012.07.10 12:38:39 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AED5B9B1-2729-4F15-B4C4-AB61A97E19FF} [2012.07.10 12:35:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5D682741-7ED2-4BE4-B5F2-7D636111267E} [2012.07.10 12:35:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E60104AA-4DD5-4021-BBD4-03F7982C36AA} [2012.07.10 12:33:31 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E5F25F98-69A1-4F48-A3E5-DAC53FC7B25B} [2012.07.10 12:33:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{22F4B989-C283-4286-9EF1-396CBCD10F36} [2012.07.10 07:46:01 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2012.07.10 05:01:00 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{548AAE94-864A-488C-BBF6-A87081A34D1F} [2012.07.10 05:00:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D8F08B8A-94EC-4DE8-8B62-8A1980673325} [2012.07.10 04:59:14 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7FB373B5-5CC6-4500-9270-C6AA4B3EE64B} [2012.07.09 18:29:26 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F2EB1D1D-8F1B-46E5-848A-D839539E1A64} [2012.07.09 18:29:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{267772D7-C86F-4F16-824E-280C413272BB} [2012.07.09 18:27:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{768C2AF0-7A51-4FBC-9902-FA19E9876AE7} [2012.07.09 10:45:40 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{CA1A0F1D-335B-46C7-93D7-CB40466C7DF3} [2012.07.09 10:45:08 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{942865D5-E391-42FA-9808-6F03E0FF21A0} [2012.07.09 10:44:02 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D1DE2617-DF12-4FE3-8CAE-B1C6A2153CCD} [2012.07.09 04:51:10 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{C8806431-B3BF-4055-BC40-D6F7B03A2F9F} [2012.07.09 04:50:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8C519929-9A4F-4DF3-BACD-0068422A4346} [2012.07.08 14:07:18 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4E84F626-1A78-4863-850F-4C76A4DD28A5} [2012.07.08 14:06:53 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{7C32F982-AEFA-472F-9E02-88D1E002DE32} [2012.07.08 14:05:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{8DAD5730-CF5B-42A7-9DFC-37E7DB299A48} [2012.07.08 11:08:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{AF6AC36B-18D2-4287-9522-3D71460E2801} [2012.07.08 11:08:27 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{05A79011-AF20-4214-B62D-8D143130E88D} [2012.07.08 11:07:03 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B85AC7B6-1DA4-4F7D-9E81-9206E70644A8} [2012.07.08 11:05:24 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{299C9867-0AC9-4A15-B0C0-2A4AEB5F608F} [2012.07.07 14:49:40 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F4333359-A8F4-43BE-978A-198BE77AAB83} [2012.07.07 14:49:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A09E18A4-8D29-4D74-86A9-CBC6C71149FF} [2012.07.07 14:47:57 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{4BCB8AC6-9692-4A59-9A36-253412A44A56} [2012.07.07 12:56:25 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A533F7FE-4717-4AA6-B4B2-0B18CF624880} [2012.07.07 12:56:12 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{713B3013-36B8-43AD-95A7-EF2A8CF2A14B} [2012.07.07 12:54:37 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{840ACED1-37AC-4448-971B-0455B196A86F} [2012.07.07 12:54:15 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{9423C24D-60BC-42FC-A442-DC65A68163B7} [2012.07.07 12:52:58 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{5268967D-6508-44E7-9799-A84A7C04C6D3} [2012.07.07 12:51:21 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{70FEFFA8-153E-4AF3-B5F6-EED40CBCE321} [2012.07.07 10:36:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EA06BE66-2C46-495A-B753-20D78AD37C88} [2012.07.07 10:35:56 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3965E361-8C60-4C52-8AB1-2A12A62B9DFE} [2012.07.07 09:24:35 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A17576DD-1648-41EF-A968-881B6010AA68} [2012.07.07 09:24:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A76AA937-D50D-47D2-9E78-AD5F66FA98AF} [2012.07.06 20:28:17 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{21451720-9B5F-4861-9244-5AA3DD3E81B9} [2012.07.06 20:27:49 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{3C18F7AA-1C84-4BEE-9992-DFEF9B926F07} [2012.07.06 20:25:50 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{D4D31913-7B22-4ED7-86A6-2E020205129D} [2012.07.06 18:59:59 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{EDD13FC0-4DC2-407B-9F10-D8B5A4A57F5A} [2012.07.06 18:59:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{41AC753C-7FA7-4968-8646-695BF7F2ABE0} [2012.07.06 10:43:19 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{A37E2B49-3CB7-49E0-8D11-E1339B1AE4AE} [2012.07.06 10:43:07 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{E431B8E6-F44E-4B57-9634-81D1620B29C5} [2012.07.06 10:39:16 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B999D891-2402-4B80-ACDA-91DCE496E56C} [2012.07.06 10:38:46 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{96CC4B1D-9801-4F1B-9226-F55BB9A10D75} [2012.07.06 06:55:45 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{F4425833-77D3-4F0A-B4EA-640E80223422} [2012.07.06 06:55:13 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{44A9ACAE-1A07-4FA9-83E2-EC8CBE8CA62F} [2012.07.05 19:32:49 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{B6C3ED12-9E20-4743-BC45-0A5BA8E7AF9D} [2012.07.05 19:32:22 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{2D71262C-C8B2-4D5C-AFC8-4D007B439A99} [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.08.04 16:52:30 | 003,198,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.08.04 16:52:30 | 000,920,504 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.08.04 16:52:30 | 000,748,298 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.08.04 16:52:30 | 000,712,500 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.08.04 16:52:30 | 000,005,210 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.08.04 16:08:58 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Karl\Desktop\OTL.exe [2012.08.04 15:54:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.04 15:53:55 | 536,322,047 | -HS- | M] () -- C:\hiberfil.sys [2012.08.04 13:45:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.04 13:41:10 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.08.04 13:38:46 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.04 13:38:46 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.04 13:31:27 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.08.02 09:03:50 | 000,000,051 | ---- | M] () -- C:\ProgramData\jfptwpidwokqxfh [2012.07.27 19:45:30 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.07.27 19:45:30 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.07.11 11:43:08 | 000,294,368 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.08.02 09:03:44 | 000,000,051 | ---- | C] () -- C:\ProgramData\jfptwpidwokqxfh [2012.06.07 13:29:04 | 000,000,118 | ---- | C] () -- C:\Windows\Podcasts.INI [2011.11.29 17:21:19 | 000,239,021 | ---- | C] () -- C:\Windows\hpwins26.dat [2011.08.10 14:10:41 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.08.10 14:08:22 | 000,002,857 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat ========== LOP Check ========== [2012.01.13 20:19:09 | 000,000,000 | ---D | M] -- C:\Users\Karl\AppData\Roaming\OpenOffice.org [2011.11.29 17:11:45 | 000,000,000 | ---D | M] -- C:\Users\Karl\AppData\Roaming\T-Online [2011.12.02 14:40:59 | 000,000,000 | ---D | M] -- C:\Users\Karl\AppData\Roaming\wargaming.net [2011.12.24 11:09:18 | 000,000,000 | ---D | M] -- C:\Users\Karl\AppData\Roaming\Windows Live Writer [2012.08.02 11:38:35 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Code:
ATTFilter OTL Extras logfile created on: 04.08.2012 16:59:22 - Run 1
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\Karl\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
6,00 Gb Total Physical Memory | 4,71 Gb Available Physical Memory | 78,49% Memory free
12,00 Gb Paging File | 10,91 Gb Available in Paging File | 90,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1397,16 Gb Total Space | 1348,44 Gb Free Space | 96,51% Space Free | Partition Type: NTFS
Drive I: | 7,48 Gb Total Space | 7,23 Gb Free Space | 96,65% Space Free | Partition Type: FAT32
Computer Name: KARL-PC | User Name: Karl | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1992270557-1898567466-1585808569-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{6FBFDB89-A707-40A1-A727-6D4F3D3CF8ED}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{CCCF7EC7-34CC-4CC4-9A5F-617079D0E5A9}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{10F15B4C-F09F-4081-846B-38879382840E}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe |
"{220D1BD4-F6B1-48CB-934D-7106FCAB4E38}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe |
"{3473BDCD-8E37-4FF2-B660-2FA0073F9AE1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe |
"{416BACE9-C4B4-4221-8004-E113BBCAEB16}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe |
"{455E56AB-4D15-4C52-8AD7-5579421E03B0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe |
"{64C031EB-4625-499B-84AB-4AB68825DBA6}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe |
"{662A9386-ED94-4880-965F-552EE943E3C0}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{79FB4936-D1CC-4A08-B1DD-3C8E533D39D4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe |
"{7AF41DFB-EEFC-4EDC-9813-A5D51E1D7358}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe |
"{8559A1CB-936A-4E09-A1EE-46E341E00E50}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe |
"{89482472-3CDD-4AAA-AA74-71BBBAAD4965}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe |
"{8CBB586F-9AEC-4CEF-9F69-AC64E3AE4577}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe |
"{98132101-CC29-4BE1-809C-F1FA7A03F503}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe |
"{A3657B72-CB4A-4D32-83A1-3C5E0E410A20}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe |
"{B11F68EE-58FB-4E01-BEAE-B560C44B9AE9}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe |
"{BE506B24-75EC-4BCB-A4F5-B4B7B2CEA4D6}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe |
"{C75DE52C-5BAF-4B24-8F88-054061DD20EA}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe |
"{DAC48AFE-AC58-44EA-B9B4-9F23B44AFEBD}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{DFBAC06D-404C-4381-9E25-22F9B9130C80}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{F7F63BA7-8374-445E-83F6-E7CACF3F2156}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe |
"TCP Query User{7377E8EC-0F82-4767-8ED4-6D2B4B88B229}C:\program files (x86)\rapidsolution\radiotracker 6\radiotracker.exe" = protocol=6 | dir=in | app=c:\program files (x86)\rapidsolution\radiotracker 6\radiotracker.exe |
"TCP Query User{8177291E-F031-4E2D-B8BA-AB74F766D4B9}C:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"TCP Query User{979FF789-A2A2-4119-A8FC-27DE22E01EF0}C:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"UDP Query User{49EACB6C-6A57-44E2-8CF5-65C4EC03FB63}C:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"UDP Query User{8ADB8E0B-A810-4854-A6E1-9DD548636907}C:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"UDP Query User{D7454E27-1176-4A4D-8BB2-C1B94D15D875}C:\program files (x86)\rapidsolution\radiotracker 6\radiotracker.exe" = protocol=17 | dir=in | app=c:\program files (x86)\rapidsolution\radiotracker 6\radiotracker.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{38B4F79A-CC5F-96DF-0AFC-682FC2692BA5}" = ccc-utility64
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{49C81962-DCD2-8746-FC64-19A541B48113}" = ATI Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4FEDA15F-C426-5241-0794-FDC432C67710}" = AMD Drag and Drop Transcoding
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6BFAB6C1-6D46-46DB-A538-A269907C9F2F}" = Network64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A4DDB2AB-ECCD-4C3A-8633-77D5A1A0E542}" = Network64
"{ABCF7983-3860-318E-EB24-E89E8AEC1967}" = ATI AVIVO64 Codecs
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{E5083D57-D93F-404C-A91F-1C50D67C2BEB}" = HP Officejet 4500 G510g-m
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"ASRock App Charger_is1" = ASRock App Charger v1.0.4
"HP Document Manager" = HP Document Manager 2.0
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Smart Web Printing" = HP Smart Web Printing 4.5
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Shop for HP Supplies" = Shop for HP Supplies
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0DDEC3B9-5C3A-B46E-2F8F-6A83079D77D6}" = ccc-core-static
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{11F04D55-8EC5-66FD-DF7E-20CAC68812C6}" = CCC Help English
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1E863F44-2D2D-4BD7-B25B-EDA9FF622267}" = Radiotracker
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.6.7
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{26809808-FA2D-1C8E-C52B-3D493C403C17}" = CCC Help Japanese
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{28379381-B56A-43e1-B505-3098D82B1C30}" = 4500G510gm_Software_Min
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{2AA4F3AA-2CDD-42F1-3EFA-08A915915638}" = Catalyst Control Center Graphics Previews Common
"{2D854C57-2C5E-A0D5-E59B-3E7B5E1411CD}" = CCC Help Norwegian
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{2F603A45-D956-496B-81B5-50D782424976}" = SweetPacks Toolbar for Internet Explorer 4.4
"{304A0462-1905-F55F-182A-B2A2A8593110}" = CCC Help Chinese Standard
"{379DE402-807D-4F46-D47B-FD5275B07EF4}" = CCC Help Italian
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{381DF9C7-494F-85C2-4F94-D6BAA5F1CB0B}" = CCC Help Chinese Traditional
"{3E63E473-B8E2-4340-AD77-46AC3BA7D6B6}" = Catalyst Control Center - Branding
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4B413494-28A6-11C0-7012-715E2E578A1B}" = CCC Help Spanish
"{4DC7539C-56B5-CCBE-8A1E-6A108E71889C}" = Catalyst Control Center InstallProxy
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.0.0
"{804519C9-0CEE-A1CC-D4E2-DFEBEACBCB29}" = Catalyst Control Center Graphics Previews Vista
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92A51949-EE4C-466D-AAF0-99E74A49A63F}" = DocMgr
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A436F67F-687E-4736-BD2B-537121A804CF}" = HP Product Detection
"{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}" = PixiePack Codec Pack
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B083CEAD-4E0E-0E56-7D69-01DBB8A456FB}" = CCC Help Danish
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B22C231D-F642-7B0E-D112-C5871C2FD8C5}" = CCC Help German
"{B7AF2E06-E8A5-CC9E-ED58-9D7A63BFF7BC}" = CCC Help French
"{B85C4CB2-B352-4BD8-818C-BCE353599107}" = SweetIM for Messenger 3.6
"{BCFF5DE4-0B38-6034-6F86-3C3596F195F9}" = CCC Help Dutch
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BE0D4271-69C9-4f28-AD9B-BB33D126A30E}" = 4500G510gm
"{BFF8B634-D083-99A1-813B-126B3497B318}" = CCC Help Finnish
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C548A5B3-A90C-B87A-018A-5E84B9830F87}" = Catalyst Control Center Localization All
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DF0B357C-5874-47D0-81E7-79AA890B0CE0}" = 4500_G510gm_Help
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1A019FE-6196-D19B-C40F-E1C02E18B46D}" = CCC Help Swedish
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F8AE2978-3A1B-0542-C3FE-8941F3C016C2}" = HydraVision
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"VLC media player" = VLC media player 2.0.1
"WinLiveSuite" = Windows Live Essentials
"XFastUsb" = XFastUsb
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 26.07.2012 22:54:28 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 26.07.2012 22:54:28 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 26.07.2012 22:54:28 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 26.07.2012 23:53:52 | Computer Name = Karl-PC | Source = System Restore | ID = 8193
Description =
Error - 26.07.2012 23:53:52 | Computer Name = Karl-PC | Source = System Restore | ID = 8211
Description =
Error - 27.07.2012 06:11:01 | Computer Name = Karl-PC | Source = WinMgmt | ID = 10
Description =
Error - 27.07.2012 06:16:39 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 27.07.2012 06:16:39 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 27.07.2012 06:16:39 | Computer Name = Karl-PC | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 27.07.2012 06:44:22 | Computer Name = Karl-PC | Source = System Restore | ID = 8193
Description =
[ System Events ]
Error - 04.08.2012 08:01:54 | Computer Name = Karl-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk5\DR5 gefunden.
Error - 04.08.2012 08:30:52 | Computer Name = Karl-PC | Source = DCOM | ID = 10005
Description =
Error - 04.08.2012 09:54:05 | Computer Name = Karl-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AsrAppCharger avipbb avkmgr discache spldr Wanarpv6
Error - 04.08.2012 09:54:09 | Computer Name = Karl-PC | Source = DCOM | ID = 10005
Description =
Error - 04.08.2012 09:54:16 | Computer Name = Karl-PC | Source = DCOM | ID = 10005
Description =
Error - 04.08.2012 09:54:18 | Computer Name = Karl-PC | Source = DCOM | ID = 10005
Description =
Error - 04.08.2012 09:54:19 | Computer Name = Karl-PC | Source = DCOM | ID = 10005
Description =
Error - 04.08.2012 10:51:09 | Computer Name = Karl-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.
Error - 04.08.2012 10:51:10 | Computer Name = Karl-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.
Error - 04.08.2012 10:51:10 | Computer Name = Karl-PC | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR6 gefunden.
< End of report >
 |
|
04.08.2012, 18:28
| #2 |
| /// Helfer-Team  | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Fixen mit OTL Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).
Code:
ATTFilter :OTL
DRV - (Null) -- C:\Windows\SysWow64\NULL ()
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}
IE - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.startfenster.com"
FF - prefs.js..keyword.URL: "http://search.sweetim.com/search.asp?src=2&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "http://www.google.de"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "data:text/plain,keyword.URL=http://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p="
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found
O2 - BHO: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus WebGuard) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName})
O4 - HKLM..\Run: [SweetIM] C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
[2012.08.02 09:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\cjtcdkkyaxfpcez
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[2012.08.02 09:03:50 | 000,000,051 | ---- | M] () -- C:\ProgramData\jfptwpidwokqxfh
[2012.08.04 13:45:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.04 13:41:10 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.04 13:31:32 | 000,000,000 | ---D | C] -- C:\Users\Karl\AppData\Local\{FBDCD6C4-48B8-441E-84FD-6F6C810D2E1B}
[2012.08.04 13:31:27 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
:Files
C:\ProgramData\hwzuvtcu.exe
C:\Users\Karl\0.6031144694117136.exe
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden. Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!
__________________ |
|
04.08.2012, 18:50
| #3 |
| | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Hallo t'john,
__________________erstmal danke für deine Hilfe und auch für das Script  Hier das Logfile: Code:
ATTFilter All processes killed
========== OTL ==========
Service Null stopped successfully!
Service Null deleted successfully!
C:\Windows\SysWOW64\NULL moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKEY_USERS\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.
HKU\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "SweetIM Search" removed from browser.search.defaultenginename
Prefs.js: "" removed from browser.search.defaulturl
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.startfenster.com" removed from browser.startup.homepage
Prefs.js: "hxxp://search.sweetim.com/search.asp?src=2&q=" removed from keyword.URL
Prefs.js: "" removed from sweetim.toolbar.previous.browser.search.defaultenginename
Prefs.js: "" removed from sweetim.toolbar.previous.browser.search.defaulturl
Prefs.js: "" removed from sweetim.toolbar.previous.browser.search.selectedEngine
Prefs.js: "hxxp://www.google.de" removed from browser.startup.homepage
Prefs.js: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p=" removed from sweetim.toolbar.previous.keyword.URL
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}\ deleted successfully.
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ deleted successfully.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_USERS\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-1992270557-1898567466-1585808569-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.
File C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files (x86)\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SweetIM deleted successfully.
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Web-Suche\ deleted successfully.
File Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Web-Suche\ not found.
File Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\ProgramData\cjtcdkkyaxfpcez folder moved successfully.
C:\Windows\SysWow64\tmpE750.tmp deleted successfully.
C:\Windows\SysWow64\tmpE771.tmp deleted successfully.
C:\ProgramData\jfptwpidwokqxfh moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Users\Karl\AppData\Local\{FBDCD6C4-48B8-441E-84FD-6F6C810D2E1B} folder moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
========== FILES ==========
File\Folder C:\ProgramData\hwzuvtcu.exe not found.
File\Folder C:\Users\Karl\0.6031144694117136.exe not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Karl\Desktop\cmd.bat deleted successfully.
C:\Users\Karl\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Karl
->Temp folder emptied: 44293057 bytes
->Temporary Internet Files folder emptied: 29882716 bytes
->Java cache emptied: 13223489 bytes
->FireFox cache emptied: 63348871 bytes
->Flash cache emptied: 1072128914 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 432123482 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 84962 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 1.578,00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Karl
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.43.0 log created on 08042012_193741
Files\Folders moved on Reboot...
C:\Users\Karl\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
Registry entries deleted on Reboot...
|
|
04.08.2012, 20:29
| #4 |
| /// Helfer-Team | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Sehr gut! Wie laeuft der Rechner? 1. Schritt Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.danach: 2. Schritt Downloade Dir bitte AdwCleaner auf deinen Desktop.
|
|
04.08.2012, 21:42
| #5 |
| | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Logfile von Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.04.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Karl :: KARL-PC [Administrator] Schutz: Aktiviert 04.08.2012 21:58:21 mbam-log-2012-08-04 (21-58-21).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 316733 Laufzeit: 31 Minute(n), 57 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/04/2012 at 22:39:02
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Karl - KARL-PC
# Running from : C:\Users\Karl\Desktop\adwcleaner.exe
# Option [Search]
***** [Services] *****
***** [Files / Folders] *****
Folder Found : C:\Users\Karl\AppData\Local\AskToolbar
Folder Found : C:\Users\Karl\AppData\LocalLow\AskToolbar
Folder Found : C:\Users\Karl\AppData\LocalLow\SweetIM
Folder Found : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\SweetIMToolbarData
Folder Found : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\extensions\plugin@yontoo.com
Folder Found : C:\ProgramData\SweetIM
Folder Found : C:\ProgramData\Tarma Installer
Folder Found : C:\Program Files (x86)\Ask.com
Folder Found : C:\Program Files (x86)\SweetIM
Folder Found : C:\Program Files (x86)\Yontoo
Folder Found : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Found : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\searchplugins\SweetIm.xml
***** [Registry] *****
Key Found : HKCU\Software\APN
Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
Key Found : HKCU\Software\AskToolbar
Key Found : HKCU\Software\SweetIm
Key Found : HKLM\SOFTWARE\APN
Key Found : HKLM\SOFTWARE\AskToolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Found : HKLM\SOFTWARE\Classes\sim-packages
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Key Found : HKLM\SOFTWARE\SweetIM
[x64] Key Found : HKCU\Software\APN
[x64] Key Found : HKCU\Software\AppDataLow\Software\AskToolbar
[x64] Key Found : HKCU\Software\AskToolbar
[x64] Key Found : HKCU\Software\SweetIm
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
[x64] Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
[x64] Key Found : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
[x64] Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
[x64] Key Found : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
[x64] Key Found : HKLM\SOFTWARE\Classes\sim-packages
[x64] Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
[x64] Key Found : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
[x64] Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
[x64] Key Found : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
[x64] Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
[x64] Key Found : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
[x64] Key Found : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
[x64] Key Found : HKLM\SOFTWARE\Tarma Installer
***** [Registre - GUID] *****
Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Found : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\prefs.js
Found : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Found : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Found : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Found : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Found : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Found : user_pref("sweetim.toolbar.mode.debug", "false");
Found : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Found : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Found : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Found : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Found : user_pref("sweetim.toolbar.search.history", "pornhub,hupporno,d%C3%BClken,gelbe%20seiten,www.golly%2[...]
Found : user_pref("sweetim.toolbar.search.history.capacity", "10");
Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "1");
Found : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "1");
Found : user_pref("sweetim.toolbar.searchguard.enable", "true");
Found : user_pref("sweetim.toolbar.simapp_id", "{955D584C-83B3-11E1-B3D7-002522A3B961}");
Found : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
*************************
AdwCleaner[R1].txt - [13393 octets] - [04/08/2012 22:39:02]
########## EOF - C:\AdwCleaner[R1].txt - [13522 octets] ##########
MfG |
|
05.08.2012, 01:15
| #6 |
| /// Helfer-Team | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Sehr gut!
danach: Malware-Scan mit Emsisoft Anti-Malware Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm. Lade über Jetzt Updaten die aktuellen Signaturen herunter. Wähle den Freeware-Modus aus. Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers. Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten. Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________ --> Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) |
|
05.08.2012, 12:34
| #7 |
| | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Hier nun noch die beiden Logfiles, denke der Rechner ist jetzt fertig oder? Code:
ATTFilter # AdwCleaner v1.800 - Logfile created 08/05/2012 at 12:47:03
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Karl - KARL-PC
# Running from : C:\Users\Karl\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
Folder Deleted : C:\Users\Karl\AppData\Local\AskToolbar
Folder Deleted : C:\Users\Karl\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\Karl\AppData\LocalLow\SweetIM
Folder Deleted : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\SweetIMToolbarData
Folder Deleted : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\extensions\plugin@yontoo.com
Folder Deleted : C:\ProgramData\SweetIM
Folder Deleted : C:\ProgramData\Tarma Installer
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\SweetIM
Folder Deleted : C:\Program Files (x86)\Yontoo
Folder Deleted : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
File Deleted : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\searchplugins\SweetIm.xml
***** [Registry] *****
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AskToolbar
Key Deleted : HKCU\Software\SweetIm
Key Deleted : HKLM\SOFTWARE\APN
Key Deleted : HKLM\SOFTWARE\AskToolbar
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Key Deleted : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Key Deleted : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Key Deleted : HKLM\SOFTWARE\Classes\sim-packages
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar
Key Deleted : HKLM\SOFTWARE\Classes\SWEETIE.IEToolbar.1
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook
Key Deleted : HKLM\SOFTWARE\Classes\sweetim_urlsearchhook.toolbarurlsearchhook.1
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar3.sweetie.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Api.1
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers
Key Deleted : HKLM\SOFTWARE\Classes\YontooIEClient.Layers.1
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2F603A45-D956-496B-81B5-50D782424976}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B85C4CB2-B352-4BD8-818C-BCE353599107}
Key Deleted : HKLM\SOFTWARE\SweetIM
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
[x64] Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}
[x64] Key Deleted : HKLM\SOFTWARE\Tarma Installer
***** [Registre - GUID] *****
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7E84186E-B5DE-4226-8A66-6E49C6B511B4}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FE9271F2-6EFD-44B0-A826-84C829536E93}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
***** [Internet Browsers] *****
-\\ Internet Explorer v9.0.8112.16421
[OK] Registry is clean.
-\\ Mozilla Firefox v14.0.1 (de)
Profile name : default
File : C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\prefs.js
C:\Users\Karl\AppData\Roaming\Mozilla\Firefox\Profiles\zxsw15yn.default\user.js ... Deleted !
Deleted : user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
Deleted : user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
Deleted : user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
Deleted : user_pref("sweetim.toolbar.mode.debug", "false");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.defaulturl", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", "");
Deleted : user_pref("sweetim.toolbar.previous.browser.startup.homepage", "");
Deleted : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]
Deleted : user_pref("sweetim.toolbar.search.history", "pornhub,hupporno,d%C3%BClken,gelbe%20seiten,www.golly%2[...]
Deleted : user_pref("sweetim.toolbar.search.history.capacity", "10");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "1");
Deleted : user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "1");
Deleted : user_pref("sweetim.toolbar.searchguard.enable", "true");
Deleted : user_pref("sweetim.toolbar.simapp_id", "{955D584C-83B3-11E1-B3D7-002522A3B961}");
Deleted : user_pref("sweetim.toolbar.urls.homepage", "hxxp://home.sweetim.com");
*************************
AdwCleaner[R1].txt - [13416 octets] - [04/08/2012 22:39:02]
AdwCleaner[S1].txt - [265 octets] - [04/08/2012 23:31:19]
AdwCleaner[S2].txt - [10246 octets] - [05/08/2012 12:47:03]
########## EOF - C:\AdwCleaner[S2].txt - [10375 octets] ##########
Code:
ATTFilter Emsisoft Anti-Malware - Version 6.6
Letztes Update: 05.08.2012 12:54:52
Scan Einstellungen:
Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\
Archiv Scan: An
ADS Scan: An
Scan Beginn: 05.08.2012 12:55:29
Gescannt 574255
Gefunden 0
Scan Ende: 05.08.2012 13:26:03
Scan Zeit: 0:30:34
|
|
05.08.2012, 12:38
| #8 |
| /// Helfer-Team | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Sehr gut! Deinstalliere: Emsisoft Anti-Malware ESET Online Scanner Vorbereitung
|
|
05.08.2012, 14:47
| #9 |
| | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Esset hat vermutlich noch den "alten" Trojaner gefunden und gelöscht. Hab Esset nun deinstalliert, den Ordner gelöscht und der Papierkorb ist auch leer  logfile: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=b802f72d6c29354ea323e6c152731acb
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-08-05 12:36:28
# local_time=2012-08-05 02:36:28 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1792 16777215 100 0 5980484 5980484 0 0
# compatibility_mode=5893 16776573 100 94 668 95797433 0 0
# compatibility_mode=8192 67108863 100 0 61731 61731 0 0
# scanned=139074
# found=1
# cleaned=1
# scan_time=2605
C:\_OTL\MovedFiles\08042012_193741\C_ProgramData\cjtcdkkyaxfpcez\main.html HTML/Ransom.B trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
|
|
05.08.2012, 20:38
| #10 |
| /// Helfer-Team | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Java aktualisieren Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html |
|
06.08.2012, 02:16
| #11 |
| | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Danke t'John  deine Hilfe war gut und schnell Gerne wieder, wenn nötig! Gruß Oliver |
|
06.08.2012, 02:18
| #12 |
| /// Helfer-Team | Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) Sehr gut! damit bist Du sauber und entlassen! Tool-Bereinigung mit OTL Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.
Zurücksetzen der Sicherheitszonen Lasse die Sicherheitszonen wieder zurücksetzen, da diese manipuliert wurden um den Browser für weitere Angriffe zu öffnen. Gehe dabei so vor: http://www.trojaner-board.de/111805-...ecksetzen.html Aufräumen mit CCleaner Lasse mit CCleaner (Download) (Anleitung) Fehler in der
Lektuere zum abarbeiten: http://www.trojaner-board.de/90880-d...tallation.html http://www.trojaner-board.de/105213-...tellungen.html PluginCheck http://www.trojaner-board.de/96344-a...-rechners.html Secunia Online Software Inspector http://www.trojaner-board.de/71715-k...iendungen.html http://www.trojaner-board.de/83238-a...sschalten.html |
|
| Themen zu Gesperrt durch Bundespolizei (Trojan.Phex.THAGen7 gefunden) |
| .dll, administrator, adobe flash player, autorun, avira, avira searchfree toolbar, bho, error, explorer, fehler, firefox, flash player, format, gesperrt, google earth, helper, home, install.exe, langs, logfile, nvidia, officejet, opera, plug-in, programme, registry, scan, security, software, sweetpacks, trojan.phex.thagen, trojaner, udp, vdeck.exe, yontoo |
Linear-Darstellung
