| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Kann keine gespeicherten Dateien mehr öffnen!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.08.2012, 14:32
| #1 |
| |  Kann keine gespeicherten Dateien mehr öffnen! Hallo, seit ein paar Tagen kann ich keine meiner gespeicherten Dateien mehr öffnen! Betroffen sind sicher: .jpg, .doc, .docx, .xlsx, .pdf und Videodateien(.avi, .mpg, .wmv). Ob weitere betroffen sind, kann ich im Moment nicht sagen. Als Fehlermeldung bekomme ich bei .jpg (Programm: IrfanView): "Kann Dateiheader nicht lesen! Unbekanntes Bildformat oder Datei existiert nicht!" Die anderen Fehlermeldungen sind ähnlich. Die Dateinamen und -endungen sind unverändert, auch die Vorschaubilder sind vorhanden. Es betrifft nur Dateien, die vor einem bestimmten Datum (11.08.2012) gespeichert wurden, die neueren lassen sich öffnen. Kein Virenscanner hat bisher etwas auf dem Rechner gefunden, auch ein Scan mit Malwarebytes fand keine Schadsoftware. Ich hatte eine Email mit einer Mahnung und einer .zip-Datei als Anhang. Die .zip-Datei habe ich geöffnet und als darin eine Anwendung war, habe ich alles sofort gelöscht. Ich nutze kein Email-Programm, sondern die Homepage meines Anbieters. Ich vermute, dass ich mir da etwas eingefangen habe, da das etwa um den 11.08. herum war. Wer kann mit helfen? Grüße aus Stuttgart Thomas Ergänzung: Ein Hinzufügen der Dateiendungen funktioniert nicht, die Fehlermeldung bleibt gleich. Thomas Geändert von taucher1 (25.08.2012 um 14:34 Uhr) Grund: Ergänzung |
|
28.08.2012, 07:43
| #2 | |||
| /// Helfer-Team    | Kann keine gespeicherten Dateien mehr öffnen! Hallo und Herzlich Willkommen!
__________________ Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Zitat:
 1. ► Welche Art und Weise wurden die Daten (Eigene Dateien wie Bilder, Dokumente, Musik etc) bereits verschlüsselt? Kannst Du ein Beispiel nennen? Dateiändung wurden zugefügt (z.B "locked- .wxyz"), oder nach einem Zufallsprinzip besteht ein Dateiname aus Groß und Kleinbuchstaben (wie z.B QsEEUTODXNVqyssQ) andere? Nämlich manche Varianten lassen sich entschlüsseln, andere wieder leider nicht.. 2. ► welches Betriebssystem hast Du denn? 3. Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Zitat:
kira
__________________ |
|
01.09.2012, 09:34
| #3 |
| |  Kann keine gespeicherten Dateien mehr öffnen! Hallo,
__________________zu deinen Fragen: 1. Es hat sich weder an den Dateinamen noch an den -endungen etwas geändert, sie lauten nach wie vor: P1232.jpg (Beispiel bei Bildern) 2. Ich arbeite mit Windows 7 professionell 32 bit Und hier die Logfiles des OTL-Scans: Datei: Extras.txt OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 01.09.2012 09:55:07 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\xxxxxxx\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,87 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 47,28% Memory free
5,73 Gb Paging File | 3,74 Gb Available in Paging File | 65,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 92,21 Gb Total Space | 45,40 Gb Free Space | 49,24% Space Free | Partition Type: NTFS
Drive D: | 364,76 Gb Total Space | 115,25 Gb Free Space | 31,59% Space Free | Partition Type: NTFS
Computer Name: xxxxxxxPC | User Name: xxxxxxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 180 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_USERS\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01D4BAD6-EFE3-48DB-984F-579B654F6D6A}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{107BD430-9644-40F1-B02C-2AB22CE5ACAA}" = rport=445 | protocol=6 | dir=out | app=system |
"{135D02DA-9806-4FBD-A883-2D9A1CEED9D8}" = lport=445 | protocol=6 | dir=in | app=system |
"{1462EC92-5ED0-4DFE-A9AB-C94EDE54B5F7}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{16C8E45F-95C9-4D9F-BB5A-906CDCA00839}" = lport=139 | protocol=6 | dir=in | app=system |
"{1982C691-4A9B-4138-A92C-5D9E51D7E21D}" = lport=137 | protocol=17 | dir=in | app=system |
"{363D35F2-EA1D-4D20-A4C1-0CA1133A7A9A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3AB30171-8807-49FC-B641-FE05A148811B}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{402BD94C-6276-4F9B-A63C-0DA8B5D01126}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4DB60FB4-36B7-4C22-99D6-F4F2E0C8246A}" = rport=10243 | protocol=6 | dir=out | app=system |
"{4FC6F2F7-182B-428D-BB2B-3BBB0625FD1A}" = lport=5721 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{62059F51-90E5-45BF-A68D-F919F3C9863F}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6CC05F4D-D6F6-4C51-BB65-77D9B2BAFCC3}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{6E95F616-CB76-44FB-88F7-CDBAC743CF36}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{7138E55C-35BE-4D8D-8831-835C6FE5A844}" = lport=138 | protocol=17 | dir=in | app=system |
"{76ED4A53-052A-4519-ACF5-1822141AC35A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{AB3815AF-CA7D-4672-9F1A-529C6C9A57D3}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AD7DD0A9-AF8E-4BF4-846C-460DB5CC5917}" = rport=138 | protocol=17 | dir=out | app=system |
"{B4AB4510-4257-4B2C-991F-102FBA25B3E5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BAED7AFD-2FBE-4325-9563-6D5490DC0166}" = rport=137 | protocol=17 | dir=out | app=system |
"{BB27BAD5-9B7D-44DB-BDA1-C999997E0EA3}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{BB2A53FE-040B-411E-A6F9-F3E964A6C7A4}" = rport=139 | protocol=6 | dir=out | app=system |
"{BDB11B5C-F525-4733-89E8-04288AA30554}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{D2D591FA-25D8-4902-BBF5-A82EA12C3546}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{D6DE6FDC-BE38-457C-854E-AE737072ADEF}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdcbase.exe,-4006 |
"{F4183ABD-0DA5-4316-B9ED-C532F33E752D}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F99D2717-868F-4248-ADCE-87E95A09882F}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{FDC30E02-9E52-4A91-9BD8-0DA85B722EA9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{081975B6-F306-41F2-92B6-B1F63212D43D}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{0E944B01-29B1-4C9A-BCA1-7A2BA58E1A23}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{179074D0-2BBF-4E01-BE7D-313EA1714566}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{180A06EE-10E2-4517-8793-487DA0B2D0BD}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{1DF78855-CE9D-4F71-8DB8-10F1861D2113}" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminator.exe |
"{2426A455-13FE-4200-B726-E8ACBA8A34C7}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2767B874-8CCC-4959-A8A5-4BF1B199AED6}" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminator.exe |
"{302C8C51-14F4-46B5-9E4B-3991FD7E7934}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{3C90AAFF-B223-4E46-8A9D-1AC11AB919EC}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{3E0867E2-1ADC-4579-8AA8-63D28E3DA1AB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4233C534-D318-48E0-BDD8-67BDA61065E3}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{56A02CEA-CF22-4599-8318-C560D531863D}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{5853409C-BC55-45DE-B4A3-E3253559390D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{601658E5-0861-4748-AA4D-09868FFDAFA2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{614F0D1E-3350-4D58-85C7-7D09A33A26E3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{67A8A5DC-5B91-4C8B-BAC7-2E7E93AAFBEC}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{7C221319-6F53-4359-9280-59EC0E9D765D}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{9C1A4AF9-BEF1-4E49-B098-97AECDF3DEEE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9CB8F374-9FAB-4D0B-ABA6-C96C391CF480}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{A01BF390-B492-45A0-B7A4-A085E1AF9A8D}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{AC0FB2DE-4A38-445A-953C-F367AA7014FB}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B2A111F7-007C-4FEE-B84B-71DDAE3F58BF}" = protocol=17 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"{B4CA3B80-EDFC-4ED5-BF4F-7FE68B71A6BD}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{B689D298-1C6F-4CF4-AE80-5D2219BB1A33}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{B6D2D5E4-7576-4300-A08E-20E037D53054}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{C22A1A17-1462-4092-AE02-666728DAA60F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{C4147EE5-CBAB-4B29-A1D9-76B0DF82FBA8}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe |
"{CBBE41AE-1DFA-49AC-9246-8B43C239809D}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{CCDE785F-5947-40C9-98F8-AE1091608EAF}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{CD23D54F-7946-49E4-8FD8-A5EAE764355C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{D3200756-B9C9-4DE4-AAB2-543067D6B2AC}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{D3B3B592-C45C-4F68-AA5B-600820CDEEA0}" = protocol=6 | dir=out | app=system |
"{DAEDB943-9078-4C16-AB20-486A6C47AF98}" = protocol=6 | dir=in | app=c:\program files\spyware terminator\spywareterminatorupdate.exe |
"{E00A65FA-2307-4362-9749-2AA286DCDB28}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{E0695337-259E-4D06-A8ED-6A915753ACCC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E74662C1-42DF-49C6-8E90-8AED443243B0}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{E7B248FC-7FB7-4F06-BF31-3C27A64F0487}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{FD29797C-1375-4C4A-8F54-56E553D609E7}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA}" = Uniblue RegistryBooster
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 30
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1" = shopping-preise.de - AddOn für Firefox
"{31A559C1-9E4D-423B-9DD3-34A6C5398752}" = HTC BMP USB Driver
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{42442BC6-5A92-4BC2-9E0C-3D359D548A21}_is1" = Pazera Free MP4 to AVI Converter 1.6
"{42C8B7DF-FEB0-4D51-B169-506B6BEC5797}" = Nero 10 Menu TemplatePack 1
"{43FBAB46-5969-4200-9958-1FF81FEE506F}" = Nero 10 Movie ThemePack 1
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{526B2AE8-73DF-4CE0-B140-9968677A7C93}" = HTC Sync
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{56736259-613E-4A3B-B428-6235F2E76F44}_is1" = Spyware Terminator 2012
"{5F548A02-80BC-404D-BAE6-F05F9BF6B449}" = Nero DiscCopyGadget 10 Help (CHM)
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6B4AD1A9-E73A-4184-9D6B-072F8A3C5EBA}" = VoiceOver Kit
"{6D6664A9-3342-4948-9B7E-034EFE366F0F}" = HTC Driver Installer
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{70F19404-B96C-4EBB-AD2B-3574F8736197}" = Nero 10 Movie ThemePack 2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 4.6.0
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{92146419-AE44-4C8B-A48B-0ABB1B5EC026}" = Nero 10 Menu TemplatePack 3
"{92A10E9D-EA00-4A46-8F22-EEA660992D61}" = Nero 10 Sample Videos
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{92EC1A84-7FFC-42DF-A8F6-79C21C4765A5}" = Nero DiscCopy Gadget 10
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{96ED4B78-300E-4033-AE6C-C115CEB4DF07}" = Nero 10 ClipartPack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.5 - Deutsch
"{ACD15FDF-FC42-4175-B477-576F92FF2256}" = Nero 10 Sample ImagePack
"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{BDCEB6A6-5966-4291-861A-058F49A2195A}_is1" = MiniTool Partition Recovery 5.0
"{BF6685DC-50F9-48EA-B2FF-99AF905D7660}" = Envisioneer Express 5.0
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E712C273-7564-4C8E-AA59-0FA19BC35117}" = Nero 10 Menu TemplatePack 2
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Aldi Süd Foto Service" = Aldi Süd Foto Service 4.6
"ALDI Süd Online Druck Service" = ALDI Süd Online Druck Service 4.6
"ALDI Sued Fotoservice_is1" = Aldi Sued Fotoservice 2.7
"Ashampoo WinOptimizer 2010 Advanced_is1" = Ashampoo WinOptimizer 2010 Advanced
"AudioPlayer 3.0" = AudioPlayer 3.0
"Avira AntiVir Desktop" = Avira Free Antivirus
"conduitEngine" = Conduit Engine
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"DesktopIconAmazon" = Desktop Icon für Amazon
"Download Accelerator Plus (DAP)" = Download Accelerator Plus (DAP)
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Google Chrome" = Google Chrome
"InstallShield_{BF6685DC-50F9-48EA-B2FF-99AF905D7660}" = Envisioneer Express 5.0
"IrfanView" = IrfanView (remove only)
"loadtbs-2.1" = loadtbs-2.1
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mobile Partner" = Mobile Partner
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"PC Tools Firewall Plus" = PC Tools Firewall Plus 6.0
"Picasa 3" = Picasa 3
"Pixum ePrint" = Pixum ePrint 1.2
"SearchAnonymizer" = SearchAnonymizer
"softonic" = Softonic toolbar on IE and Chrome
"Sweet Home 3D_is1" = Sweet Home 3D version 3.5
"TomTom HOME" = TomTom HOME 2.8.2.2264
"Uniblue RegistryBooster" = Uniblue RegistryBooster
"UseNeXT_is1" = UseNeXT
"VLC media player" = VLC media player 0.9.9
"WinGimp-2.0_is1" = GIMP 2.6.7
"Winload Toolbar" = Winload Toolbar
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 19.02.2012 23:03:46 | Computer Name = xxxxxxxPc | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: SpywareTerminatorUpdate.exe, Version:
3.0.0.30, Zeitstempel: 0x4eca4385 Name des fehlerhaften Moduls: TorrentDll.dll,
Version: 3.0.0.1, Zeitstempel: 0x4dbe5f67 Ausnahmecode: 0xc0000417 Fehleroffset: 0x00132780
ID
des fehlerhaften Prozesses: 0xf2c Startzeit der fehlerhaften Anwendung: 0x01ccef2e397a6c18
Pfad
der fehlerhaften Anwendung: C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\Spyware Terminator\TorrentDll.dll Berichtskennung:
8061b8c2-5b6f-11e1-bd74-00238b5700b4
Error - 21.02.2012 06:00:12 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\HTC\HTC
Sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 21.02.2012 06:03:33 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\HTC\htc
sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 21.02.2012 19:33:17 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\HTC\HTC
Sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 21.02.2012 19:36:44 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\HTC\htc
sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 22.02.2012 17:44:27 | Computer Name = xxxxxxxPc | Source = VSS | ID = 8194
Description =
Error - 24.02.2012 03:50:35 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\HTC\HTC
Sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 24.02.2012 03:54:48 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\HTC\htc
sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 27.02.2012 10:50:05 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\HTC\HTC
Sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 27.02.2012 10:53:25 | Computer Name = xxxxxxxPc | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\HTC\htc
sync 3.0\FDAgentForOutlook64.exe". Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
[ OSession Events ]
Error - 29.01.2011 14:28:02 | Computer Name = xxxxxxxPc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2017
seconds with 240 seconds of active time. This session ended with a crash.
Error - 30.01.2011 08:02:49 | Computer Name = xxxxxxxPc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 99
seconds with 0 seconds of active time. This session ended with a crash.
Error - 05.03.2011 15:07:55 | Computer Name = xxxxxxxPc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 447
seconds with 300 seconds of active time. This session ended with a crash.
Error - 20.03.2011 09:29:55 | Computer Name = xxxxxxxPc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 894
seconds with 0 seconds of active time. This session ended with a crash.
Error - 20.01.2012 17:57:56 | Computer Name = xxxxxxxPc | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 12
seconds with 0 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 29.08.2012 14:50:25 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%-2140993535
Error - 30.08.2012 04:22:12 | Computer Name = xxxxxxxPc | Source = PNRPSvc | ID = 102
Description =
Error - 30.08.2012 04:22:12 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%-2140993535
Error - 30.08.2012 04:22:12 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
beendet: %%-2140993535
Error - 30.08.2012 04:22:29 | Computer Name = xxxxxxxPc | Source = PNRPSvc | ID = 102
Description =
Error - 30.08.2012 04:22:30 | Computer Name = xxxxxxxPc | Source = PNRPSvc | ID = 102
Description =
Error - 30.08.2012 04:22:30 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
beendet: %%-2140993535
Error - 30.08.2012 04:22:30 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%-2140993535
Error - 30.08.2012 04:22:30 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler
beendet: %%-2140993535
Error - 30.08.2012 04:22:30 | Computer Name = xxxxxxxPc | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name
Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%-2140993535
< End of report >
und otl.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.09.2012 09:55:07 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\xxxxxxx\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,87 Gb Total Physical Memory | 1,36 Gb Available Physical Memory | 47,28% Memory free 5,73 Gb Paging File | 3,74 Gb Available in Paging File | 65,23% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 92,21 Gb Total Space | 45,40 Gb Free Space | 49,24% Space Free | Partition Type: NTFS Drive D: | 364,76 Gb Total Space | 115,25 Gb Free Space | 31,59% Space Free | Partition Type: NTFS Computer Name: xxxxxPC | User Name: xxxxxxxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 180 Days ========== Processes (SafeList) ========== PRC - C:\Users\xxxxxxx\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_3_300_271.exe (Adobe Systems, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Programme\pdf24\pdf24.exe (Geek Software GmbH) PRC - C:\Users\xxxxxxx\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe () PRC - C:\Programme\Spyware Terminator\st_rsser.exe (Crawler.com) PRC - C:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe () PRC - C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe () PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom) PRC - C:\Programme\Uniblue\RegistryBooster\rbmonitor.exe (Uniblue Systems Limited) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Programme\PC Tools Firewall Plus\FWService.exe (PC Tools) PRC - C:\Programme\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools) PRC - C:\Programme\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) PRC - C:\Programme\Nero\Update\NASvc.exe (Nero AG) PRC - C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_3_300_271.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll () MOD - C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll () MOD - C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\Maps\R66Api.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcUPCTLoader.exe () MOD - C:\Programme\HTC\HTC Sync 3.0\sqlite3.7.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\sqlite3.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDetect.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDetectLegend.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\htcDisk.dll () MOD - C:\Programme\HTC\HTC Sync 3.0\fdHttpd.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll () MOD - C:\Programme\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\ContextHandler.dll () ========== Win32 Services (SafeList) ========== SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (SkypeUpdate) -- C:\Programme\Skype\Updater\Updater.exe (Skype Technologies) SRV - (SearchAnonymizer) -- C:\Users\xxxxxx\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe () SRV - (ST2012_Svc) -- C:\Programme\Spyware Terminator\st_rsser.exe (Crawler.com) SRV - (PassThru Service) -- C:\Programme\HTC\Internet Pass-Through\PassThruSvr.exe () SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation) SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom) SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) SRV - (PCToolsFirewallPlus) -- C:\Programme\PC Tools Firewall Plus\FWService.exe (PC Tools) SRV - (NAUpdate) -- C:\Programme\Nero\Update\NASvc.exe (Nero AG) SRV - (DfSdkS) -- C:\Programme\Ashampoo\Ashampoo WinOptimizer 2010 Advanced\DfSdkS.exe (mst software GmbH, Germany) SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (YahooAUService) -- C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (Microsoft Office Groove Audit Service) -- C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation) SRV - (odserv) -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (USBModem) -- system32\DRIVERS\lgusbmodem.sys File not found DRV - (UsbDiag) -- system32\DRIVERS\lgusbdiag.sys File not found DRV - (usbbus) -- system32\DRIVERS\lgusbbus.sys File not found DRV - (lgbusenum) -- system32\DRIVERS\lgbtbus.sys File not found DRV - (androidusb) -- System32\Drivers\lgandadb.sys File not found DRV - (ANDModem) -- system32\DRIVERS\lgandmodem.sys File not found DRV - (AndGps) -- system32\DRIVERS\lgandgps.sys File not found DRV - (AndDiag) -- system32\DRIVERS\lganddiag.sys File not found DRV - (Andbus) -- system32\DRIVERS\lgandbus.sys File not found DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (sp_rsdrv2) -- C:\Windows\System32\drivers\sp_rsdrv2.sys () DRV - (vmbus) -- C:\Windows\System32\drivers\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\System32\drivers\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\System32\drivers\storvsc.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\System32\drivers\VMBusHID.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\System32\drivers\vms3cap.sys (Microsoft Corporation) DRV - (pctplfw) -- C:\Windows\System32\drivers\pctplfw.sys (PC Tools) DRV - (PCTFW-PacketFilter) -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys (PC Tools) DRV - (pctNDIS) -- C:\Windows\System32\drivers\pctNdis.sys (PC Tools) DRV - (pctgntdi) -- C:\Windows\System32\drivers\pctgntdi.sys (PC Tools) DRV - (PCTFW-DNS) -- C:\Windows\System32\drivers\pctNdis-DNS.sys (PC Tools) DRV - (PCTAppEvent) -- C:\Windows\System32\drivers\PCTAppEvent.sys (PC Tools) DRV - (htcnprot) -- C:\Windows\System32\drivers\htcnprot.sys (Windows (R) Win 7 DDK provider) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (pwdrvio) -- C:\Windows\System32\pwdrvio.sys () DRV - (pwdspio) -- C:\Windows\System32\pwdspio.sys () DRV - (HTCAND32) -- C:\Windows\System32\drivers\ANDROIDUSB.sys (HTC, Corporation) DRV - (18728462) -- C:\Windows\System32\drivers\18728462.sys (Kaspersky Lab) DRV - (setup_9.0.0.722_27.08.2012_12-35drv) -- C:\Windows\System32\drivers\1872846.sys (Kaspersky Lab) DRV - (18728461) -- C:\Windows\System32\drivers\18728461.sys (Kaspersky Lab) DRV - (Serial) -- C:\Windows\System32\drivers\serial.sys (Brother Industries Ltd.) DRV - (RTL8187B) -- C:\Windows\System32\drivers\RTL8187B.sys (Realtek Semiconductor Corporation ) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2736476 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=61008 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 8F F3 81 AD CD E4 CB 01 [binary data] IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com) IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes,DefaultScope = {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{022CE129-69F3-405C-AB89-EFA7BE23429F}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D267372633D49452D536561726368426F7826464F524D3D494538535243&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = hxxp://www.crawler.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E637261776C65722E636F6D2F7365617263682F646973706174636865722E617370783F74703D627326716B773D7B7365617263685465726D737D26746269643D3631303038&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{3AB2E9AC-E69B-4162-B4DE-CAED2DAA9488}: "URL" = hxxp://search.avg.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6176672E636F6D2F726F7574652F3F643D24696E7374642426763D247665722426693D246463686964242674703D6368726F6D6526713D7B7365617263685465726D737D266C6E673D7B6D6F7A3A6C6F63616C657D2669793D2679636874653D6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{3EC9E7C7-4F37-41F2-AA16-BA02DEF6E59A}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{4EB077FB-2D36-4D93-93E9-DFC08D592DA6}: "URL" = hxxp://search.softonic.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E736F66746F6E69632E636F6D2F4D4F4E30303031352F74625F76313F713D7B7365617263685465726D737D26536561726368536F757263653D342663633D&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{5A151D7F-3401-455C-AFED-AF948FA43809}: "URL" = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263685465726D737D26736F7572636569643D69653726726C733D636F6D2E6D6963726F736F66743A656E2D55532669653D75746638266F653D75746638&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{5B8D1F5D-7100-4F1A-8FFD-05ADB450F2C3}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{5C46CC61-49AA-415A-AA3C-C190084CE40A}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{603D99C2-5D14-44EC-BD96-47E28FBE195A}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E676F6F676C652E636F6D2F7365617263683F713D7B7365617263&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{D1342E0F-D5B2-4F8E-B35A-A6DC1FFBFDEB}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=e3b0d403-71cd-4cef-b72c-54fa3d10d3bb&pid=freewarede&mode=bounce&k=0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\SearchScopes\{EE11F22B-7A6A-4647-9D70-19F35C6553A8}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2319825 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-382997804-309790855-3942279583-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB10&ctid=CT2319825&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Crawler Search" FF - prefs.js..browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..extensions.enabledItems: {F17C1572-C9EC-4e5c-A542-D05CBB5C5A08}:8.6.7.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3 FF - prefs.js..extensions.enabledItems: searchpredict@speedbit.com:1.0.1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://search.avg.com/route/?d=4cd5753e&v=6.010.006.004&i=27&tp=ab&iy=&ychte=de&lng=de&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Program Files\Crawler\Toolbar\firefox\ [2010.11.06 17:47:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\searchpredict@speedbit.com: C:\Program Files\SearchPredict\PRFireFox [2011.01.05 13:54:15 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\webbooster@iminent.com: C:\Program Files\Iminent\webbooster@iminent.com FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.31 11:09:24 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.27 10:07:08 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\extensions\firejump@firejump.net [2012.07.06 11:46:12 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.31 11:09:24 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.05.27 10:07:08 | 000,000,000 | ---D | M] [2011.09.17 14:01:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Extensions [2011.09.17 14:01:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Extensions\home2@tomtom.com [2012.08.13 17:08:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions [2012.07.04 21:29:51 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2012.07.06 11:57:20 | 000,000,000 | ---D | M] (IMinent Toolbar) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\{C9B68337-E93A-44EA-94DC-CB300EC06444} [2012.08.13 17:08:17 | 000,000,000 | ---D | M] (Bitdefender QuickScan) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012.02.16 21:07:05 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\ffxtlbra@softonic.com [2012.07.06 11:46:12 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\firejump@firejump.net [2012.05.27 10:08:06 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\xxxxxxx\AppData\Roaming\mozilla\Firefox\Profiles\urasmjlm.default\extensions\software@loadtubes.com [2012.05.21 16:34:36 | 000,000,949 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\searchplugins\conduit.xml [2012.05.09 13:02:14 | 000,001,675 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\searchplugins\softonic.xml [2012.05.09 13:02:14 | 000,002,188 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\searchplugins\{3188A434-BDB4-480D-AF60-A6ECCC784E8F}.xml [2012.05.09 13:02:14 | 000,002,077 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\searchplugins\{481BA1F5-711D-474B-B180-7740119825EC}.xml [2012.05.09 13:02:14 | 000,001,870 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\urasmjlm.default\searchplugins\{6F1FC6B0-CF80-491F-9961-45FD8AE4EAC5}.xml [2012.01.25 17:57:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.08.03 12:35:03 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.08.31 11:09:23 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.11.10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.05.27 10:08:02 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files\mozilla firefox\plugins\npmieze.dll [2012.06.08 16:00:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.31 11:09:22 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.05.09 13:02:14 | 000,001,652 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\crawlersrch.xml [2012.06.08 16:00:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.06.08 16:00:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.08 16:00:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.08 16:00:50 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.google.com CHR - plugin: Shockwave Flash (Disabled) = C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\20.0.1132.57\pdf.dll CHR - plugin: Skype Toolbars (Enabled) = C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\npSkypeChromePlugin.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Skype Extension = C:\Users\xxxxxxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\ O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com) O2 - BHO: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Softonic Helper Object) - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Programme\Softonic\softonic\1.5.11.5\bh\softonic.dll (Softonic.com) O2 - BHO: (DAPIELoader Class) - {FF6C3CF0-4B15-11D1-ABED-709549C10000} - C:\Programme\DAP\dapieloader.dll (SpeedBit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found. O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com) O3 - HKLM\..\Toolbar: (Softonic Toolbar) - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Programme\Softonic\softonic\1.5.11.5\softonicTlbr.dll (Softonic.com) O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found. O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\xxxxxxx\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH) O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) O3 - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Programme\Winload\prxtbWinl.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-382997804-309790855-3942279583-1001\..\Toolbar\WebBrowser: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com) O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HTC Sync Loader] C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NBAgent] C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe (Nero AG) O4 - HKLM..\Run: [Ocs_SM] C:\Users\xxxxxxx\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS) O4 - HKLM..\Run: [PDFPrint] C:\Programme\pdf24\pdf24.exe (Geek Software GmbH) O4 - HKLM..\Run: [SpywareTerminatorShield] C:\Programme\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com) O4 - HKLM..\Run: [SpywareTerminatorUpdater] C:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com) O4 - HKU\S-1-5-21-382997804-309790855-3942279583-1001..\Run: [Messenger (Yahoo!)] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.) O4 - HKU\S-1-5-21-382997804-309790855-3942279583-1001..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O8 - Extra context menu item: &Clean Traces - C:\Programme\DAP\Privacy Package\dapcleanerie.htm () O8 - Extra context menu item: &Download with &DAP - C:\Programme\DAP\dapextie.htm () O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Crawler Search - tbr:iemenu File not found O8 - Extra context menu item: Download &all with DAP - C:\Programme\DAP\dapextie2.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab (Symantec AntiVirus scanner) O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab (Symantec RuFSI Utility Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4AF21005-69B6-4EB5-A4EF-D9389C7B2C3F}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{5e330125-b2bc-11df-9cd6-00238b5700b4}\Shell - "" = AutoRun O33 - MountPoints2\{62582a16-e041-11e0-a2c0-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{62582a16-e041-11e0-a2c0-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{6ff3c798-f58d-11e0-a16d-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{6ff3c798-f58d-11e0-a16d-806e6f6e6963}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{eafb326c-69a8-11e0-8786-00225f5c385d}\Shell - "" = AutoRun O33 - MountPoints2\{eafb3275-69a8-11e0-8786-00225f5c385d}\Shell - "" = AutoRun O33 - MountPoints2\{eafb3275-69a8-11e0-8786-00225f5c385d}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\F\Shell - "" = AutoRun O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 180 Days ========== [2012.09.01 09:53:02 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\xxxxxxx\Desktop\OTL.exe [2012.08.31 17:18:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2012.08.31 17:17:16 | 000,311,312 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\1872846.sys [2012.08.31 17:17:16 | 000,128,016 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\18728461.sys [2012.08.31 17:17:16 | 000,037,392 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\18728462.sys [2012.08.31 17:17:16 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\Desktop\DE-Cleaner powered by Kaspersky [2012.08.26 17:02:27 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar [2012.08.26 17:02:27 | 000,000,000 | ---D | C] -- C:\Program Files\Convar [2012.08.25 09:30:31 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Malwarebytes [2012.08.25 09:30:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.25 09:30:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.25 09:30:05 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.25 09:30:04 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.25 09:20:58 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\IrfanView [2012.08.25 09:17:09 | 000,014,664 | ---- | C] (McAfee, Inc.) -- C:\Windows\stinger.sys [2012.08.25 09:16:06 | 000,000,000 | ---D | C] -- C:\Program Files\stinger [2012.08.18 18:29:48 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Avira [2012.08.18 18:27:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.08.18 18:27:00 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2012.08.18 18:26:59 | 000,137,928 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.08.18 18:26:59 | 000,083,392 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.08.18 18:26:59 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.08.18 18:26:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.08.18 18:26:54 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2012.08.16 03:00:44 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.08.16 03:00:42 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.08.16 03:00:42 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.08.16 03:00:41 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.08.16 03:00:41 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.08.16 03:00:40 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.08.16 03:00:38 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.08.15 10:38:47 | 000,400,896 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll [2012.08.15 10:38:46 | 002,345,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.08.15 10:38:44 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll [2012.08.13 17:10:38 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\QuickScan [2012.08.11 14:02:08 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Rvdefogp [2012.07.11 12:53:45 | 000,219,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2012.07.11 12:53:41 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msxml3r.dll [2012.07.11 12:53:38 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll [2012.07.06 12:09:52 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Local\CFM [2012.07.06 11:58:43 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Local\freecompressor Air [2012.07.06 11:58:29 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\freeCompressor [2012.07.06 11:57:56 | 000,000,000 | ---D | C] -- C:\Program Files\FreeCompressor [2012.07.06 11:55:46 | 000,000,000 | ---D | C] -- C:\Program Files\iNTERNET Turbo [2012.07.04 13:27:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! Companion [2012.07.04 13:27:36 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Yahoo! [2012.07.04 13:27:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yahoo! Messenger [2012.07.04 13:27:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Yahoo! [2012.07.04 13:24:10 | 000,000,000 | ---D | C] -- C:\Program Files\Yahoo! [2012.06.21 09:05:13 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll [2012.06.21 09:05:13 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll [2012.06.21 09:05:02 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll [2012.06.21 09:05:01 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll [2012.06.21 09:05:01 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll [2012.06.21 09:04:49 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll [2012.06.21 09:04:48 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe [2012.06.16 15:57:01 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\eTeks [2012.06.16 15:56:43 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\Documents\Haus [2012.06.16 15:51:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eTeks Sweet Home 3D [2012.06.16 15:50:56 | 000,000,000 | ---D | C] -- C:\Program Files\Sweet Home 3D [2012.06.14 10:11:31 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Local\Macromedia [2012.06.13 16:50:54 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2012.06.13 16:50:54 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll [2012.06.13 16:50:54 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe [2012.06.09 13:09:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.06.09 13:09:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.06.02 18:30:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\pdf24 [2012.05.27 10:07:28 | 000,000,000 | ---D | C] -- C:\Program Files\Winload [2012.05.27 10:07:05 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\loadtbs [2012.05.15 17:51:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2012.05.15 17:50:43 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2012.05.10 10:03:00 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2012.05.10 10:01:44 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders [2012.05.10 09:54:00 | 003,968,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2012.05.10 09:54:00 | 003,913,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2012.05.10 09:53:45 | 001,077,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2012.05.09 13:03:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pazera Free MP4 to AVI Converter [2012.05.09 13:03:00 | 000,000,000 | ---D | C] -- C:\Program Files\pazera-software [2012.05.09 13:02:15 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\Opera [2012.05.09 13:02:02 | 000,000,000 | ---D | C] -- C:\Users\xxxxxxx\AppData\Roaming\OCS [2012.04.25 10:11:07 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2012.04.25 10:11:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.04.17 11:55:45 | 000,426,184 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.03.17 13:00:04 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2012.03.17 12:50:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2012.03.17 12:46:28 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2012.03.16 19:58:56 | 000,826,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcore.dll [2012.03.14 08:50:59 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-27.sys [2012.03.12 15:12:51 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-26.sys [2012.03.12 14:38:28 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-25.sys [2012.03.11 15:44:00 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-24.sys [2012.03.11 13:55:30 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-23.sys [2012.03.11 13:11:31 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-22.sys [2012.03.11 09:26:17 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-21.sys [2012.03.10 21:28:35 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-20.sys [2012.03.10 14:25:15 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-19.sys [2012.03.10 09:40:38 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-18.sys [2012.03.10 09:15:02 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-17.sys [2012.03.08 15:53:51 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-16.sys [2012.03.08 09:05:09 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2012.03.08 09:05:09 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2012.03.08 09:05:09 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2012.03.08 09:05:09 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2012.03.08 09:05:09 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2012.03.08 09:05:09 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2012.03.08 09:05:08 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2012.03.08 09:05:08 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2012.03.08 09:05:08 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2012.03.08 09:05:08 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2012.03.08 09:05:07 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2012.03.08 09:05:07 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.03.08 09:05:07 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2012.03.08 09:05:07 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2012.03.08 09:05:07 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2012.03.08 09:05:07 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2012.03.08 09:05:07 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2012.03.08 09:05:07 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2012.03.08 09:05:07 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2012.03.08 09:05:07 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2012.03.08 09:05:07 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2012.03.08 09:05:07 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2012.03.08 09:05:07 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2012.03.08 09:05:07 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2012.03.08 09:05:06 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2012.03.08 09:05:06 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2012.03.08 09:05:06 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2012.03.08 09:05:06 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2012.03.08 09:05:06 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2012.03.08 09:05:06 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2012.03.07 19:26:11 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-15.sys [2012.03.07 15:41:05 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-14.sys [2012.03.07 11:13:26 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-13.sys [2012.03.07 10:34:23 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-12.sys [2012.03.06 18:55:22 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-11.sys [2012.03.06 10:59:37 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-10.sys [2012.03.06 08:41:40 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-9.sys [2012.03.05 20:08:53 | 000,003,104 | ---- | C] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-8.sys ========== Files - Modified Within 180 Days ========== [2012.09.01 09:48:39 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\xxxxxxx\Desktop\OTL.exe [2012.09.01 09:31:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.01 09:18:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.08.31 21:18:00 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.08.30 10:22:13 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job [2012.08.30 10:22:13 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\SpeedUpMyPC.job [2012.08.28 08:17:26 | 000,660,174 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.28 08:17:26 | 000,621,234 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.28 08:17:26 | 000,132,494 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.28 08:17:26 | 000,108,558 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.27 22:38:08 | 000,014,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.27 22:38:08 | 000,014,848 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.27 22:30:09 | 000,433,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.27 22:30:01 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.27 22:29:50 | 2309,443,584 | -HS- | M] () -- C:\hiberfil.sys [2012.08.26 17:02:27 | 000,001,308 | ---- | M] () -- C:\Users\xxxxxxx\Desktop\PC Inspector File Recovery.lnk [2012.08.25 09:30:10 | 000,001,091 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.25 09:20:59 | 000,001,854 | ---- | M] () -- C:\Users\xxxxxxx\Desktop\IrfanView Thumbnails.lnk [2012.08.25 09:20:59 | 000,000,978 | ---- | M] () -- C:\Users\xxxxxxx\Desktop\IrfanView.lnk [2012.08.25 09:17:09 | 000,014,664 | ---- | M] (McAfee, Inc.) -- C:\Windows\stinger.sys [2012.08.22 01:21:02 | 000,002,294 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2012.08.18 18:27:10 | 000,001,952 | ---- | M] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.08.15 14:31:18 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2012.08.15 14:31:18 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.08.13 19:57:22 | 000,290,779 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Local\census.cache [2012.08.13 19:57:21 | 000,129,513 | ---- | M] () -- C:\Users\xxxxxxx\AppData\Local\ars.cache [2012.07.18 19:47:53 | 002,345,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.07.18 18:04:42 | 000,137,928 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2012.07.18 18:04:42 | 000,083,392 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2012.07.18 18:04:42 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2012.07.06 12:11:56 | 000,000,862 | ---- | M] () -- C:\Windows\System32\InstallUtil.InstallLog [2012.07.06 11:43:00 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2012.07.06 11:43:00 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2012.07.04 23:14:34 | 000,041,984 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\browcli.dll [2012.07.04 13:27:19 | 000,001,119 | ---- | M] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.06.29 15:50:34 | 151,514,892 | ---- | M] () -- C:\Users\xxxxxxx\Documents\CPU-Temperatur [2012.06.29 02:16:58 | 001,800,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2012.06.29 02:08:59 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2012.06.29 02:07:44 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2012.06.29 02:06:02 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2012.06.29 02:04:43 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2012.06.29 02:00:45 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2012.06.29 01:57:46 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2012.06.16 15:51:15 | 000,001,099 | ---- | M] () -- C:\Users\xxxxxxx\Desktop\Sweet Home 3D.lnk [2012.06.09 18:36:22 | 000,000,167 | ---- | M] () -- C:\user.js [2012.06.09 13:09:34 | 000,002,535 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.06.06 07:03:06 | 000,805,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cdosys.dll [2012.06.03 00:19:33 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll [2012.06.03 00:19:32 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups.dll [2012.06.03 00:19:23 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll [2012.06.03 00:12:32 | 002,422,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll [2012.06.03 00:12:13 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll [2012.06.02 18:30:58 | 000,001,805 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk [2012.06.02 18:30:57 | 000,001,824 | ---- | M] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk [2012.06.02 15:19:42 | 000,171,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll [2012.06.02 15:12:20 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe [2012.06.02 06:39:10 | 000,219,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ncrypt.dll [2012.05.31 12:25:14 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [2012.05.27 10:06:38 | 000,000,348 | ---- | M] () -- C:\Users\xxxxxxx\Desktop\Ebay.de.url [2012.05.15 17:51:38 | 000,001,759 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.05.10 10:40:59 | 000,152,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msclmd.dll [2012.05.09 13:03:06 | 000,001,253 | ---- | M] () -- C:\Users\Public\Desktop\Pazera Free MP4 to AVI Converter.lnk [2012.05.05 09:46:52 | 000,400,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\srcore.dll [2012.05.03 12:06:27 | 000,075,807 | ---- | M] () -- C:\Users\xxxxxxx\Documents\Rechnung Bremsen.pdf [2012.04.26 06:45:55 | 000,058,880 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll [2012.04.26 06:45:54 | 000,129,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll [2012.04.26 06:41:16 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe [2012.03.31 06:39:37 | 003,968,368 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2012.03.31 06:39:37 | 003,913,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2012.03.17 12:50:03 | 000,001,827 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2012.03.14 08:50:59 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-27.sys [2012.03.12 15:12:51 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-26.sys [2012.03.12 14:38:28 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-25.sys [2012.03.11 15:44:00 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-24.sys [2012.03.11 13:55:30 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-23.sys [2012.03.11 13:11:31 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-22.sys [2012.03.11 09:26:17 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-21.sys [2012.03.10 21:28:35 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-20.sys [2012.03.10 14:25:15 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-19.sys [2012.03.10 09:40:38 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-18.sys [2012.03.10 09:15:02 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-17.sys [2012.03.08 15:53:51 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-16.sys [2012.03.08 09:05:09 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2012.03.08 09:05:09 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2012.03.08 09:05:09 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2012.03.08 09:05:09 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2012.03.08 09:05:09 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2012.03.08 09:05:09 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2012.03.08 09:05:08 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2012.03.08 09:05:08 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2012.03.08 09:05:08 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2012.03.08 09:05:08 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2012.03.08 09:05:07 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2012.03.08 09:05:07 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2012.03.08 09:05:07 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2012.03.08 09:05:07 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2012.03.08 09:05:07 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2012.03.08 09:05:07 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2012.03.08 09:05:07 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2012.03.08 09:05:07 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2012.03.08 09:05:07 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2012.03.08 09:05:07 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2012.03.08 09:05:07 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2012.03.08 09:05:07 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2012.03.08 09:05:07 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2012.03.08 09:05:07 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2012.03.08 09:05:07 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2012.03.08 09:05:06 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2012.03.08 09:05:06 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2012.03.08 09:05:06 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2012.03.08 09:05:06 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2012.03.08 09:05:06 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2012.03.08 09:05:06 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2012.03.07 19:26:11 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-15.sys [2012.03.07 15:41:05 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-14.sys [2012.03.07 11:13:26 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-13.sys [2012.03.07 10:34:23 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-12.sys [2012.03.06 18:55:22 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-11.sys [2012.03.06 10:59:37 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-10.sys [2012.03.06 08:41:40 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-9.sys [2012.03.05 20:08:53 | 000,003,104 | ---- | M] (Matthias Withopf) -- C:\Windows\System32\CPUTempWDrv-8.sys ========== Files Created - No Company Name ========== [2012.08.26 17:02:27 | 000,001,308 | ---- | C] () -- C:\Users\xxxxxxx\Desktop\PC Inspector File Recovery.lnk [2012.08.25 09:30:10 | 000,001,091 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.25 09:20:59 | 000,001,854 | ---- | C] () -- C:\Users\xxxxxxx\Desktop\IrfanView Thumbnails.lnk [2012.08.25 09:20:59 | 000,000,978 | ---- | C] () -- C:\Users\xxxxxxx\Desktop\IrfanView.lnk [2012.08.18 18:27:10 | 000,001,952 | ---- | C] () -- C:\Users\Public\Desktop\Avira Control Center.lnk [2012.08.13 18:06:06 | 000,290,779 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\census.cache [2012.08.13 18:05:43 | 000,129,513 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\ars.cache [2012.07.06 11:57:00 | 000,000,862 | ---- | C] () -- C:\Windows\System32\InstallUtil.InstallLog [2012.07.06 11:43:00 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS [2012.07.06 11:43:00 | 000,000,000 | RHS- | C] () -- C:\IO.SYS [2012.07.04 13:27:19 | 000,001,119 | ---- | C] () -- C:\Users\Public\Desktop\Yahoo! Messenger.lnk [2012.06.16 15:51:15 | 000,001,099 | ---- | C] () -- C:\Users\xxxxxxx\Desktop\Sweet Home 3D.lnk [2012.06.02 18:30:58 | 000,001,805 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Fax.lnk [2012.06.02 18:30:57 | 000,001,824 | ---- | C] () -- C:\Users\Public\Desktop\PDF24 Editor.lnk [2012.05.15 17:51:38 | 000,001,759 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2012.05.09 13:03:06 | 000,001,253 | ---- | C] () -- C:\Users\Public\Desktop\Pazera Free MP4 to AVI Converter.lnk [2012.04.17 11:55:48 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.03.17 12:50:03 | 000,001,827 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2012.03.12 14:38:28 | 151,514,892 | ---- | C] () -- C:\Users\xxxxxxx\Documents\CPU-Temperatur [2012.03.08 09:05:07 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2012.03.02 18:06:47 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll [2011.12.16 13:16:18 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2011.11.29 13:09:22 | 000,000,000 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\{CAD08DC0-0641-4C95-AFF4-4B3DCF3C6AA1} [2011.10.26 16:47:21 | 000,000,000 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\{6AF385F2-31ED-48C6-903B-AAE08EF7988C} [2011.10.26 16:46:09 | 000,000,000 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\{35448372-B7E0-4DC0-9E42-0E9A9E250A8E} [2011.08.22 18:59:28 | 000,718,336 | ---- | C] () -- C:\Windows\System32\pwNative.exe [2011.08.22 18:59:28 | 000,016,472 | ---- | C] () -- C:\Windows\System32\pwdrvio.sys [2011.08.22 18:59:09 | 000,011,104 | ---- | C] () -- C:\Windows\System32\pwdspio.sys [2011.08.03 12:43:11 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.06.24 17:07:20 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2011.06.08 12:10:10 | 000,000,000 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\{EA403E6E-B426-4EB6-98A5-6B48CF941BEA} [2011.03.18 18:54:14 | 000,000,037 | ---- | C] () -- C:\Windows\eprint.INI [2011.03.14 21:40:14 | 000,005,632 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.02.22 20:46:55 | 000,000,036 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Local\housecall.guid.cache [2010.12.16 19:24:22 | 000,000,026 | ---- | C] () -- C:\Windows\NeoSetup.INI [2010.08.31 15:20:03 | 000,000,205 | ---- | C] () -- C:\Users\xxxxxxx\AppData\Roaming\mdbu.bin [2009.06.05 05:53:07 | 000,005,144 | ---- | C] () -- C:\Users\xxxxxxx\.recently-used.xbel ========== LOP Check ========== [2010.11.06 17:34:28 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\AVG10 [2012.03.02 18:07:27 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\CPUTempWatch [2012.03.02 18:06:43 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\DesktopIconForAmazon [2011.03.18 18:28:31 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\diginet [2012.07.06 11:58:31 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\freeCompressor [2010.12.16 19:23:29 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\GetRightToGo [2011.03.13 18:41:03 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\gtk-2.0 [2011.12.18 12:48:43 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\HTC [2011.01.05 15:00:16 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1 [2011.08.22 15:11:25 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\IrfanView [2011.01.05 13:31:05 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\LG Electronics [2012.05.27 10:08:06 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\loadtbs [2011.12.16 18:48:24 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\MyPhoneExplorer [2012.05.09 13:02:02 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\OCS [2010.10.10 17:52:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\OpenOffice.org [2012.05.09 13:02:15 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Opera [2011.01.05 15:23:42 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Outlook [2010.08.25 19:42:23 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\PCToolsFirewallPlus [2012.09.01 09:40:30 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\QuickScan [2012.08.31 17:18:16 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Rvdefogp [2011.12.16 13:16:16 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Spyware Terminator [2011.01.05 14:54:54 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Teleca [2011.09.17 14:00:47 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\TomTom [2011.03.17 18:46:59 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\Uniblue [2012.08.31 17:11:40 | 000,000,000 | ---D | M] -- C:\Users\xxxxxxx\AppData\Roaming\UseNeXT [2012.08.30 10:22:13 | 000,000,342 | ---- | M] () -- C:\Windows\Tasks\RegistryBooster.job [2012.04.25 10:19:34 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2012.08.30 10:22:13 | 000,000,334 | ---- | M] () -- C:\Windows\Tasks\SpeedUpMyPC.job ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:A9662AE0 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:C31F31E6 < End of report > ich hoffe, du kannst mir weiter helfen. Thomas |
|
02.09.2012, 08:14
| #4 | |||||
| /// Helfer-Team | Kann keine gespeicherten Dateien mehr öffnen! ► Hilfeleistung - geplante Vorgehensweise:
Für Vista und Win7: Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! 1. Würde ich deinstallieren (unnötig) und die Windows eigene Firewall einschalten!: Zitat:
Das Installieren von `zuviel` Software beeinträchtigt die Systemleistung und Sicherheit, verlangsamt den Start-Vorgang enorm und belastet den Arbeitsspeicher (weil laufen ja die Programme nebeneinander gleichzeitig, die viel Performance fressen, aber wenig Qualität bringen). Im Laufe der Zeit wird der rechner durch zu viel unnötigen Ballast immer langsamer, und unsicherer. Um so mehr Programme installiert sind, um so häufiger treten Probleme auf, die dann unter Umständen nur schwer lösen können. Dazu kommt noch, das einige Programme große Sicherheitsrisiken mit sich bringen, denn jede Software hat Ihre Lücken  Außerdem der Angreifer kann sich jeder Zeit erhöhte Rechte verschaffen, Antiviren-, Firewall- und andere Schutzprogramme einfach abschalten... Windows ist grundsätzlich anfällig: Zitat:
Deinstalliere: Zitat:
3. Deinstalliere, unter Systemsteuerung-> Software/Programme: Code:
ATTFilter Conduit Engine
IMinent Toolbar
loadtbs
Softonic Toolbar
Yahoo! Toolbar
Winload Toolbar
Immer die benutzerdefinierte Installation wählen, nicht die Standardinstallation, weil dann oft Sachen mitinstalliert werden, die man nicht braucht oder nicht möchte. Bei Installation bitte die Lizenzbestimmungen immer lesen, und nicht sofort überall den Haken setzen bzw gesetzten Haken belassen, weil damit stimmt man nämlich zu, dass andere "Fremdprogramm", oder sogar Adware (Werbe-Pop-ups) durch Partnerprogrammen, Sponsoren etc - mitinstalliert wird, weil sich Freeware damit finanziert. Zitat:
Code:
ATTFilter Uniblue RegistryBooster
Windows garnix so dumm, wie oft behauptet wird! - Windows mit Eigenmittel zu beschleunigen, bietet an von Hause aus einen ordentlichen Werkzeugkoffer, mit guter Ausstattung für "Heimwerker": ...das Glück liegt darin, da weiß man wenigstens was man tut!  Tipps: ► Wenn wir fertig sind, kannst "ausprobieren":
5. Hast du den Rechner bereits auf Viren überprüft? Folgende Ergebnisse möchte ich noch sehen: Code:
ATTFilter Malwarebytes
TDSSKiller
(alle vorhandenen Protokolle!)
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
7. erneut einen Scan mit OTL:
Zitat:
kira
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! Geändert von kira (02.09.2012 um 08:20 Uhr) |
|
| Themen zu Kann keine gespeicherten Dateien mehr öffnen! |
| andere, anderen, anwendung, bestimmte, bestimmten, dateien, dateien lassen sich nicht öffnen, dateiname, dateinamen, datum, eingefangen, email, fehlermeldung, fehlermeldungen, homepage, malwarebytes, programm, rechner, scan, scanner, sofort, verändert, videodateien, virenscan, virenscanner, vorschaubilder, öffnen |
Linear-Darstellung
