| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
30.08.2012, 01:13
| #1 |
 |  GVU Trojaner Hallo ICh hoffe ich habe da alles richtig gemacht bin zum ersten mal hier ^^ naja zurück zu meinen prob. nehmlich mein bruter hat den gvu trojaner und jetzt stadt alles neu installiren (das erst vor 3 wochen neu installirt wurde) und bei euch schon öffteres hilfreiche sachen gefunden habe habe jetzt das prob OTL.TXT Code:
ATTFilter OTL logfile created on: 30.08.2012 01:38:52 - Run 1 OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\DAVID\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free 6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe PRC - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe PRC - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.07.04 08:21:18 | 000,453,632 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe PRC - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.07.03 13:46:44 | 000,462,920 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () -- C:\Programme\PC Beschleunigen\PCSUService.exe PRC - [2012.05.29 15:50:04 | 000,115,032 | R--- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Messenger\SweetIM.exe PRC - [2012.02.26 16:01:44 | 000,295,728 | ---- | M] (SweetIM Technologies Ltd.) -- C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe PRC - [2011.03.28 20:31:16 | 000,193,920 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe PRC - [2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe ========== Modules (No Company Name) ========== MOD - [2012.08.01 19:37:35 | 000,240,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsFormsIntegra#\961b28b18dc304d4434ca9938abd1d60\WindowsFormsIntegration.ni.dll MOD - [2012.08.01 17:51:04 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\c366ebd7f33816762268154efc68176d\System.Core.ni.dll MOD - [2012.08.01 01:14:04 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc626095c194be137bceb219934b06a7\PresentationFramework.Aero.ni.dll MOD - [2012.08.01 01:13:59 | 014,325,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\517358eb2fd962a942dd1ea6afc5b93e\PresentationFramework.ni.dll MOD - [2012.08.01 01:13:46 | 012,218,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\e9d0ba41128f363f2390c7e630129c2b\PresentationCore.ni.dll MOD - [2012.08.01 01:13:46 | 000,060,928 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\UIAutomationProvider\68b5806af0df6ce86027bacb7dc37233\UIAutomationProvider.ni.dll MOD - [2012.08.01 01:13:36 | 003,325,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b68fdf2c95b93fc5006a092c11eed07c\WindowsBase.ni.dll MOD - [2012.08.01 01:13:29 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll MOD - [2012.08.01 01:13:09 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll MOD - [2012.08.01 01:13:02 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll MOD - [2012.08.01 01:12:54 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll MOD - [2012.08.01 01:12:51 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll MOD - [2012.08.01 01:12:47 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll MOD - [2012.08.01 01:12:42 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012.08.01 01:12:33 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2012.07.20 14:42:02 | 000,652,800 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll MOD - [2012.07.04 01:34:48 | 000,095,232 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll MOD - [2012.07.04 01:16:08 | 000,369,152 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2009.07.14 10:47:20 | 000,249,856 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\PresentationFramework.resources.dll MOD - [2009.07.14 10:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.07.14 10:47:12 | 000,208,896 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll ========== Services (SafeList) ========== SRV - [2012.08.23 18:52:58 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.08.01 01:43:59 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012.07.29 11:23:14 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater) SRV - [2012.07.27 22:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.14 02:13:54 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.07.04 08:20:42 | 000,217,088 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2012.07.04 01:34:42 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV - [2012.07.03 13:46:44 | 000,655,944 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.06.05 09:39:42 | 000,289,544 | ---- | M] () [Auto | Running] -- C:\Programme\PC Beschleunigen\PCSUService.exe -- (PCSUService) SRV - [2012.03.08 18:32:24 | 001,492,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2011.04.01 11:14:30 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.03.28 20:31:14 | 001,713,536 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2011.03.28 11:21:16 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.09.22 16:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 03:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) ========== Driver Services (SafeList) ========== DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2012.07.04 08:58:12 | 010,070,016 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2012.07.04 07:10:30 | 000,290,304 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2012.07.03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.02.23 14:31:58 | 000,086,544 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService) DRV - [2010.05.20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo) DRV - [2010.02.18 09:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86) DRV - [2009.07.14 03:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009.07.14 03:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009.07.14 03:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009.07.14 01:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.07.14 01:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://mystart.incredibar.com/mb178?a=6OyM8En1pg&i=26 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 55 73 BC AC 68 6F CD 01 [binary data] IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.) IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes,DefaultScope = {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=112555&tt=010812_nich_3112_7&babsrc=SP_ss&mntrId=60755749000000000000001d9284e761 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb178/?search={searchTerms}&loc=IB_DS&a=6OyM8En1pg&i=26 IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = hxxp://search.sweetim.com/search.asp?src=6&crg=3.16010003&st=12&q={searchTerms}&barid={02010704-9E70-4432-A75F-0CAEB55238B6} IE - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "MyStart Search" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/" FF - prefs.js..keyword.URL: "hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&a=6OyM8En1pg&&i=26&search=" FF - prefs.js..network.proxy.type: 0 FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.hlportal.de/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.6.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.6.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.08.25 23:35:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.08.01 01:25:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.01 01:25:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Extensions [2012.08.25 23:44:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions [2012.08.01 22:42:36 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.08.04 15:35:56 | 000,000,000 | ---D | M] (Default Manager) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\DefaultManager@Microsoft [2012.08.05 14:07:33 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\DAVID\AppData\Roaming\mozilla\Firefox\Profiles\2st5itbf.default\extensions\ffxtlbr@babylon.com [2012.08.25 23:35:07 | 000,002,203 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\MyStart Search.xml [2012.08.13 12:21:26 | 000,004,003 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Mozilla\Firefox\Profiles\2st5itbf.default\searchplugins\sweetim.xml [2012.08.01 01:25:37 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.08.25 23:35:09 | 000,000,000 | ---D | M] (Web Assistant) -- C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012.08.02 16:10:28 | 000,330,316 | ---- | M] () (No name found) -- C:\USERS\DAVID\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\2ST5ITBF.DEFAULT\EXTENSIONS\PERSONAS@CHRISTOPHER.BEARD.XPI [2012.07.14 02:15:45 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012.07.14 02:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.08.04 18:20:45 | 000,002,361 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2012.07.14 02:45:08 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.07.14 02:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.07.14 02:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.07.14 02:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.07.14 02:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} CHR - default_search_provider: MyStart Search (Enabled) CHR - default_search_provider: search_url = hxxp://mystart.incredibar.com/mb178/?loc=IB_DS&search={searchTerms}&a=6OyM8En1pg&i=26 CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://home.sweetim.com/?crg=3.16010003&st=12&barid={02010704-9E70-4432-A75F-0CAEB55238B6} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.75\PepperFlash\pepflashplayer.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_268.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\DAVID\AppData\Local\Google\Chrome\Application\21.0.1180.83\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Java(TM) Platform SE 7 U5 (Enabled) = C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Java Deployment Toolkit 7.0.50.6 (Enabled) = C:\Windows\system32\npDeployJava1.dll CHR - plugin: Windows Live\\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Facebook Desktop (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\DAVID\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Google Update (Enabled) = C:\Users\DAVID\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1165635.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\ CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\ CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\ CHR - Extension: Blue Mist = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgkbmdcobedhknnajfbimomnhndjfaa\1_0\ CHR - Extension: Web Assistant = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.474_0\ CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\Copy of CHR - Extension: SweetIM for Facebook = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.0.0.0_0\ CHR - Extension: New tab for Chrome\u2122 = C:\Users\DAVID\AppData\Local\Google\Chrome\User Data\Default\Extensions\jifflliplgeajjdhmkcfnngfpgbjonjg\1.0.0_0\ O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\bh\BabylonToolbar.dll (Babylon BHO) O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll () O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Programme\BabylonToolbar\BabylonToolbar\1.5.29.1\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Programme\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) O3 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000\..\Toolbar\WebBrowser: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [AMD AVT] C:\Windows\System32\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SweetIM] C:\Programme\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.) O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.) O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Facebook Update] C:\Users\DAVID\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [PCSpeedUp] C:\Programme\PC Beschleunigen\PCSUNotifier.exe () O4 - HKU\S-1-5-21-1147550278-2776106881-3068253191-1000..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\DAVID\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4F21A1A-2DCA-4472-8E3E-8C886204D1F9}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {0213C6AF-5562-4D09-884C-2ADCFC8C2F35} - Microsoft .NET Framework 1.1 Security Update (KB2656353) ActiveX: {1897C549-AE52-4571-8996-44854F5612B2} - Microsoft .NET Framework 1.1 Security Update (KB2656370) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {23A20C3C-2ADD-4A80-AFB4-C146F8847D79} - .NET Framework ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.08.30 01:30:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes [2012.08.30 01:30:19 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2012.08.30 01:30:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.08.30 01:24:40 | 010,652,120 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.30 01:22:13 | 000,598,528 | ---- | C] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe [2012.08.29 19:36:28 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2012.08.29 16:43:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FDEFC916-94F8-402F-BF07-85166C54D94D} [2012.08.28 14:59:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\test [2012.08.28 14:57:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.28 13:53:23 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2012.08.28 13:47:34 | 000,445,016 | ---- | C] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll [2012.08.28 13:47:34 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\ssleay32.dll [2012.08.28 13:47:33 | 000,265,216 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libssl32.dll [2012.08.28 13:47:33 | 000,103,424 | ---- | C] (GNU <www.gnu.org>) -- C:\Windows\System32\libintl3.dll [2012.08.28 13:47:32 | 002,288,181 | ---- | C] (Red Hat) -- C:\Windows\System32\cygwin1.dll [2012.08.28 13:47:32 | 001,178,112 | ---- | C] (The OpenSSL Project, hxxp://www.openssl.org/) -- C:\Windows\System32\libeay32.dll [2012.08.28 13:47:32 | 001,008,128 | ---- | C] (GnuWin32 <hxxp://gnuwin32.sourceforge.net>) -- C:\Windows\System32\libiconv2.dll [2012.08.28 13:47:32 | 000,325,376 | ---- | C] (AutoIt Team) -- C:\Windows\System32\AutoItX3.dll [2012.08.28 13:47:32 | 000,131,072 | ---- | C] (Sereby Corporation) -- C:\Windows\System32\AiORuntimes.dll [2012.08.28 13:45:52 | 000,000,000 | ---D | C] -- C:\Windows\System32\URTTEMP [2012.08.28 13:27:38 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{AA70E4C7-3EA6-4479-AAFD-4B32DC075A42} [2012.08.27 16:14:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3DE389B4-21C6-4EF5-8BF2-2125B738FB7E} [2012.08.26 16:04:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{74C5C7E0-7B28-40F1-B457-603587B130DD} [2012.08.25 23:36:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IZArc [2012.08.25 23:36:55 | 000,000,000 | ---D | C] -- C:\Program Files\IZArc [2012.08.25 23:35:17 | 000,000,000 | ---D | C] -- C:\Program Files\Perion [2012.08.25 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\Incredibar.com [2012.08.25 23:35:09 | 000,000,000 | ---D | C] -- C:\Program Files\Web Assistant [2012.08.25 16:39:53 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1422C04D-9D74-4483-865B-52C45E21E570} [2012.08.24 15:53:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A5C05416-0D11-4151-97E2-EC046BE23852} [2012.08.23 16:15:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A3BDA7CD-7DC8-4F42-B547-D0FE664CC038} [2012.08.23 01:00:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{81CC2B07-26AC-448A-936F-B214C29D51AB} [2012.08.22 12:59:25 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3B1172AC-8B45-4ED4-9572-266D3B87A182} [2012.08.22 00:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{D5D78E76-B6C4-43ED-A7E9-4E0226747904} [2012.08.21 12:58:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{90C325E5-C120-49B6-B17F-51BC89180147} [2012.08.21 00:57:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8D27366A-EF92-4DEA-A76E-40514405ADBE} [2012.08.20 12:57:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7698B4A-3A96-4D69-BBCE-612004A05FD7} [2012.08.19 14:07:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft LifeCam [2012.08.19 12:58:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1BCE4FB6-C611-48A9-ADB4-A4BE3F99FFB9} [2012.08.18 17:46:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (2) [2012.08.18 09:27:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5FF8639-8AAA-4099-B3B3-3AE8D854DB48} [2012.08.18 09:27:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5429EB52-19E3-43D6-BCC3-B199799BB7AD} [2012.08.15 13:12:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0AC293C2-380F-4FC8-973B-D1DA57F894E3} [2012.08.15 13:12:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{69187003-FC8F-4047-A90E-97A4608E6069} [2012.08.15 01:12:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5A3141BA-7C90-404A-BDCD-C519CC469776} [2012.08.15 01:11:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{5647895B-9C4B-409E-A38C-2772D698418F} [2012.08.14 13:11:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B0C8A4DA-2EAB-4BB2-9709-E04AFFC4CE21} [2012.08.14 13:10:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{17BFBFA2-3B8A-4DCD-990B-5E34AB8589D3} [2012.08.14 00:09:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FAD0800A-D4C8-472E-BCBE-AD056320F233} [2012.08.14 00:08:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{297A7543-3CE9-4971-9F13-1548882E53F0} [2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\SweetIM [2012.08.13 12:21:07 | 000,000,000 | ---D | C] -- C:\Program Files\SweetIM [2012.08.13 12:21:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.13 12:21:02 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Pacman [2012.08.13 12:07:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1C986E0F-39FE-404D-9C06-AFFF63788D27} [2012.08.13 12:07:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{235318B8-F279-4CA9-A52E-A5CC759CE37E} [2012.08.12 23:52:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1863F3F9-C4EE-4E4E-BE72-6B42E973A38A} [2012.08.12 23:52:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{840B3278-5D66-4516-ADD9-0AC97A23CB30} [2012.08.12 21:48:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome [2012.08.12 21:47:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Google [2012.08.12 12:52:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook [2012.08.12 12:34:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner [2012.08.12 11:51:35 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C1E37549-7EB1-4C8E-93A5-8FE0C663A06C} [2012.08.12 11:51:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1ED976BA-9880-4615-8287-38FE7E3D7F83} [2012.08.12 01:41:48 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2AC7E57D-A98C-41F3-BFB1-4D4DB3863B53} [2012.08.12 01:41:26 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A6B5B453-2E78-4CDB-8B52-B99E543F0188} [2012.08.11 13:40:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{269AA1F6-34B6-4809-BE3C-DC44F4FA75D4} [2012.08.11 13:40:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{310F73D9-E60F-483F-9B61-8BC8AF9494B2} [2012.08.11 01:28:36 | 000,000,000 | ---D | C] -- C:\Program Files\osu! [2012.08.11 01:27:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.10 15:59:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{DDDEBA05-4446-4E17-9086-4A17F993C423} [2012.08.10 15:59:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{456EA81D-AF2B-416A-B8E4-331D321D94CD} [2012.08.10 03:58:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B7EF1C98-97A8-4FAF-83EC-E773C8EB479C} [2012.08.09 15:57:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C59EEA8A-D61E-4067-B523-B362207F253B} [2012.08.09 15:57:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{05D54603-FF7E-4972-A537-E4E99B176E79} [2012.08.09 15:50:01 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft LifeCam [2012.08.09 15:49:03 | 000,000,000 | ---D | C] -- C:\e51500d3262ef71cfa616f1fe023 [2012.08.09 15:02:04 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1912FD8E-4F8C-4DD2-9ABE-B6337B08A99F} [2012.08.08 15:22:32 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{3EA14EC2-49DA-4ABF-9973-41A45A6A36E4} [2012.08.08 15:22:08 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{1F2267B3-DCE0-4DC8-B3A4-E0D9A0B5E061} [2012.08.08 03:21:43 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{4838BC28-92D9-4830-8577-0213983EC707} [2012.08.08 03:21:21 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{0C079B8E-8EC4-414A-8962-97BE5F46FC49} [2012.08.07 15:21:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{E02D56C4-A005-431F-9758-88F30D4BFD59} [2012.08.07 15:20:45 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{CBDA15B1-0953-4E03-9631-24B4ECF4DC67} [2012.08.07 03:20:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9F2A31F6-DBF8-45BA-AE38-8DC41891BECB} [2012.08.07 03:19:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{2666C542-9294-44C6-989C-A3AA218411CB} [2012.08.06 15:19:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{A8A3BA5A-B6F5-47A7-A155-714F8EA8AC8D} [2012.08.06 15:19:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{408FFAD5-F2FA-4003-87C0-B5BE3EE339A7} [2012.08.05 19:50:29 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Facebook [2012.08.05 15:37:03 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{F5F71426-9B07-440E-8A74-893D43DB5AC5} [2012.08.05 15:36:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{660D6C36-EB57-4749-99B8-EC6A1731ECF9} [2012.08.05 03:36:17 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{199BBFA7-03AB-4B30-B7B2-0F36BB5F406E} [2012.08.05 03:36:07 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{49BB09EF-F59F-48F5-9CF2-C1A95C8E6203} [2012.08.04 18:20:54 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.04 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\BabylonToolbar [2012.08.04 18:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon [2012.08.04 18:20:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader [2012.08.04 18:20:33 | 000,000,000 | ---D | C] -- C:\Program Files\YourFileDownloader [2012.08.04 18:09:37 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2012.08.04 15:35:51 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8C8178A6-3AF8-4CC6-BCE1-F66F1883CE6C} [2012.08.04 15:35:37 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{8FB349F9-71F5-4C01-8982-5A562376DAAF} [2012.08.04 15:35:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{B4EF47E7-3879-4F1C-91B6-F28AEAF05972} [2012.08.03 18:15:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\INVedit [2012.08.03 14:06:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{9CD59B95-DBD1-4F4B-821E-1643F6892142} [2012.08.03 14:06:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{C6697D36-273A-4462-A68B-BC4711B63CA9} [2012.08.02 16:18:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{7A4C2557-182F-48B5-9824-24BC1977C34B} [2012.08.02 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{FF041113-94D8-4843-B1B9-CD21598ADF43} [2012.08.01 22:44:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\PCSpeedUp [2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Beschleunigen [2012.08.01 22:44:21 | 000,000,000 | ---D | C] -- C:\Program Files\PC Beschleunigen [2012.08.01 22:42:55 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.01 22:42:36 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.01 22:42:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2012.08.01 22:42:30 | 000,405,144 | ---- | C] (Newtonsoft) -- C:\Windows\System32\Newtonsoft.Json.Net20.dll [2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\DVDVideoSoft [2012.08.01 22:42:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DVDVideoSoft [2012.08.01 22:41:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 21:33:11 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{44362EDA-AF1C-463A-803F-03AB0D7903B8} [2012.08.01 21:33:05 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Documents\Meine empfangenen Dateien [2012.08.01 21:33:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\{BD0C36FC-4345-475D-8E00-7B2CB1546E34} [2012.08.01 21:32:47 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Tracing [2012.08.01 21:29:15 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.08.01 21:28:31 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE [2012.08.01 21:28:08 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live [2012.08.01 21:27:36 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft SQL Server Compact Edition [2012.08.01 21:25:26 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live [2012.08.01 21:24:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft [2012.08.01 21:23:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.08.01 21:23:14 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.08.01 21:19:57 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Windows Live [2012.08.01 21:19:55 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live [2012.08.01 20:48:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\rom & emulator [2012.08.01 20:46:18 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\musik meins [2012.08.01 20:46:16 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\deck [2012.08.01 20:45:24 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\mein bilder neue version ^_^ [2012.08.01 20:45:02 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Love [2012.08.01 20:43:40 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\hg und so bilder [2012.08.01 20:42:34 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (9) [2012.08.01 20:42:31 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\fotos und co [2012.08.01 20:42:30 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\Neuer Ordner (13) [2012.08.01 20:42:19 | 000,000,000 | ---D | C] -- C:\Users\DAVID\Desktop\David sicherung [2012.08.01 20:22:50 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ElevatedDiagnostics [2012.08.01 20:00:18 | 000,000,000 | ---D | C] -- C:\Windows\ja-JP [2012.08.01 20:00:17 | 000,000,000 | ---D | C] -- C:\Windows\en-US [2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\ja [2012.08.01 19:59:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\0411 [2012.08.01 19:59:49 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\ja-JP [2012.08.01 19:54:35 | 000,003,072 | ---- | C] (SCM Microsystems, Inc.) -- C:\Windows\System32\drivers\ja-JP\pscr.sys.mui [2012.08.01 19:54:32 | 000,031,744 | ---- | C] (Marvell) -- C:\Windows\System32\drivers\ja-JP\yk62x86.sys.mui [2012.08.01 19:53:54 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerIb.sys.mui [2012.08.01 19:53:53 | 000,006,144 | ---- | C] (Agere Systems) -- C:\Windows\System32\drivers\ja-JP\ltmdmnt.sys.mui [2012.08.01 19:53:32 | 000,002,560 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrParwdm.sys.mui [2012.08.01 19:53:31 | 000,006,656 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\System32\drivers\ja-JP\BrSerId.sys.mui [2012.08.01 17:49:51 | 000,000,000 | ---D | C] -- C:\Program Files\Paint.NET [2012.08.01 17:49:33 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Paint.NET [2012.08.01 17:48:39 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.01 17:48:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PhotoScape [2012.08.01 17:48:18 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoScape [2012.08.01 01:52:14 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2012.08.01 01:51:15 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Skype [2012.08.01 01:51:09 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.08.01 01:51:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.08.01 01:51:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.08.01 01:50:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2012.08.01 01:42:26 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam [2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2012.08.01 01:42:24 | 000,000,000 | ---D | C] -- C:\Program Files\Steam [2012.08.01 01:41:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2012.08.01 01:33:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2012.08.01 01:31:43 | 000,000,000 | ---D | C] -- C:\Windows\System32\Adobe [2012.08.01 01:31:28 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Adobe [2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2012.08.01 01:30:40 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Macromedia [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Macromedia [2012.08.01 01:29:23 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Adobe [2012.08.01 01:28:13 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed [2012.08.01 01:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Mozilla [2012.08.01 01:25:41 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Mozilla [2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service [2012.08.01 01:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.08.01 01:25:36 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2012.08.01 01:17:42 | 000,000,000 | -H-D | C] -- C:\Program Files\Temp [2012.08.01 01:15:56 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\AMD [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\ATI [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\ATI [2012.08.01 01:15:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2012.08.01 01:15:51 | 000,000,000 | ---D | C] -- C:\Program Files\AMD AVT [2012.08.01 01:15:48 | 000,000,000 | ---D | C] -- C:\Program Files\AMD APP [2012.08.01 01:15:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ATI Technologies [2012.08.01 01:15:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2012.08.01 01:14:58 | 000,000,000 | ---D | C] -- C:\ProgramData\AMD [2012.08.01 01:14:11 | 000,000,000 | ---D | C] -- C:\Program Files\ATI [2012.08.01 01:13:49 | 000,000,000 | ---D | C] -- C:\Program Files\ATI Technologies [2012.08.01 01:12:59 | 000,000,000 | ---D | C] -- C:\AMD [2012.08.01 00:50:35 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2012.08.01 00:34:49 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft Games [2012.08.01 00:13:48 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.08.01 00:13:45 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Searches [2012.08.01 00:02:30 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.08.01 00:02:20 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Identities [2012.08.01 00:02:18 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Contacts [2012.08.01 00:02:09 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\VirtualStore [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Vorlagen [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Verlauf [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Temporary Internet Files [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Startmenü [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\SendTo [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Recent [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Netzwerkumgebung [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Lokale Einstellungen [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Druckumgebung [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Cookies [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\AppData\Local\Anwendungsdaten [2012.08.01 00:02:03 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Anwendungsdaten [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Videos [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Musik [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Eigene Dateien [2012.08.01 00:02:02 | 000,000,000 | -HSD | C] -- C:\Users\DAVID\Documents\Eigene Bilder [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Temp [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Local\Microsoft [2012.08.01 00:02:01 | 000,000,000 | ---D | C] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs [2012.08.01 00:02:00 | 000,000,000 | --SD | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Videos [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Saved Games [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Pictures [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Music [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Links [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Favorites [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Downloads [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Documents [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\Desktop [2012.08.01 00:02:00 | 000,000,000 | R--D | C] -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.08.01 00:02:00 | 000,000,000 | -H-D | C] -- C:\Users\DAVID\AppData [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Programme [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.07.31 23:58:09 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2012.07.31 23:54:18 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.07.31 23:51:27 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2012.07.31 23:51:05 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2012.08.30 01:30:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.30 01:24:53 | 010,652,120 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\DAVID\Desktop\mbam-setup-1.62.0.1300.exe [2012.08.30 01:23:59 | 000,618,227 | ---- | M] () -- C:\Users\DAVID\Desktop\adwcleaner.exe [2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 01:23:15 | 000,014,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.08.30 01:22:15 | 000,598,528 | ---- | M] (OldTimer Tools) -- C:\Users\DAVID\Desktop\OTL.exe [2012.08.30 01:18:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.08.30 01:18:09 | 2616,745,984 | -HS- | M] () -- C:\hiberfil.sys [2012.08.29 16:57:12 | 000,001,120 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.29 16:54:23 | 004,503,728 | ---- | M] () -- C:\ProgramData\nud0repor.pad [2012.08.29 16:54:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.28 21:57:00 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.28 14:42:34 | 000,265,640 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.28 14:17:59 | 000,707,062 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.08.28 14:17:59 | 000,660,658 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.08.28 14:17:59 | 000,411,572 | ---- | M] () -- C:\Windows\System32\perfh011.dat [2012.08.28 14:17:59 | 000,152,548 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc011.dat [2012.08.28 14:17:59 | 000,124,744 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.08.28 13:56:46 | 000,007,958 | ---- | M] () -- C:\Windows\unins002.dat [2012.08.28 13:56:37 | 000,709,719 | ---- | M] () -- C:\Windows\unins002.exe [2012.08.28 13:52:49 | 000,011,299 | ---- | M] () -- C:\Windows\unins001.dat [2012.08.28 13:52:26 | 001,199,175 | ---- | M] () -- C:\Windows\unins001.exe [2012.08.28 13:47:37 | 000,010,922 | ---- | M] () -- C:\Windows\unins000.dat [2012.08.28 13:47:28 | 001,187,609 | ---- | M] () -- C:\Windows\unins000.exe [2012.08.28 01:08:58 | 000,011,264 | -H-- | M] () -- C:\Users\DAVID\Desktop\photothumb.db [2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job [2012.08.25 23:35:13 | 000,000,764 | ---- | M] () -- C:\user.js [2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.22 12:01:11 | 000,002,453 | ---- | M] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk [2012.08.19 14:07:41 | 000,002,011 | ---- | M] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk [2012.08.13 12:21:03 | 000,000,000 | ---- | M] () -- C:\END [2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2012.08.03 21:35:43 | 000,077,728 | ---- | M] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg [2012.08.01 22:48:00 | 000,011,189 | -HS- | M] () -- C:\Users\DAVID\Desktop\Folder.jpg [2012.08.01 22:48:00 | 000,002,348 | -HS- | M] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg [2012.08.01 22:42:31 | 000,001,360 | ---- | M] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk [2012.08.01 19:59:17 | 000,141,988 | ---- | M] () -- C:\Windows\System32\perfi011.dat [2012.08.01 19:59:17 | 000,031,548 | ---- | M] () -- C:\Windows\System32\perfd011.dat [2012.08.01 17:50:57 | 000,001,288 | ---- | M] () -- C:\Users\Public\Desktop\Paint.NET.lnk [2012.08.01 17:48:30 | 000,000,993 | ---- | M] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk [2012.08.01 16:47:02 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.01 01:51:09 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.01 01:42:30 | 000,000,875 | ---- | M] () -- C:\Users\Public\Desktop\Steam.lnk [2012.08.01 01:31:08 | 000,278,561 | ---- | M] () -- C:\Users\DAVID\Desktop\Minecraft.exe [2012.08.01 01:25:38 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.07.31 23:55:20 | 000,057,050 | ---- | M] () -- C:\Windows\System32\license.rtf [2012.07.31 23:53:46 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin ========== Files Created - No Company Name ========== [2012.08.30 01:30:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.08.30 01:23:52 | 000,618,227 | ---- | C] () -- C:\Users\DAVID\Desktop\adwcleaner.exe [2012.08.28 17:46:19 | 004,503,728 | ---- | C] () -- C:\ProgramData\nud0repor.pad [2012.08.28 17:46:19 | 000,001,887 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.28 13:56:37 | 000,709,719 | ---- | C] () -- C:\Windows\unins002.exe [2012.08.28 13:56:37 | 000,007,958 | ---- | C] () -- C:\Windows\unins002.dat [2012.08.28 13:52:27 | 001,199,175 | ---- | C] () -- C:\Windows\unins001.exe [2012.08.28 13:52:27 | 000,011,299 | ---- | C] () -- C:\Windows\unins001.dat [2012.08.28 13:47:34 | 000,066,560 | ---- | C] () -- C:\Windows\System32\zlib1.dll [2012.08.28 13:47:33 | 000,162,304 | ---- | C] () -- C:\Windows\System32\libpng13.dll [2012.08.28 13:47:33 | 000,138,752 | ---- | C] () -- C:\Windows\System32\libpng15.dll [2012.08.28 13:47:32 | 001,187,609 | ---- | C] () -- C:\Windows\unins000.exe [2012.08.28 13:47:32 | 000,271,264 | ---- | C] () -- C:\Windows\System\vbrun100.dll [2012.08.28 13:47:32 | 000,210,944 | ---- | C] () -- C:\Windows\System\msvcrt10.dll [2012.08.28 13:47:32 | 000,010,922 | ---- | C] () -- C:\Windows\unins000.dat [2012.08.22 20:23:50 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.08.19 14:07:41 | 000,002,011 | ---- | C] () -- C:\Users\Public\Desktop\Microsoft LifeCam.lnk [2012.08.13 12:21:03 | 000,000,000 | ---- | C] () -- C:\END [2012.08.12 21:48:36 | 000,002,453 | ---- | C] () -- C:\Users\DAVID\Desktop\Google Chrome.lnk [2012.08.12 21:47:42 | 000,001,120 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.12 21:47:41 | 000,001,068 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.12 12:52:06 | 000,001,320 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk [2012.08.05 19:50:36 | 000,000,928 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.05 19:50:34 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.04 18:20:49 | 000,000,764 | ---- | C] () -- C:\user.js [2012.08.04 00:41:31 | 000,011,264 | -H-- | C] () -- C:\Users\DAVID\Desktop\photothumb.db [2012.08.03 21:35:42 | 000,077,728 | ---- | C] () -- C:\Users\DAVID\Desktop\SharinganPictures.jpg [2012.08.01 22:48:00 | 000,011,189 | -HS- | C] () -- C:\Users\DAVID\Desktop\Folder.jpg [2012.08.01 22:48:00 | 000,002,348 | -HS- | C] () -- C:\Users\DAVID\Desktop\AlbumArtSmall.jpg [2012.08.01 22:44:22 | 000,000,336 | ---- | C] () -- C:\Windows\tasks\PC SpeedUp Service Deactivator.job [2012.08.01 22:42:31 | 000,001,360 | ---- | C] () -- C:\Users\DAVID\Desktop\Free YouTube to MP3 Converter.lnk [2012.08.01 21:27:58 | 000,001,251 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012.08.01 21:27:43 | 000,001,320 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012.08.01 21:27:17 | 000,001,404 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk [2012.08.01 21:26:54 | 000,002,432 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2012.08.01 20:02:35 | 000,411,572 | ---- | C] () -- C:\Windows\System32\perfh011.dat [2012.08.01 20:02:35 | 000,141,988 | ---- | C] () -- C:\Windows\System32\perfi011.dat [2012.08.01 20:02:35 | 000,124,744 | ---- | C] () -- C:\Windows\System32\perfc011.dat [2012.08.01 20:02:35 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd011.dat [2012.08.01 17:50:57 | 000,001,300 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk [2012.08.01 17:50:57 | 000,001,288 | ---- | C] () -- C:\Users\Public\Desktop\Paint.NET.lnk [2012.08.01 17:48:30 | 000,000,993 | ---- | C] () -- C:\Users\DAVID\Desktop\PhotoScape.lnk [2012.08.01 16:47:02 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.08.01 16:43:31 | 000,265,640 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2012.08.01 01:51:09 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.08.01 01:42:30 | 000,000,875 | ---- | C] () -- C:\Users\Public\Desktop\Steam.lnk [2012.08.01 01:31:05 | 000,278,561 | ---- | C] () -- C:\Users\DAVID\Desktop\Minecraft.exe [2012.08.01 01:30:50 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2012.08.01 01:25:38 | 000,001,104 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.08.01 01:25:38 | 000,001,092 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.08.01 00:02:32 | 000,001,413 | ---- | C] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.07.31 23:55:09 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2012.07.31 23:55:01 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.07.31 23:53:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.07.31 23:51:05 | 2616,745,984 | -HS- | C] () -- C:\hiberfil.sys [2012.07.04 07:27:30 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat [2012.07.04 07:27:30 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat [2012.07.04 02:32:18 | 000,159,232 | ---- | C] () -- C:\Windows\System32\clinfo.exe [2012.04.18 19:39:06 | 000,028,672 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll [2012.03.06 19:59:32 | 000,618,823 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat [2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll ========== LOP Check ========== [2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader [2012.08.22 12:56:01 | 000,000,906 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000Core.job [2012.08.29 00:56:00 | 000,000,928 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1147550278-2776106881-3068253191-1000UA.job [2012.08.27 17:53:30 | 000,000,336 | ---- | M] () -- C:\Windows\Tasks\PC SpeedUp Service Deactivator.job [2009.07.14 06:53:46 | 000,011,464 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2012.08.05 23:51:04 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\.minecraft [2012.08.01 01:31:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Adobe [2012.08.01 01:15:52 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\ATI [2012.08.04 18:20:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Babylon [2012.08.04 18:20:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\BabylonToolbar [2012.08.11 01:27:32 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Downloaded Installations [2012.08.01 22:43:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoft [2012.08.01 22:42:36 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\DVDVideoSoftIEHelpers [2012.08.01 00:02:20 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Identities [2012.08.28 14:57:48 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Kaiba Corporation [2012.08.01 01:29:23 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Macromedia [2012.08.30 01:30:29 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Malwarebytes [2009.07.14 10:56:41 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Media Center Programs [2012.08.23 18:33:48 | 000,000,000 | --SD | M] -- C:\Users\DAVID\AppData\Roaming\Microsoft [2012.08.01 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Mozilla [2012.08.22 19:54:16 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Namco [2012.08.01 22:42:55 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\OpenCandy [2012.08.12 12:49:09 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\PhotoScape [2012.08.29 16:55:21 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\Skype [2012.08.04 18:20:33 | 000,000,000 | ---D | M] -- C:\Users\DAVID\AppData\Roaming\YourFileDownloader < %APPDATA%\*.exe /s > [2012.07.18 00:53:12 | 002,682,336 | ---- | M] (Speedchecker Limited ) -- C:\Users\DAVID\AppData\Roaming\OpenCandy\FBDF2727D10F4AF39BF632C179D7C436\PCSU_SL_3.1.2.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2012.07.03 13:46:42 | 000,217,672 | ---- | M] () MD5=8A7F34F0BBD076EC3815680A7309114F -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.07.14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2012.07.04 08:21:46 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll < %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\*.* > [2012.08.28 17:46:19 | 000,001,887 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.08.01 01:12:03 | 000,000,174 | -HS- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini [2012.08.12 12:52:06 | 000,001,320 | ---- | M] () -- C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk < %APPDATA%\*AcroIEH*.* > < %APPDATA%\*.exe > < %APPDATA%\*.tmp > < End of report > habe bis jetzt mit KIS rescure disk so weit gereinigt das bis jetzt dises GVU nachricht nicht kommt aber möchte da noch sicher gehen das es 100 % weg ist Code:
ATTFilter OTL Extras logfile created on: 30.08.2012 01:38:52 - Run 1
OTL by OldTimer - Version 3.2.59.1 Folder = C:\Users\DAVID\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,41 Gb Available Physical Memory | 74,12% Memory free
6,50 Gb Paging File | 5,52 Gb Available in Paging File | 85,03% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 114,40 Gb Total Space | 79,37 Gb Free Space | 69,38% Space Free | Partition Type: NTFS
Drive D: | 37,25 Gb Total Space | 28,81 Gb Free Space | 77,35% Space Free | Partition Type: NTFS
Computer Name: DAVID-PC | User Name: DAVID | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E71EA2A-8B7F-44D8-8BF6-E786EEFF3CB0}" = rport=139 | protocol=6 | dir=out | app=system |
"{149F047B-0182-4C8A-8AD9-8D53AD19BCA5}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1E4A8126-21E7-4A66-844B-CE091F092A9C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{20BB8D70-1BA9-4493-9AE4-394DEEA109C0}" = lport=137 | protocol=17 | dir=in | app=system |
"{23CBCA6E-FFA4-4542-A31A-E7DA8A0B5E57}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{3EB90466-94D7-4C84-9E67-E2B543FC1746}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4CC42362-AEF2-48ED-96EA-AED493B2A646}" = lport=139 | protocol=6 | dir=in | app=system |
"{5C2EE4E7-237B-442C-B98B-5B350589E4A4}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{5C910D09-A4CD-4035-9970-F50D1A2DB00E}" = rport=10243 | protocol=6 | dir=out | app=system |
"{5CE22336-A521-4DF3-91C8-A818F791129E}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{5F284DA7-2A5F-4E39-9A91-BF95C2BF2C1F}" = lport=445 | protocol=6 | dir=in | app=system |
"{66F5CA14-2F22-4B1D-8672-0D42F7C2631D}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{708934F4-548F-4E86-81A8-0C073AFE2CF5}" = lport=138 | protocol=17 | dir=in | app=system |
"{8AE8E505-853A-4082-AE47-C4C9ABDC1C59}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8C856EDD-D0D7-4D5E-98E8-D8ABBAB31B92}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{965A7ECA-0D43-4506-8A81-82D99525FB2F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9F83B979-5581-49DB-9DAD-03D943C2FC1A}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{9FBE7D16-EC83-4288-82BA-60C4C3835CD2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AA09E96F-766D-406B-B1B7-F39C328043B8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AAD03F40-4B74-43C0-BE08-6B8DDD4216B2}" = lport=10243 | protocol=6 | dir=in | app=system |
"{BB3B8D84-E8EA-4E89-B688-E45737E7443D}" = rport=138 | protocol=17 | dir=out | app=system |
"{BC8DCB34-5D31-4E42-B404-D0AB2ADE3754}" = rport=137 | protocol=17 | dir=out | app=system |
"{E8DF50FD-C309-4330-9145-54B5146CCF17}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{083C5FAC-DAD1-4283-BEE4-01B85546D629}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{09334953-6130-4C33-BEF4-37522D5EC0AA}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{0D0C353A-9B05-430F-9839-68B61A895E73}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{140DB08D-7B93-4B98-8588-C4A330D7FAAB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{16E1E30C-F47B-46F4-A8C2-2FF7EABDCD8E}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe |
"{19CBCAF1-1303-4DA5-A7C5-4A2015FC722A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{23FDA6C0-70F4-4D3B-B740-9AC834057F68}" = dir=in | app=c:\users\david\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{31815D79-6899-428A-A694-DC9B66FEDC93}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{31A28E47-7B53-4FCB-8B58-033642C70CAF}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{33FE17F3-B1C8-4E55-BFC8-406300D27146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{35A514BB-8BCA-4306-8D37-EC1DFBDCF23E}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{40EC194A-03CC-4688-889A-A1D6E452C5D6}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{4E8C3A26-EB18-447F-8E75-D167E70695A7}" = protocol=17 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe |
"{50DA0AAD-A5B6-48A0-B21C-9F29D42D965B}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{6327EC05-F6A5-4025-89D6-34297766AE9E}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{67D6085B-CFF6-4313-B33F-8B650203E900}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{69056FC6-1269-4418-8261-F2C8E8408145}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{70E63EE3-766E-49CE-B22A-8D6923621658}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{873194FD-056E-4D04-90E6-3526CA2825EC}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\yourfile.exe |
"{8E048679-6F15-4AF9-A88B-06CE7ED86931}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{91F9AFE5-D8C4-473F-912A-21010047A646}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{9522901E-051E-4E00-BFB7-39CE84A7B37D}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{96005A78-1D72-4607-8466-FCA88320F194}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{AD9A553A-12A4-48B1-B56D-098970CA379C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{AF3D6BFD-86FF-4C93-8236-8D6AE06D789A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C2EEB483-43E2-47A9-B084-A534E041A589}" = protocol=6 | dir=out | app=system |
"{CC3E5C06-8655-4886-8466-3612A3A220FC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CC601D8A-1A0C-4883-9823-A690D441A357}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{D98AEB9C-BF75-4BA7-ADAF-2588CD60B15F}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{DE746130-D62E-4762-A012-49ED6CA3A2BA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E456DD15-2764-4CFB-877B-4AEF6B91F53A}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{E48F1566-C455-46C0-B827-E992826E9B30}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{E57D9A92-18EC-41A7-9D08-5DE119F0F85D}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{E6DFA811-810B-45D8-AFE4-971AE03D699D}" = protocol=6 | dir=in | app=c:\program files\yourfiledownloader\downloader.exe |
"{E6FAD79D-C4E2-44E6-8874-7913F9D1847B}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E7F5E5F2-9055-4284-AB73-992AA1797264}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ECB4EFF2-712D-498D-AFE9-7B4E1FFE1030}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{EE3B9250-94C2-43F7-B239-08C5F41BB1C4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F7430B27-4364-4527-B1A5-F31948E277B9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{6CF77EF7-EE43-4464-B337-86A4B54A8AE2}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{CAF25443-1149-46B9-A884-33C56C953AEB}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{054C5EBD-1803-9B06-A201-63A1A8A5C365}" = CCC Help Danish
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0FB8CBBF-CFBA-B7C5-6433-4F5132783C31}" = CCC Help Portuguese
"{143412FA-840C-6158-599F-2B32D0861F80}" = Catalyst Control Center Graphics Previews Common
"{16FED766-CFB4-87B1-9591-4A394E4AE673}" = ccc-utility
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1D33871D-8470-7658-9AC6-27F8C77AA3AB}" = AMD Accelerated Video Transcoding
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1F6D1DB5-82B5-41A4-85A2-0A382C142A35}_is1" = Allgemeine Runtime Files (x86)
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20EA5B84-7055-65D9-7378-59750A15C6B5}" = CCC Help Russian
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{2680C5AE-EDC8-7A73-3D41-FCE9A2F22390}" = CCC Help German
"{26A24AE4-039D-4CA4-87B4-2F83217006FF}" = Java 7 Update 6
"{2D6E3D97-1FDF-4993-AC75-72F59EC445C5}" = Windows Live Family Safety
"{2D7F5276-5B18-A31A-3C39-3F537C12D310}" = AMD Drag and Drop Transcoding
"{32E879B3-F89C-5385-78C8-4DE7730C5FA0}" = AMD VISION Engine Control Center
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.474
"{33D64034-5BC0-FF4F-6176-62ED61555CA8}" = CCC Help Thai
"{3406AF2D-25A4-F348-76C1-F2164AF6131F}" = AMD Fuel
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CFAAB58-35C8-84C9-1391-8D4373714AFE}" = CCC Help Spanish
"{449CE12D-E2C7-4B97-B19E-55D163EA9435}" = Bing Bar
"{453FDDF1-BA65-8D13-2E6F-1740190BB5C4}" = CCC Help Greek
"{4728A95D-FD9B-CEE9-9609-BB01B5F82A0B}" = CCC Help Turkish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AFC194C-FEAD-B844-92C2-D0273872ECCF}" = CCC Help Dutch
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{5308F6BF-4660-926A-B611-0CBB32F44DD0}" = CCC Help Swedish
"{56E56B8C-6B2E-F4FD-2C82-BDC128BDC894}" = AMD Catalyst Install Manager
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{69425AB7-75BF-25FC-EB4F-D2EAE9D82AA5}" = CCC Help Hungarian
"{6B00CD97-EADD-3AFC-A844-89EB4DA73461}" = Catalyst Control Center InstallProxy
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7683B745-6060-41FD-AA75-0BBB383FEAD4}" = SweetIM for Messenger 3.7
"{774C0434-9948-4DEE-A14E-69CDD316E36C}" = Internet Explorer Toolbar 4.6 by SweetPacks
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{79839E2D-82B1-6DF1-97A6-6737E4404407}" = CCC Help Japanese
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{7C2D9B2C-D78C-EC0A-2337-612FD4799750}" = CCC Help Czech
"{7CAC6A44-C3DE-4153-ACA6-7524602C789E}" = Facebook Video Calling 1.2.0.159
"{7D9C2CBE-5941-0250-2922-804D0A506ED0}" = CCC Help Polish
"{83AA2913-C123-4146-85BD-AD8F93971D39}" = BabylonObjectInstaller
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8729E65B-8C12-4A42-B1FE-E4DA7ED52855}_is1" = DirectX 9.0c Extra Files (x86)
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B57458E-1BB4-F08F-C534-8B3E3D541229}" = AMD Media Foundation Decoders
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{9057D097-0563-6FFB-CDC6-DB2B2C5D1014}" = CCC Help Italian
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{941A1864-A0D5-4EC0-933C-968F83A7D9E5}" = Dawn Of A New Era
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 4.1.7
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA387C7F-7413-9C5A-DB71-70E406A8A92E}" = CCC Help French
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B00F5097-1F34-D3EA-4FB9-8DD2FAFF66F4}" = CCC Help Finnish
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B42129AB-E528-9CB4-7C8B-3BFE648F5CD8}" = CCC Help Norwegian
"{C1A27149-1897-8509-CBFC-2C96866C8AD6}" = CCC Help Korean
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DE54DD68-6E24-9B72-467A-DFEE00E6E9A8}" = CCC Help Chinese Traditional
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9FDD18A-206A-9A43-AAE3-AB72EFFCD333}" = CCC Help Chinese Standard
"{ED524538-828E-1AD8-D0E1-E2E72C926EE0}" = CCC Help English
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F5A4F780-DF0C-444F-BA82-637CCF5C8052}" = Windows Live Family Safety
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FB697452-8CA4-46B4-98B1-165C922A2EF3}" = Update Manager for SweetPacks 1.0
"{FCFE800F-8F42-1AC9-895C-10389CB90D86}" = Catalyst Control Center Localization All
"{FDF7187F-3960-4BEC-916D-98C9A83E3A68}_is1" = DirectX for Managed Code
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"BabylonToolbar" = Babylon toolbar on IE
"CCleaner" = CCleaner
"Defraggler" = Defraggler
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.26.706
"incredibar" = Incredibar Toolbar on IE
"M928366" =
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIA Drivers" = NVIDIA Drivers
"PCSU-SL_is1" = PC Beschleunigen - Vollständige Deinstallation
"PhotoScape" = PhotoScape
"WinLiveSuite" = Windows Live Essentials
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1147550278-2776106881-3068253191-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"YourFileDownloader" = YourFileDownloader
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.08.2012 16:50:49 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x004caf42 ID des fehlerhaften Prozesses: 0x303c Startzeit der fehlerhaften Anwendung:
0x01cd823a230d3c84 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
628f035a-ee2d-11e1-93ee-001d9284e761
Error - 24.08.2012 16:51:39 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x001107f3 ID des fehlerhaften Prozesses: 0x2ac4 Startzeit der fehlerhaften Anwendung:
0x01cd823a34dcfde1 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
7fe6d839-ee2d-11e1-93ee-001d9284e761
Error - 24.08.2012 16:51:53 | Computer Name = DAVID-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: FlashPlayerPlugin_11_4_402_265.exe,
Version: 11.4.402.265, Zeitstempel: 0x502bf384 Name des fehlerhaften Moduls: NPSWF32_11_4_402_265.dll,
Version: 11.4.402.265, Zeitstempel: 0x502bf58e Ausnahmecode: 0xc0000005 Fehleroffset:
0x0005d8eb ID des fehlerhaften Prozesses: 0x2e04 Startzeit der fehlerhaften Anwendung:
0x01cd823a49b708e1 Pfad der fehlerhaften Anwendung: C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_4_402_265.exe
Pfad
des fehlerhaften Moduls: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll
Berichtskennung:
8882e018-ee2d-11e1-93ee-001d9284e761
Error - 28.08.2012 07:45:22 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:49:33 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:52:24 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 28.08.2012 07:56:30 | Computer Name = DAVID-PC | Source = MsiInstaller | ID = 1013
Description =
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7040
Description =
Error - 29.08.2012 10:51:06 | Computer Name = DAVID-PC | Source = Windows Search Service | ID = 7042
Description =
Error - 29.08.2012 19:28:35 | Computer Name = DAVID-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.59.1 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 2c4 Startzeit:
01cd863d2dffbe71 Endzeit: 16 Anwendungspfad: C:\Users\DAVID\Desktop\OTL.exe Berichts-ID:
32a28b9c-f231-11e1-b658-001d9284e761
[ System Events ]
Error - 29.08.2012 19:38:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:38:42 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:39:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:40:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:41:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:42:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "\Device\HarddiskVolume3" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:43:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:44:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:45:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
Error - 29.08.2012 19:46:15 | Computer Name = DAVID-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie auf dem Volume "D:" den Befehl "chkdsk" aus.
< End of report >
malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.08.29.10 Windows 7 x86 NTFS Internet Explorer 8.0.7600.16385 DAVID :: DAVID-PC [Administrator] Schutz: Aktiviert 30.08.2012 02:15:32 mbam-log-2012-08-30 (02-15-32).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 182237 Laufzeit: 3 Minute(n), 13 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\DAVID\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
Baum-Darstellung