| |
| |||||||
Log-Analyse und Auswertung: DVU Virus entfernt? AppData/Local/Temp/wgsdgsdgdsgsd.exe nicht gefundenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
07.09.2012, 20:30
| #1 |
 |  DVU Virus entfernt? AppData/Local/Temp/wgsdgsdgdsgsd.exe nicht gefunden Hallo zusammen, habe schon zweimal den GVU Trojaner gehabt (vor 2 Tagen und vor einigen Wochen). Da ich computermäßig Laie bin, habe ich inzwischen folgende Schutz- und Wartungsprogramme auf meinem Rechner (Windows Vista) und lasse sie regelmäßig laufen. Vielleicht behindern sie sich ja gegenseitig? Avira Antivir, Registry Booster, CCleaner, Malwarebytes Anti-Malware , Paragon Backup & Recovery™ 10 Suite (Klon des Rechners auf externer Festplatte), DriverScanner Folgende Probleme sind noch da, obwohl Antivir und Malware nichts finden (außer ein verstecktes Objekt). Ich kann keine Fotos mehr vom Rechner auf CD brennen (Totalabsturz, der nur mit Ausschalten zu „beheben“ ist) Oft reagiert der Windows Explorer nicht mehr. Nach dem Booten kommt die Anzeige: „Fehler beim Laden von C:/Users/HILLIE*1/AppData/Local/Temp/wgsdgsdgdsgsd.exe. Das angegebene Modul wurde nicht gefunden“ Avira meldet dass „Bonjour“ eine Änderung vorgenommen hat. Habe die Anleitung 1 (keine Fehlermeldung des "defogger") und 2 vorgenommen (Dateien unten) und ein Problem bei Schritt 3 gehabt: Nach Runterladen des Programms: Internetverbindung geschlossen, Avira und Windows Firewall ausgeschaltet. Start des Programmes. Auf rechter Leiste kein Haken bei Laufwerke D:/ (externe Festplatte) Auf rechter Leiste kein Haken bei „Show all“ Nach Scannerstart folgende Fehlermeldung: „1rjfzol1.exe funktioniert nicht mehr. Das Programm wird aufgrund eines Problems nicht richtig ausgeführt. Das Programm wird geschlossen und sie werden benachrichtigt, wenn eine Lösung verfügbar ist“ Schließen des Programms, Avira und Firewall wieder angeschaltet, ins Internet gegangen und hier gepostet. Was kann ich jetzt machen? Herzlichen Dank und viele Grüße von GunHill OTL.txtOTL Logfile: Code:
ATTFilter OTL logfile created on: 07.09.2012 20:17:19 - Run 1 OTL by OldTimer - Version 3.2.61.1 Folder = C:\Users\***\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,06 Gb Available Physical Memory | 53,09% Memory free 4,23 Gb Paging File | 3,09 Gb Available in Paging File | 73,10% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 445,26 Gb Total Space | 140,42 Gb Free Space | 31,54% Space Free | Partition Type: NTFS Drive D: | 20,49 Gb Total Space | 9,84 Gb Free Space | 48,04% Space Free | Partition Type: FAT32 Computer Name: ***-PC | User Name: ***| Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.07 20:16:32 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe PRC - [2012.09.01 18:01:14 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.10 12:51:16 | 000,026,016 | ---- | M] (Uniblue Systems Limited) -- C:\Programme\Uniblue\DriverScanner\dsmonitor.exe PRC - [2012.07.08 14:39:22 | 000,026,016 | ---- | M] (Uniblue Systems Limited) -- C:\Programme\Uniblue\RegistryBooster\rbmonitor.exe PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.02.23 13:30:40 | 000,059,240 | ---- | M] (Apple Inc.) -- C:\Programme\Common Files\Apple\Internet Services\ubd.exe PRC - [2011.12.02 17:22:26 | 000,188,600 | ---- | M] (Panasonic Corporation) -- C:\Programme\Common Files\Panasonic\PHOTOfunSTUDIO AutoStart\AutoStartupService.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009.03.27 16:22:08 | 000,339,968 | ---- | M] () -- C:\Programme\Plustek\OpticFilm 7600i\QuickScan.exe PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2007.07.12 16:36:10 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2007.04.06 14:07:42 | 000,439,768 | ---- | M] (Intel Corporation) -- C:\Programme\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe PRC - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe PRC - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe ========== Modules (No Company Name) ========== MOD - [2012.06.14 10:17:22 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f2691cfa7671cdc58179e56ba9227591\System.Windows.Forms.ni.dll MOD - [2012.06.14 10:17:14 | 001,592,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\18f9789aa214c657113e676b3a9015aa\System.Drawing.ni.dll MOD - [2012.05.10 07:46:53 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bd76aaaa03ddc15d1840207b5a480644\System.Configuration.ni.dll MOD - [2012.05.10 07:35:24 | 005,450,752 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d2630342a066a7cb9056d9eb6157687a\System.Xml.ni.dll MOD - [2012.05.10 07:34:09 | 007,953,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\28d633338fc8d29f8af31935ef7d001b\System.ni.dll MOD - [2012.05.10 07:33:56 | 011,492,352 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\af9c9e9d7e0523cd444f8b551baa9cbf\mscorlib.ni.dll MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.08.26 18:36:48 | 000,884,736 | ---- | M] () -- C:\Programme\Plustek\OpticFilm 7600i\ScndrvU.drv MOD - [2009.03.30 06:42:11 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009.03.27 16:22:08 | 000,339,968 | ---- | M] () -- C:\Programme\Plustek\OpticFilm 7600i\QuickScan.exe MOD - [2008.05.28 13:55:10 | 000,086,016 | ---- | M] () -- C:\Programme\Plustek\OpticFilm 7600i\plkcom32.dll MOD - [2006.10.30 16:59:34 | 000,024,576 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtProc.exe MOD - [2006.09.20 08:35:26 | 000,020,480 | ---- | M] () -- C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe MOD - [2004.04.06 18:45:46 | 000,040,960 | ---- | M] () -- C:\Programme\Plustek\OpticFilm 7600i\DetectSession.dll ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon) SRV - [2012.09.01 20:32:12 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.07.13 13:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008.01.19 09:33:39 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2007.07.12 16:36:12 | 000,354,840 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) SRV - [2007.04.13 18:14:26 | 000,036,864 | ---- | M] (Empolis GmbH) [Disabled | Stopped] -- c:\Programme\Common Files\Gnab\Service\ServiceController.exe -- (GnabService) SRV - [2007.04.06 14:10:56 | 000,223,704 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Intel\IntelDH\CCU\AlertService.exe -- (AlertService) SRV - [2007.04.06 14:10:22 | 000,272,856 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\QualityManager.exe -- (QualityManager) SRV - [2007.04.06 14:10:08 | 000,449,496 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe -- (Remote UI Service) SRV - [2007.04.06 14:08:58 | 000,158,168 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe -- (MCLServiceATL) SRV - [2007.04.06 14:08:24 | 000,039,896 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Programme\Common Files\Intel\IntelDH\bin\DHTraceController.exe -- (DHTRACE) SRV - [2007.04.06 14:08:14 | 000,059,352 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\issm.exe -- (ISSM) SRV - [2007.04.06 14:07:46 | 000,313,816 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe -- (NMSCore) SRV - [2007.04.06 14:06:48 | 000,256,472 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe -- (M1 Server) SRV - [2007.02.12 10:46:34 | 000,208,896 | ---- | M] () [Disabled | Stopped] -- C:\Programme\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe -- (DQLWinService) SRV - [2006.11.02 20:40:12 | 000,174,656 | ---- | M] () [Disabled | Stopped] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\GigasetGenericUSB.sys -- (GigasetGenericUSB) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - [2012.09.01 20:50:13 | 000,030,616 | ---- | M] (PenMount) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pmserenum.sys -- (pmserenum) DRV - [2012.09.01 20:27:58 | 000,023,608 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Smb_driver_Intel.sys -- (SmbDrvI) DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.10.12 17:07:14 | 000,395,464 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\System32\drivers\Uim_IM.sys -- (Uim_IM) DRV - [2010.10.12 17:07:12 | 000,056,208 | ---- | M] (Paragon Software Group) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hotcore3.sys -- (hotcore3) DRV - [2010.10.12 17:07:12 | 000,037,080 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\UimBus.sys -- (UimBus) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2007.10.24 17:28:23 | 000,639,224 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\sptd.sys -- (sptd) DRV - [2007.09.13 13:48:26 | 000,005,504 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntelDH.sys -- (IntelDH) DRV - [2007.06.16 14:11:00 | 007,566,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2007.04.13 13:22:56 | 000,228,224 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) DRV - [2007.04.06 14:10:40 | 000,014,808 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Programme\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys -- (TSHWMDTCP) DRV - [2007.02.18 20:34:50 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\nmsunidr.sys -- (nmsunidr) DRV - [2006.11.10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - No CLSID value found IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{180C8484-65D8-4BF0-94AA-9B397A4FFAAA}: "URL" = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie IE - HKCU\..\SearchScopes\{5CEB8E03-46DF-4DDF-A395-8BACDEF90756}: "URL" = hxxp://go.gmx.net/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\..\SearchScopes\{5F1BF55A-6F6B-4AAB-A327-0FBA647F7D9F}: "URL" = hxxp://go.web.de/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MEDA IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 IE - HKCU\..\SearchScopes\{E13FB001-1E67-4BDC-904C-1EF3A05701CE}: "URL" = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Search" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=13" FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.4.0.4 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) [2009.01.18 12:41:29 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions [2012.09.04 21:39:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\uotzmpuu.default\extensions [2009.11.19 09:12:01 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\uotzmpuu.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.12.14 10:36:50 | 000,000,000 | ---D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\uotzmpuu.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2010.12.14 10:36:49 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\uotzmpuu.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2010.01.30 02:03:24 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\uotzmpuu.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} [2010.03.28 19:24:22 | 000,000,873 | ---- | M] () -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\uotzmpuu.default\searchplugins\conduit.xml [2011.03.07 00:25:48 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.05.02 15:36:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.08.30 09:21:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.30 09:19:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.03 13:09:31 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010.11.12 19:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll O1 HOSTS File: ([2011.03.07 11:39:31 | 000,000,757 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Deaktivierungs-Add-on für Browser von Google Analytics) - {75EF13CE-B59E-41ba-8A5A-A944031BD8B4} - C:\Programme\Google\Google Analytics Opt-Out\gaoptout.dll (Google, Inc.) O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll̀ File not found O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [GnabTray] C:\Program Files\Common Files\Gnab\Service\GnabTray.exe (Empolis GmbH) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [NMSSupport] C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\w32x86\3\WrtMon.exe () O4 - HKCU..\Run: [MobileDocuments] C:\Programme\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.) O4 - HKCU..\Run: [RegistryBooster] C:\Program Files\Uniblue\RegistryBooster\launcher.exe (Uniblue Systems Limited) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowCpl = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: 6 = Regions- und Sprachoptionen O8 - Extra context menu item: Free YouTube Download - C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Hillienhoff\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Öffnen mit WordPerfect - C:\Programme\WordPerfect Office X3\Programs\WPLauncher.hta () O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A9C46A2-27DD-45C6-B998-180135A2E3AD}: NameServer = 195.50.140.182 195.50.140.114 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\***\Fotos\2011\2011.11._September_bis_November\neu_1.10.2011 024 - t-shirt.JPG O24 - Desktop BackupWallPaper: C:\Users\***\Fotos\2011\2011.11._September_bis_November\neu_1.10.2011 024 - t-shirt.JPG O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.09.07 20:16:14 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Users\Hillienhoff\Desktop\OTL.exe [2012.09.05 22:49:21 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2012.09.05 22:49:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.09.05 22:49:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2012.09.04 21:30:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Luka [2012.09.02 21:34:30 | 000,000,000 | ---D | C] -- C:\Program Files\Convar [2012.09.02 21:34:29 | 000,516,784 | R--- | C] (Xceed Software Inc (450) 442-2626 support@xceedsoft.com www.xceedsoft.com) -- C:\Windows\System32\XceedCry.dll [2012.09.02 21:34:29 | 000,217,088 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartSock.dll [2012.09.02 21:34:29 | 000,118,784 | ---- | C] (Dart Communications) -- C:\Windows\System32\DartWeb.dll [2012.09.01 20:50:13 | 000,030,616 | ---- | C] (PenMount) -- C:\Windows\System32\drivers\pmserenum.sys [2012.09.01 20:33:14 | 001,725,784 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\WavesGUILib.dll [2012.09.01 20:33:11 | 000,214,368 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFNHK.dll [2012.09.01 20:33:11 | 000,074,080 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFCOM.dll [2012.09.01 20:33:11 | 000,068,960 | ---- | C] (Synopsys, Inc.) -- C:\Windows\System32\SFAPO.dll [2012.09.01 20:33:03 | 000,359,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEP32A.dll [2012.09.01 20:33:03 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEL32A.dll [2012.09.01 20:33:02 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll [2012.09.01 20:33:02 | 000,295,768 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll [2012.09.01 20:33:02 | 000,170,840 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEED32A.dll [2012.09.01 20:33:02 | 000,064,856 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEG32A.dll [2012.09.01 20:33:01 | 007,161,696 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEP32A.dll [2012.09.01 20:33:01 | 000,351,072 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EED32A.dll [2012.09.01 20:33:01 | 000,105,824 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEL32A.dll [2012.09.01 20:33:01 | 000,091,488 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEA32A.dll [2012.09.01 20:33:01 | 000,061,792 | ---- | C] (Dolby Laboratories) -- C:\Windows\System32\R4EEG32A.dll [2012.09.01 20:33:00 | 000,350,552 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxVolumeSDAPO.dll [2012.09.01 20:32:59 | 001,185,112 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek2.dll [2012.09.01 20:32:57 | 007,783,768 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek.dll [2012.09.01 20:32:56 | 001,836,376 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll [2012.09.01 20:32:56 | 000,709,976 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPOShell.dll [2012.09.01 20:32:56 | 000,259,928 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO30.dll [2012.09.01 20:32:56 | 000,232,792 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll [2012.09.01 20:32:55 | 000,357,712 | ---- | C] (Knowles Acoustics ) -- C:\Windows\System32\KAAPORT.dll [2012.09.01 20:32:54 | 002,193,472 | ---- | C] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll [2012.09.01 20:32:54 | 001,509,480 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2SpeakerDLL.dll [2012.09.01 20:32:54 | 001,292,904 | ---- | C] (DTS) -- C:\Windows\System32\DTSS2HeadphoneDLL.dll [2012.09.01 20:32:54 | 000,631,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSSymmetryDLL.dll [2012.09.01 20:32:54 | 000,601,704 | ---- | C] (DTS) -- C:\Windows\System32\DTSVoiceClarityDLL.dll [2012.09.01 20:32:54 | 000,458,344 | ---- | C] (DTS) -- C:\Windows\System32\DTSNeoPCDLL.dll [2012.09.01 20:32:54 | 000,421,744 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PLFX32.dll [2012.09.01 20:32:54 | 000,398,192 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PGFX32.dll [2012.09.01 20:32:54 | 000,375,400 | ---- | C] (DTS) -- C:\Windows\System32\DTSLimiterDLL.dll [2012.09.01 20:32:54 | 000,335,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSU2PREC32.dll [2012.09.01 20:32:54 | 000,218,216 | ---- | C] (DTS) -- C:\Windows\System32\DTSLFXAPO.dll [2012.09.01 20:32:53 | 001,220,200 | ---- | C] (DTS) -- C:\Windows\System32\DTSBoostDLL.dll [2012.09.01 20:32:53 | 000,654,952 | ---- | C] (DTS) -- C:\Windows\System32\DTSBassEnhancementDLL.dll [2012.09.01 20:32:53 | 000,389,736 | ---- | C] (DTS) -- C:\Windows\System32\DTSGainCompensatorDLL.dll [2012.09.01 20:32:53 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPONS.dll [2012.09.01 20:32:53 | 000,218,728 | ---- | C] (DTS) -- C:\Windows\System32\DTSGFXAPO.dll [2012.09.01 20:28:58 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics [2012.09.01 20:27:58 | 000,023,608 | ---- | C] (Synaptics Incorporated) -- C:\Windows\System32\drivers\Smb_driver_Intel.sys [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.07 20:20:06 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.09.07 20:16:32 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\Hillienhoff\Desktop\OTL.exe [2012.09.07 20:15:34 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.09.07 20:15:34 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.09.07 20:15:34 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.09.07 20:15:34 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.09.07 20:09:18 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl [2012.09.07 20:09:15 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.09.07 20:09:14 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.09.07 20:09:13 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.09.07 20:09:13 | 000,000,340 | ---- | M] () -- C:\Windows\tasks\DriverScanner.job [2012.09.07 20:09:12 | 000,000,344 | ---- | M] () -- C:\Windows\tasks\RegistryBooster.job [2012.09.07 20:09:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.09.07 20:09:03 | 2145,562,624 | -HS- | M] () -- C:\hiberfil.sys [2012.09.07 20:06:17 | 000,000,020 | ---- | M] () -- C:\Users\***\defogger_reenable [2012.09.07 20:04:39 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe [2012.09.07 19:31:22 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.09.06 22:02:33 | 000,022,655 | ---- | M] () -- C:\Users\***f\Desktop\Hund.jpg [2012.09.06 19:49:33 | 001,140,654 | ---- | M] () -- C:\Users\***\Desktop\GEN10183r.pdf [2012.09.06 18:57:02 | 005,055,663 | ---- | M] () -- C:\Users\***\Desktop\booklet-GEN10183.pdf [2012.09.05 22:32:12 | 004,503,728 | ---- | M] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.09.05 22:30:16 | 000,001,740 | ---- | M] () -- C:\Users\Hillienhoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.09.04 16:56:12 | 000,001,422 | ---- | M] () -- C:\Users\***\Documents\cc_20120904_165608.reg [2012.09.03 12:48:49 | 000,509,440 | -HS- | M] () -- C:\Users\***\Desktop\ehthumbs_vista.db [2012.09.03 12:34:40 | 000,403,504 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.09.02 21:17:57 | 000,000,978 | ---- | M] () -- C:\Users\***\Documents\cc_20120902_211753.reg [2012.09.01 20:50:13 | 000,030,616 | ---- | M] (PenMount) -- C:\Windows\System32\drivers\pmserenum.sys [2012.09.01 20:33:14 | 001,725,784 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\WavesGUILib.dll [2012.09.01 20:33:12 | 000,214,368 | ---- | M] (Synopsys, Inc.) -- C:\Windows\System32\SFNHK.dll [2012.09.01 20:33:11 | 000,074,080 | ---- | M] (Synopsys, Inc.) -- C:\Windows\System32\SFCOM.dll [2012.09.01 20:33:11 | 000,068,960 | ---- | M] (Synopsys, Inc.) -- C:\Windows\System32\SFAPO.dll [2012.09.01 20:33:03 | 000,359,768 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEP32A.dll [2012.09.01 20:33:03 | 000,078,680 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEL32A.dll [2012.09.01 20:33:02 | 007,161,696 | ---- | M] (Dolby Laboratories) -- C:\Windows\System32\R4EEP32A.dll [2012.09.01 20:33:02 | 000,295,768 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DHT32.dll [2012.09.01 20:33:02 | 000,295,768 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RP3DAA32.dll [2012.09.01 20:33:02 | 000,293,889 | ---- | M] () -- C:\Windows\System32\drivers\RTAIODAT.DAT [2012.09.01 20:33:02 | 000,170,840 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEED32A.dll [2012.09.01 20:33:02 | 000,064,856 | ---- | M] (Dolby Laboratories, Inc.) -- C:\Windows\System32\RTEEG32A.dll [2012.09.01 20:33:01 | 000,351,072 | ---- | M] (Dolby Laboratories) -- C:\Windows\System32\R4EED32A.dll [2012.09.01 20:33:01 | 000,105,824 | ---- | M] (Dolby Laboratories) -- C:\Windows\System32\R4EEL32A.dll [2012.09.01 20:33:01 | 000,091,488 | ---- | M] (Dolby Laboratories) -- C:\Windows\System32\R4EEA32A.dll [2012.09.01 20:33:01 | 000,061,792 | ---- | M] (Dolby Laboratories) -- C:\Windows\System32\R4EEG32A.dll [2012.09.01 20:33:00 | 001,185,112 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek2.dll [2012.09.01 20:33:00 | 000,350,552 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxVolumeSDAPO.dll [2012.09.01 20:32:59 | 007,783,768 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioRealtek.dll [2012.09.01 20:32:57 | 001,836,376 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioEQ.dll [2012.09.01 20:32:56 | 000,709,976 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPOShell.dll [2012.09.01 20:32:56 | 000,259,928 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO30.dll [2012.09.01 20:32:56 | 000,232,792 | ---- | M] (Waves Audio Ltd.) -- C:\Windows\System32\MaxxAudioAPO20.dll [2012.09.01 20:32:55 | 000,357,712 | ---- | M] (Knowles Acoustics ) -- C:\Windows\System32\KAAPORT.dll [2012.09.01 20:32:54 | 002,193,472 | ---- | M] (Fortemedia Corporation) -- C:\Windows\System32\FMAPO.dll [2012.09.01 20:32:54 | 001,509,480 | ---- | M] (DTS) -- C:\Windows\System32\DTSS2SpeakerDLL.dll [2012.09.01 20:32:54 | 001,292,904 | ---- | M] (DTS) -- C:\Windows\System32\DTSS2HeadphoneDLL.dll [2012.09.01 20:32:54 | 000,631,400 | ---- | M] (DTS) -- C:\Windows\System32\DTSSymmetryDLL.dll [2012.09.01 20:32:54 | 000,601,704 | ---- | M] (DTS) -- C:\Windows\System32\DTSVoiceClarityDLL.dll [2012.09.01 20:32:54 | 000,458,344 | ---- | M] (DTS) -- C:\Windows\System32\DTSNeoPCDLL.dll [2012.09.01 20:32:54 | 000,421,744 | ---- | M] (DTS) -- C:\Windows\System32\DTSU2PLFX32.dll [2012.09.01 20:32:54 | 000,398,192 | ---- | M] (DTS) -- C:\Windows\System32\DTSU2PGFX32.dll [2012.09.01 20:32:54 | 000,389,736 | ---- | M] (DTS) -- C:\Windows\System32\DTSGainCompensatorDLL.dll [2012.09.01 20:32:54 | 000,375,400 | ---- | M] (DTS) -- C:\Windows\System32\DTSLimiterDLL.dll [2012.09.01 20:32:54 | 000,335,216 | ---- | M] (DTS) -- C:\Windows\System32\DTSU2PREC32.dll [2012.09.01 20:32:54 | 000,218,216 | ---- | M] (DTS) -- C:\Windows\System32\DTSLFXAPO.dll [2012.09.01 20:32:53 | 001,220,200 | ---- | M] (DTS) -- C:\Windows\System32\DTSBoostDLL.dll [2012.09.01 20:32:53 | 000,654,952 | ---- | M] (DTS) -- C:\Windows\System32\DTSBassEnhancementDLL.dll [2012.09.01 20:32:53 | 000,218,728 | ---- | M] (DTS) -- C:\Windows\System32\DTSGFXAPONS.dll [2012.09.01 20:32:53 | 000,218,728 | ---- | M] (DTS) -- C:\Windows\System32\DTSGFXAPO.dll [2012.09.01 20:29:00 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_Smb_driver_Intel_01009.Wdf [2012.09.01 20:27:58 | 000,023,608 | ---- | M] (Synaptics Incorporated) -- C:\Windows\System32\drivers\Smb_driver_Intel.sys [2012.09.01 19:55:30 | 000,000,206 | ---- | M] () -- C:\Users\***\Documents\cc_20120901_195525.reg [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.07 20:05:57 | 000,000,020 | ---- | C] () -- C:\Users\***\defogger_reenable [2012.09.07 20:04:39 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe [2012.09.06 22:15:55 | 000,022,655 | ---- | C] () -- C:\Users\***\Desktop\Hund.jpg [2012.09.06 19:49:33 | 001,140,654 | ---- | C] () -- C:\Users\***\Desktop\GEN10183r.pdf [2012.09.06 18:57:02 | 005,055,663 | ---- | C] () -- C:\Users\***\Desktop\booklet-GEN10183.pdf [2012.09.05 22:30:16 | 004,503,728 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad [2012.09.05 22:30:16 | 000,001,740 | ---- | C] () -- C:\Users\Hillienhoff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012.09.04 16:56:10 | 000,001,422 | ---- | C] () -- C:\Users\***\Documents\cc_20120904_165608.reg [2012.09.02 21:34:30 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll [2012.09.02 21:34:30 | 000,028,672 | ---- | C] () -- C:\Windows\System32\DartWeb.oca [2012.09.02 21:34:28 | 000,000,935 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Inspector smart recovery.lnk [2012.09.02 21:17:55 | 000,000,978 | ---- | C] () -- C:\Users\***\Documents\cc_20120902_211753.reg [2012.09.01 20:33:02 | 000,293,889 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT [2012.09.01 20:29:00 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_Smb_driver_Intel_01009.Wdf [2012.09.01 20:11:45 | 000,000,340 | ---- | C] () -- C:\Windows\tasks\DriverScanner.job [2012.09.01 19:55:27 | 000,000,206 | ---- | C] () -- C:\Users\***\Documents\cc_20120901_195525.reg [2012.06.23 12:02:19 | 004,503,728 | ---- | C] () -- C:\ProgramData\loc_pyt_0_kroj.pad [2012.05.14 14:46:34 | 000,184,829 | ---- | C] () -- C:\Users\***\Unterschrift_Familie0001.JPG [2012.05.08 17:16:53 | 002,256,544 | ---- | C] () -- C:\Users\***\***_Weihnachten.JPG [2012.05.03 22:31:09 | 001,490,999 | ---- | C] () -- C:\Windows\System32\tkbtnpn1.dll [2011.12.20 15:58:57 | 000,000,680 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat [2011.09.17 15:40:17 | 000,020,531 | -H-- | C] () -- C:\ProgramData\W77X4 [2011.09.17 14:26:55 | 000,000,134 | ---- | C] () -- C:\Windows\A28U.INI [2011.09.17 14:23:02 | 000,001,807 | ---- | C] () -- C:\Windows\if42le.ini [2011.09.17 14:23:02 | 000,000,299 | ---- | C] () -- C:\Windows\Pexplore.ini [2011.09.17 14:19:04 | 000,015,360 | ---- | C] () -- C:\Windows\System32\GetInst32.dll [2011.07.05 09:13:22 | 000,145,059 | ---- | C] () -- C:\Users\***\Unterschrift_Familie.JPG [2010.09.15 09:02:30 | 000,083,412 | -H-- | C] () -- C:\Users\***\ZbThumbnail.info [2010.01.21 23:33:33 | 001,192,585 | ---- | C] () -- C:\Users\***\Pipi.PDF [2009.04.07 10:45:25 | 000,074,131 | ---- | C] () -- C:\Users\***\Betriebstagebuch KKA.PDF [2009.04.03 13:25:23 | 000,496,799 | ---- | C] () -- C:\Users\***\Familie Unterschrift.JPG [2009.04.01 16:14:19 | 012,773,473 | ---- | C] () -- C:\Users\***\Sibelius Hilfe.pdf [2008.11.29 18:51:31 | 000,933,993 | ---- | C] () -- C:\Users\***\Wartungbericht KKA.PDF [2008.10.27 18:05:49 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.05.03 23:43:30 | 007,038,688 | ---- | C] () -- C:\Users\***\Gärtnergeburtstag 1200 dpi.TIF [2008.05.03 23:38:23 | 000,156,844 | ---- | C] () -- C:\Users\***\Foto Gärtnergeburtstag.JPG [2008.03.01 15:26:36 | 000,002,608 | ---- | C] () -- C:\Users\***\AppData\Roaming\mdb.bin [2007.12.17 09:01:48 | 000,191,135 | ---- | C] () -- C:\Users\***\Wertbestätigung Hillienhoff.pdf [2007.12.17 08:44:39 | 000,129,771 | ---- | C] () -- C:\Users\***\Kto-Auszug Gehörschutz .pdf [2007.10.11 17:25:31 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html [2007.10.11 14:54:53 | 000,031,007 | ---- | C] () -- C:\Users\***\AppData\Roaming\UserTile.png [2007.10.11 14:16:32 | 000,034,304 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007.10.10 13:21:19 | 000,763,215 | ---- | C] () -- C:\Users\***\Unterschrift alle 5.TIF [2007.10.10 13:21:17 | 000,217,088 | ---- | C] () -- C:\Users\***\Carcassonne der Fluss.pdf [2007.10.02 21:28:11 | 000,000,099 | ---- | C] () -- C:\Users\Hillienhoff\AppData\Local\fusioncache.dat ========== LOP Check ========== [2011.12.20 15:59:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\1&1 Mail & Media GmbH [2007.10.10 14:30:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AAV [2010.01.29 00:49:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon [2012.09.05 08:01:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canon [2010.01.15 20:40:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\capella-software [2007.12.18 15:44:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CD-LabelPrint [2011.07.02 23:30:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DeepBurner [2010.12.14 10:36:30 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft [2010.12.14 10:36:48 | 000,000,000 | ---D | M] -- C:\Users\Hillienhoff\AppData\Roaming\DVDVideoSoftIEHelpers [2009.11.29 23:56:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Haufe [2012.07.22 08:19:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Lasersoft Imaging [2007.11.12 16:57:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Neuratron [2011.09.17 18:07:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\NewSoft [2011.12.05 20:51:59 | 000,000,000 | ---D | M] -- C:\Users\Hillienhoff\AppData\Roaming\SaalDesignSoftware [2011.01.06 20:16:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Tobit [2012.09.01 20:11:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Uniblue [2012.09.07 20:09:13 | 000,000,340 | ---- | M] () -- C:\Windows\Tasks\DriverScanner.job [2012.09.07 20:09:12 | 000,000,344 | ---- | M] () -- C:\Windows\Tasks\RegistryBooster.job [2012.09.07 20:07:25 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Geändert von GunHill (07.09.2012 um 20:44 Uhr) Grund: Namen ediert |
| Themen zu DVU Virus entfernt? AppData/Local/Temp/wgsdgsdgdsgsd.exe nicht gefunden |
| adobe, antivir, autorun, avg, betriebs, bho, booten, conduit, converter, das angegebene modul wurde nicht gefunden, defender, dvu virus, fehlermeldung, festplatte, firefox, flash player, format, google analytics, logfile, mp3, origin, plug-in, registry, registry booster, senden, server, software, trojan.agent.vgenx, trojaner, virus, vista, windows |
Baum-Darstellung