| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Chatzum -> lässt sich nicht entfernen!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
21.09.2012, 22:17
| #1 |
| |  Chatzum -> lässt sich nicht entfernen! Hallo. Ich habe das Problem, dass jedes mal wenn ich ein neues Tab (Firefox) öffne sich chatzum einschaltet. Ich werde direkt dorthin geleitet. Ich habe bereits IE u. Firefox komplett deinstalliert und anschließend neu installiert, in der Hoffnung die Toolbar damit los zu sein. Leider ist dem nicht so und sie erscheint nachwievor. Dazu kommt, dass seit dem auch ständig Virenfunde angezeigt werden. Evtl. ist dies ein bekanntes Problem und ihr könnt mir Tipps geben, wie ich diese Toolbar(?) wieder loswerde. Dazu mal der OTL Bericht: OTL logfile created on: 21.09.2012 22:34:56 - Run 1 OTL by OldTimer - Version 3.2.65.1 Folder = C:\Programme Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1014,36 Mb Total Physical Memory | 409,41 Mb Available Physical Memory | 40,36% Memory free 2,39 Gb Paging File | 1,72 Gb Available in Paging File | 71,97% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 71,04 Gb Total Space | 52,34 Gb Free Space | 73,67% Space Free | Partition Type: NTFS Drive D: | 72,00 Gb Total Space | 27,27 Gb Free Space | 37,88% Space Free | Partition Type: NTFS Computer Name: JBNETBOOK | User Name: Saleskonzept | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.09.21 22:29:13 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Programme\OTL.exe PRC - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.07 17:04:44 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.09.06 07:04:44 | 000,161,768 | ---- | M] (Oracle Corporation) -- C:\Programme\Java\jre7\bin\jqs.exe PRC - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.08.01 09:15:58 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.03 09:04:54 | 000,252,848 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe PRC - [2012.06.20 13:18:08 | 001,568,976 | ---- | M] (Ask) -- C:\Programme\Ask.com\Updater\Updater.exe PRC - [2012.05.24 13:28:56 | 000,055,184 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2012.05.02 00:55:21 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.27 13:41:02 | 001,073,744 | ---- | M] (Iminent) -- C:\Programme\Iminent\Iminent.exe PRC - [2012.04.27 13:41:02 | 000,884,816 | ---- | M] (Iminent) -- C:\Programme\Iminent\Iminent.Messengers.exe PRC - [2012.04.24 02:11:55 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2012.03.30 04:18:51 | 003,537,920 | ---- | M] (sw4you, Siegfried Weckmann) -- C:\Programme\Hardcopy\hardcopy.exe PRC - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\StumbleUpon\IE\StumbleUponUpdater.exe PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe PRC - [2011.06.17 19:33:04 | 000,272,528 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\3.0.207\SSScheduler.exe PRC - [2009.03.23 18:41:06 | 000,603,488 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2008.10.20 10:32:54 | 002,768,896 | ---- | M] () -- C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe PRC - [2008.10.06 18:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2008.05.21 16:44:30 | 000,299,008 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\PerformanceManager.exe PRC - [2008.05.20 20:02:08 | 000,372,736 | ---- | M] (SAMSUNG Electronics Co., Ltd.) -- C:\Programme\Samsung\MagicKBD\MagicKBD.exe PRC - [2008.04.14 14:00:00 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007.12.20 20:40:30 | 000,659,456 | ---- | M] (Samsung Electronics,.LTD) -- C:\Programme\Samsung\Samsung EDS\EDSAgent.exe PRC - [2004.02.13 08:37:00 | 000,094,208 | ---- | M] (Jetsoft Development Company) -- C:\Programme\Lexmark 2200 Series\lxbvbmon.exe PRC - [2004.02.13 08:15:00 | 000,057,344 | ---- | M] (Lexmark International, Inc.) -- C:\Programme\Lexmark 2200 Series\lxbvbmgr.exe ========== Modules (No Company Name) ========== MOD - [2012.07.27 22:51:38 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU MOD - [2012.06.15 06:10:46 | 000,253,952 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\9d59cf7eb15733ca09736eaaa2acaef6\WindowsFormsIntegration.ni.dll MOD - [2012.06.14 23:21:51 | 000,148,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuratio#\909306caa69b55ffdce3ae5a7f6baa20\System.Configuration.Install.ni.dll MOD - [2012.06.14 22:20:08 | 013,197,824 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\54d61af44b1dedee6aea0d1bbc46b13a\System.Windows.Forms.ni.dll MOD - [2012.06.14 22:13:50 | 017,998,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\5d585d5428ce69abc28238ffa9f4d3a2\PresentationFramework.ni.dll MOD - [2012.06.14 22:12:47 | 011,451,904 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationCore\fe068ba4be8f6cb7d6a58bccff05c75e\PresentationCore.ni.dll MOD - [2012.06.14 22:11:51 | 003,856,896 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\WindowsBase\62f103f9e662d263ec2ecacc49d4525b\WindowsBase.ni.dll MOD - [2012.06.14 22:11:43 | 001,666,048 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Drawing\4a668799513e369a54fdab8b3f74de92\System.Drawing.ni.dll MOD - [2012.06.01 22:26:14 | 001,859,584 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Web.Services\1126dc2c152098ec23d4554405217184\System.Web.Services.ni.dll MOD - [2012.06.01 22:25:51 | 017,996,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\5be1370b1331393f73af710d0d71b02d\System.ServiceModel.ni.dll MOD - [2012.06.01 22:24:42 | 001,072,128 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\a90d8ca6c54f70507704d788fd0d3ded\System.IdentityModel.ni.dll MOD - [2012.06.01 22:20:13 | 000,786,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\26ee061618887d629a9f7072970ffb85\System.EnterpriseServices.ni.dll MOD - [2012.06.01 22:20:13 | 000,236,032 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.EnterpriseSe#\26ee061618887d629a9f7072970ffb85\System.EnterpriseServices.Wrapper.dll MOD - [2012.06.01 22:20:11 | 000,646,656 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Transactions\ce2aa3a5e89c326055ac8e2a309232f7\System.Transactions.ni.dll MOD - [2012.06.01 22:20:09 | 001,020,928 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\a40c42510e312339018486b1d7076e0a\System.Runtime.DurableInstancing.ni.dll MOD - [2012.06.01 22:20:06 | 002,637,312 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\9bfda0add366eea12ea0402e60d01e84\System.Runtime.Serialization.ni.dll MOD - [2012.06.01 22:20:06 | 000,142,848 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\9115e9f656b00fc4e46da91537ef1358\SMDiagnostics.ni.dll MOD - [2012.06.01 22:19:57 | 001,781,760 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xaml\9b6f1bcb2cf4e6ad429cd721b942f30f\System.Xaml.ni.dll MOD - [2012.06.01 22:15:21 | 000,755,712 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\190e1740c9b998105a47ec31df0b6f11\PresentationFramework.Luna.ni.dll MOD - [2012.06.01 22:09:48 | 006,798,336 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Data\9f5111b0b58258c3a4bbcfb8bf27374c\System.Data.ni.dll MOD - [2012.06.01 22:09:11 | 007,052,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\14ba6251d6ec84c9579ed3d3e10b30c1\System.Core.ni.dll MOD - [2012.06.01 22:09:01 | 005,618,176 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\5ee8bf77e7b3e25cdbff6e1c299574fe\System.Xml.ni.dll MOD - [2012.06.01 22:08:44 | 000,980,480 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\0c8e950df17a0abec10888e8ad966cbe\System.Configuration.ni.dll MOD - [2012.06.01 22:08:40 | 009,090,560 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\6f399163bb35597da7141ccdb7f39d16\System.ni.dll MOD - [2012.06.01 22:08:19 | 014,412,800 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll MOD - [2012.04.16 23:11:02 | 000,398,288 | ---- | M] () -- C:\Programme\Avira\AntiVir Desktop\sqlite3.dll MOD - [2012.03.21 14:10:22 | 002,941,440 | ---- | M] () -- C:\Programme\Hardcopy\HcDllS.dll MOD - [2012.03.09 09:46:20 | 000,110,080 | ---- | M] () -- C:\Programme\Hardcopy\HcDLL2_36_Win32.dll MOD - [2012.01.07 10:54:16 | 000,047,616 | ---- | M] () -- C:\Programme\Hardcopy\hardcopy_04.dll MOD - [2011.12.29 20:00:00 | 003,472,384 | ---- | M] () -- C:\Programme\FreeTime\FormatFactory\FFModules\Filters\ffdshow\ffdshow.ax MOD - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\StumbleUpon\IE\StumbleUponUpdater.exe MOD - [2011.11.02 00:26:32 | 000,087,912 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll MOD - [2011.11.02 00:26:12 | 001,242,472 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\libxml2.dll MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdateCheck.dll MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Programme\DivX\DivX Update\DivXUpdate.exe MOD - [2009.08.16 18:06:02 | 000,141,312 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2009.03.23 18:40:06 | 002,854,976 | ---- | M] () -- C:\WINDOWS\system32\btwicons.dll MOD - [2008.10.20 10:32:54 | 002,768,896 | ---- | M] () -- C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe MOD - [2008.04.14 14:00:00 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll MOD - [2006.08.12 12:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll MOD - [2005.07.12 16:34:22 | 000,045,056 | ---- | M] () -- C:\Programme\Samsung\MagicKBD\EasyBoxDll.dll MOD - [2003.12.05 09:42:00 | 000,078,336 | ---- | M] () -- C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBVPP5C.DLL ========== Services (SafeList) ========== SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2012.09.09 13:55:10 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.09.07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.09.06 07:04:44 | 000,161,768 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Programme\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2012.09.06 03:25:06 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.08.13 13:33:30 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.24 13:28:56 | 000,055,184 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.05.02 00:55:21 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.11.22 10:59:30 | 000,018,432 | ---- | M] () [Auto | Running] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\StumbleUpon\IE\StumbleUponUpdater.exe -- (StumbleUponUpdater) SRV - [2011.06.17 19:33:04 | 000,237,008 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\3.0.207\McCHSvc.exe -- (McComponentHostService) SRV - [2009.04.21 10:09:00 | 000,282,624 | ---- | M] (Marvell) [Auto | Running] -- C:\WINDOWS\system32\yk51x86.dll -- (yksvc) SRV - [2008.05.13 08:44:00 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus) SRV - [2006.10.26 20:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2006.10.26 15:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\vsdatant.sys -- (vsdatant) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\usbaapl.sys -- (USBAAPL) DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\RimUsb.sys -- (RimUsb) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbdev.sys -- (hwusbdev) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ewusbmdm.sys -- (hwdatacard) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOKUME~1\SALESK~1\LOKALE~1\Temp\__Samsung_Update\ADDMEM.SYS -- (ADDMEM) DRV - [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012.04.27 10:20:04 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2012.04.25 00:32:27 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012.04.16 21:17:40 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr) DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.21 10:09:00 | 000,297,344 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2009.03.19 14:19:54 | 000,991,136 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2009.02.18 10:46:56 | 000,534,312 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btaudio.sys -- (btaudio) DRV - [2008.10.30 22:19:14 | 000,047,272 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2008.10.08 08:35:10 | 001,334,432 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416) DRV - [2008.09.23 22:23:58 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMC326.sys -- (VMC326) DRV - [2008.08.27 01:35:00 | 004,753,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2008.07.24 10:37:10 | 000,156,816 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btwdndis.sys -- (BTWDNDIS) DRV - [2008.02.04 10:57:44 | 000,037,160 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver) DRV - [2008.01.14 19:01:02 | 000,030,208 | ---- | M] (Samsung Electronics,.LTD) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SamsungEDS.SYS -- (DNSeFilter) DRV - [2007.11.14 04:08:38 | 000,100,992 | ---- | M] (AnyDATA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\adusbser.sys -- (adusbser) DRV - [2006.08.01 15:57:24 | 000,019,840 | ---- | M] (Samsung) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SUE_PD.sys -- (SUEPD) DRV - [2005.10.27 06:18:05 | 000,004,300 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\MEMIO.SYS -- (DOSMEMIO) DRV - [2005.05.17 05:51:34 | 000,005,315 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\URLSearchHook: - No CLSID value found IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Programme\ChatZum Toolbar\tbunsm1A4.tmp\tbhelper.dll () IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes,DefaultScope = {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.chatzum.com/?q={searchTerms} IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=sm IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_de IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = hxxp://search.chatzum.com/?q={SearchTerms} IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\SearchScopes\{B4E6A681-86CE-4F5A-93BB-019AF4CAA276}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=crm&q={searchTerms}&locale=&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=32a88f41-2220-4092-9072-5ca2d1475ba9&apn_sauid=DA935202-53B5-4720-9D77-276A67803076 IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "https://www.google.de/" FF - prefs.js..extensions.enabledAddons: de-DE@dictionaries.addons.mozilla.org:2.0.2 FF - prefs.js..extensions.enabledAddons: en-GB@dictionaries.addons.mozilla.org:1.19.1 FF - prefs.js..extensions.enabledAddons: fr-moderne@dictionaries.addons.mozilla.org:4.3 FF - prefs.js..extensions.enabledAddons: stealthyextension@gmail.com:2.3.3 FF - prefs.js..extensions.enabledAddons: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.2.145 FF - prefs.js..extensions.enabledAddons: {8AA36F4F-6DC7-4c06-77AF-5035170634FE}:2012.02.14 FF - prefs.js..keyword.URL: "hxxp://utils.chatzum.com/?url=" FF - prefs.js..network.proxy.http: "188.143.232.239" FF - prefs.js..network.proxy.http_port: 85 FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_265.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Programme\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.28 00:28:37 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\webbooster@iminent.com: C:\Programme\Iminent\webbooster@iminent.com [2012.05.30 18:36:35 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Swiss Academic Software\Citavi Picker\Firefox [2012.09.02 19:41:14 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.09.17 16:19:56 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.09.17 15:59:12 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Extensions [2012.09.17 15:41:06 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions [2011.04.28 20:04:24 | 000,000,000 | ---D | M] (German Dictionary) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\de-DE@dictionaries.addons.mozilla.org [2011.04.28 20:04:24 | 000,000,000 | ---D | M] (British English Dictionary) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\en-GB@dictionaries.addons.mozilla.org [2011.10.07 21:46:48 | 000,000,000 | ---D | M] (Dictionnaire français «Moderne») -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\fr-moderne@dictionaries.addons.mozilla.org [2012.07.03 17:42:47 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus Web Protection") -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\toolbar@ask.com [2012.07.27 10:52:45 | 000,184,864 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\stealthyextension@gmail.com.xpi [2012.07.25 21:44:35 | 000,741,958 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.09.20 14:22:00 | 000,001,655 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\searchplugins\ixquick-https---deutsch.xml [2012.09.17 16:19:56 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.09.02 19:41:14 | 000,000,000 | ---D | M] (Citavi Picker) -- C:\DOKUMENTE UND EINSTELLUNGEN\ALL USERS\ANWENDUNGSDATEN\SWISS ACADEMIC SOFTWARE\CITAVI PICKER\FIREFOX [2011.12.28 00:28:37 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>  -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5[2010.01.24 15:41:10 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2012.09.06 03:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2012.09.06 04:07:37 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.09.06 04:07:37 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2012.09.06 04:07:37 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2012.09.06 04:07:37 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2012.09.06 04:07:37 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2012.09.06 04:07:37 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms} CHR - homepage: hxxp://www.google.com/ CHR - plugin: Shockwave Flash (Enabled) = C:\Programme\Google\Chrome\Application\12.0.742.112\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Programme\QuickTime\plugins\npqtplugin7.dll CHR - plugin: Java Deployment Toolkit 6.0.240.7 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npdeployJava1.dll CHR - plugin: Java(TM) Platform SE 6 U24 (Enabled) = C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Programme\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll CHR - plugin: DivX Web Player (Enabled) = C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Programme\Windows Media Player\npdsplay.dll CHR - plugin: Chrome NaCl (Disabled) = C:\Programme\Google\Chrome\Application\12.0.742.112\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Programme\Google\Chrome\Application\12.0.742.112\pdf.dll CHR - plugin: Skype Toolbars (Enabled) = C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\npSkypeChromePlugin.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npdrmv2.dll CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Programme\Windows Media Player\npwmsdrm.dll CHR - plugin: DivX Player Netscape Plugin (Enabled) = C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll CHR - plugin: Google Update (Enabled) = C:\Programme\Google\Update\1.3.21.57\npGoogleUpdate3.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Programme\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Clouds Theme (Aero) = C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\bcciaadkjghlekmecfilhfakgmmgheei\1.1_1\ CHR - Extension: Microsoft\u00AE DRM = C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.3.0.7550_0\ O1 HOSTS File: ([2008.04.14 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Programme\Iminent\Iminent.WebBooster.InternetExplorer.dll (Iminent) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (StumbleUpon) - {DB616CFF-D989-48A8-9C85-E2A8D56AB2CA} - C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\StumbleUpon\IE\StumbleUpon.dll (StumbleUpon Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (TBSB09850 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Programme\ChatZum Toolbar\tbunsm1A4.tmp\tbcore3.dll () O3 - HKLM\..\Toolbar: (no name) - !{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [ApnUpdater] C:\Programme\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [APSDaemon] C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe () O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [DMHotKey] C:\Programme\Samsung\Easy Display Manager\DMLoader.exe (SAMSUNG Electronics) O4 - HKLM..\Run: [EDS] C:\Programme\Samsung\Samsung EDS\EDSAgent.exe (Samsung Electronics,.LTD) O4 - HKLM..\Run: [Iminent] C:\Programme\Iminent\Iminent.exe (Iminent) O4 - HKLM..\Run: [IminentMessenger] C:\Programme\Iminent\Iminent.Messengers.exe (Iminent) O4 - HKLM..\Run: [Lexmark 2200 Series] C:\Programme\Lexmark 2200 Series\lxbvbmgr.exe (Lexmark International, Inc.) O4 - HKLM..\Run: [MagicKeyboard] C:\Programme\Samsung\MagicKBD\PreMKbd.exe () O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005..\Run: [Jing] C:\Programme\TechSmith\Jing\Jing.exe (TechSmith Corporation) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Hardcopy.LNK = C:\Programme\Hardcopy\hardcopy.exe (sw4you, Siegfried Weckmann) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\3.0.207\SSScheduler.exe (McAfee, Inc.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\phase-6 Reminder.lnk = C:\Programme\phase-6\phase-6\reminder\reminder.exe (phase-6) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: &Citavi Picker... - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html () O8 - Extra context menu item: Free YouTube Download - C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\DVDVideoSoftIEHelpers\freeytvdownloader.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Senden an Bluetooth - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre6\bin\npjpi160_31.dll (Sun Microsystems, Inc.) O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Programme\ICQ7.6\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Programme\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O15 - HKU\S-1-5-21-3187671637-2011817049-1224485136-1005\..Trusted Domains: microsoft.com ([www.update] https in Trusted sites) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1341311178750 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Value error.) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0924BAFE-73B9-40ED-B834-CBF0C0D62878}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0924BAFE-73B9-40ED-B834-CBF0C0D62878}: NameServer = 212.63.64.1,212.63.65.2 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{676596EC-C04B-4CBD-862C-2B8623D70C7B}: NameServer = 212.63.64.1,212.63.65.2 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.18 16:53:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{01aa5a74-99ba-11df-ada7-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{01aa5a74-99ba-11df-ada7-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{01aa5a74-99ba-11df-ada7-0024540d1554}\Shell\AutoRun\command - "" = E:\Launcher.exe O33 - MountPoints2\{0d3d0e62-ef11-11de-acef-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{0d3d0e62-ef11-11de-acef-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{0d3d0e62-ef11-11de-acef-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{10eb4b60-6c64-11e0-adeb-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{10eb4b60-6c64-11e0-adeb-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{10eb4b60-6c64-11e0-adeb-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{569d1912-e742-11de-ace5-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{569d1912-e742-11de-ace5-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{569d1912-e742-11de-ace5-0024540d1554}\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\{6ea17c2c-ef13-11de-acf0-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{6ea17c2c-ef13-11de-acf0-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6ea17c2c-ef13-11de-acf0-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6ea17c2d-ef13-11de-acf0-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{6ea17c2d-ef13-11de-acf0-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6ea17c2d-ef13-11de-acf0-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6ea17c2e-ef13-11de-acf0-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{6ea17c2e-ef13-11de-acf0-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6ea17c2e-ef13-11de-acf0-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6ea17c31-ef13-11de-acf0-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{6ea17c31-ef13-11de-acf0-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6ea17c31-ef13-11de-acf0-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{6ea17c32-ef13-11de-acf0-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{6ea17c32-ef13-11de-acf0-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{6ea17c32-ef13-11de-acf0-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{839ed94e-6136-11e0-adde-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{839ed94e-6136-11e0-adde-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{839ed94e-6136-11e0-adde-0024540d1554}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{839ed952-6136-11e0-adde-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{839ed952-6136-11e0-adde-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{839ed952-6136-11e0-adde-0024540d1554}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{8894c600-f12c-11de-acf4-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{8894c600-f12c-11de-acf4-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8894c600-f12c-11de-acf4-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{8894c601-f12c-11de-acf4-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{8894c601-f12c-11de-acf4-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{8894c601-f12c-11de-acf4-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O33 - MountPoints2\{c49d8478-9a39-11df-ada9-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{c49d8478-9a39-11df-ada9-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c49d8478-9a39-11df-ada9-0024540d1554}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{c49d8479-9a39-11df-ada9-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{c49d8479-9a39-11df-ada9-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c49d8479-9a39-11df-ada9-0024540d1554}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{f03787de-e7db-11de-ace7-0024540d1554}\Shell - "" = AutoRun O33 - MountPoints2\{f03787de-e7db-11de-ace7-0024540d1554}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{f03787de-e7db-11de-ace7-0024540d1554}\Shell\AutoRun\command - "" = E:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2012.09.21 22:29:12 | 000,600,576 | ---- | C] (OldTimer Tools) -- C:\Programme\OTL.exe [2012.09.21 17:50:13 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Malwarebytes [2012.09.21 17:48:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Malwarebytes' Anti-Malware [2012.09.21 17:48:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2012.09.21 17:48:29 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.09.21 17:48:26 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2012.09.21 17:45:55 | 010,524,080 | ---- | C] (Malwarebytes Corporation ) -- C:\Programme\mbam-setup-1.65.0.1400.exe [2012.09.19 17:16:37 | 000,000,000 | ---D | C] -- C:\Programme\SpottyFiles [2012.09.19 17:16:37 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\SpottyFiles [2012.09.18 22:13:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8 [2012.09.17 16:19:58 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Maintenance Service [2012.09.17 16:19:54 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox [2012.09.14 10:39:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Toolbar4 [2012.09.14 10:39:36 | 000,000,000 | ---D | C] -- C:\Programme\ChatZum Toolbar [2012.09.14 10:30:53 | 000,000,000 | ---D | C] -- C:\Programme\DropBox [2012.09.06 07:10:07 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\Java [2012.09.06 07:05:18 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe [2012.09.06 07:05:06 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe [2012.09.06 07:05:06 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe [2012.09.06 07:05:06 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll [2012.09.02 19:44:35 | 000,000,000 | ---D | C] -- D:\Citavi 3 [2012.09.02 19:44:34 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Swiss Academic Software [2012.09.02 19:41:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Citavi 3 [2012.09.02 19:40:17 | 000,000,000 | ---D | C] -- C:\Programme\Citavi 3 [2012.09.02 19:33:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Saleskonzept\Application Data [2012.09.02 19:31:33 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Swiss Academic Software [2012.09.02 19:27:39 | 000,000,000 | ---D | C] -- C:\Programme\Citavi [2012.07.18 17:10:20 | 000,347,424 | ---- | C] (Microsoft Corporation) -- C:\Programme\MicrosoftFixit.wu.RNP.34266052020403068.10.1.Run.exe [2012.07.18 16:30:19 | 000,347,424 | ---- | C] (Microsoft Corporation) -- C:\Programme\MicrosoftFixit.wu.LB.34266052020403068.2.1.Run.exe [2012.07.18 16:18:42 | 004,054,000 | ---- | C] (LionSea Software ) -- C:\Programme\setup.exe [2012.06.17 11:47:22 | 000,781,864 | ---- | C] (Microsoft Corporation) -- C:\Programme\WindowsXP-KB932716-v2-x86-DEU.exe [2012.06.17 10:34:09 | 070,266,936 | ---- | C] (DVDVideoSoft Ltd. ) -- C:\Programme\FreeStudio.exe [2012.06.04 20:51:00 | 000,301,632 | ---- | C] (Softonic) -- C:\Programme\SoftonicDownloader_fuer_audacity.exe [2012.05.30 21:36:16 | 017,036,288 | ---- | C] (EffectMatrix, Inc. ) -- C:\Programme\empc_setup.exe [2012.05.30 19:31:03 | 000,301,624 | ---- | C] (Softonic) -- C:\Programme\SoftonicDownloader_fuer_gimp.exe [2012.05.30 18:17:38 | 000,301,640 | ---- | C] (Softonic) -- C:\Programme\SoftonicDownloader_fuer_photoscape.exe [2012.03.07 14:32:34 | 004,456,392 | ---- | C] (Microsoft Corporation) -- C:\Programme\OdfAddInForOfficeSetup-en_4.0.5309.exe [2011.04.13 11:12:36 | 020,062,688 | ---- | C] (MEDIA FOG LTD ) -- C:\Programme\DriverUpdaterSetup-1.2.3.2267_multilang.exe [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.09.21 22:56:01 | 000,000,240 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2012.09.21 22:55:01 | 000,001,102 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2012.09.21 22:32:17 | 000,000,480 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Desktop\Verknüpfung mit OTL.exe.lnk [2012.09.21 22:29:13 | 000,600,576 | ---- | M] (OldTimer Tools) -- C:\Programme\OTL.exe [2012.09.21 22:16:51 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2012.09.21 22:16:47 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\SpottyFiles Update.job [2012.09.21 22:05:00 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012.09.21 22:04:57 | 1063,702,528 | -HS- | M] () -- C:\hiberfil.sys [2012.09.21 22:00:16 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2012.09.21 17:46:00 | 010,524,080 | ---- | M] (Malwarebytes Corporation ) -- C:\Programme\mbam-setup-1.65.0.1400.exe [2012.09.19 09:23:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2012.09.18 18:38:22 | 000,053,248 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.09.17 16:19:59 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk [2012.09.15 14:05:06 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2012.09.13 01:02:34 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012.09.09 13:55:10 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2012.09.09 13:55:10 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2012.09.06 07:04:45 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\WindowsAccessBridge.dll [2012.09.06 07:04:43 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\npDeployJava1.dll [2012.09.06 07:04:43 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\deployJava1.dll [2012.09.06 07:04:43 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaws.exe [2012.09.06 07:04:43 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javaw.exe [2012.09.06 07:04:43 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\java.exe [2012.09.06 07:04:43 | 000,143,872 | ---- | M] (Oracle Corporation) -- C:\WINDOWS\System32\javacpl.cpl [2012.09.02 19:41:17 | 000,001,660 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citavi 3.lnk [2012.08.28 20:35:48 | 011,111,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll [2012.08.28 17:05:49 | 001,212,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll [2012.08.28 17:05:49 | 000,916,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll [2012.08.28 17:05:49 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll [2012.08.28 17:05:49 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll [2012.08.28 17:05:49 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll [2012.08.28 17:05:48 | 006,008,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll [2012.08.28 17:05:48 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl [2012.08.28 17:05:48 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl [2012.08.28 17:05:48 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll [2012.08.28 17:05:48 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll [2012.08.28 17:05:48 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll [2012.08.28 17:05:48 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll [2012.08.28 17:05:48 | 000,521,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll [2012.08.28 17:05:48 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll [2012.08.28 17:05:48 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll [2012.08.28 17:05:48 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll [2012.08.28 17:05:48 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll [2012.08.28 17:05:48 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll [2012.08.28 17:05:48 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll [2012.08.28 17:05:48 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll [2012.08.28 17:05:47 | 002,000,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll [2012.08.28 17:05:47 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll [2012.08.28 17:05:47 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll [2012.08.28 17:05:46 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll [2012.08.28 17:05:46 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll [2012.08.28 17:05:46 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll [2012.08.28 14:07:34 | 000,174,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe [2012.08.28 14:07:34 | 000,174,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe [2012.08.28 14:07:15 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.09.21 22:32:17 | 000,000,480 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\Desktop\Verknüpfung mit OTL.exe.lnk [2012.09.19 17:16:38 | 000,000,286 | ---- | C] () -- C:\WINDOWS\tasks\SpottyFiles Update.job [2012.09.18 23:54:44 | 000,000,783 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\Startmenü\Programme\Internet Explorer.lnk [2012.09.17 16:19:59 | 000,000,702 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Mozilla Firefox.lnk [2012.09.17 16:19:59 | 000,000,696 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Mozilla Firefox.lnk [2012.09.02 19:41:17 | 000,001,660 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citavi 3.lnk [2012.07.18 17:15:30 | 000,717,733 | ---- | C] () -- C:\Programme\pcwUpdateRepair.exe [2012.06.17 14:59:06 | 000,000,770 | ---- | C] () -- C:\WINDOWS\System32\winpdf.ini [2012.06.01 22:54:57 | 000,267,774 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-3187671637-2011817049-1224485136-1005-0.dat [2012.05.31 14:15:48 | 000,267,774 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat [2012.05.30 21:26:21 | 000,000,865 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\recently-used.xbel [2012.03.07 14:24:46 | 005,649,639 | ---- | C] () -- C:\Programme\OdfAddInForOfficeSetup-de_4.0.5309.exe [2012.02.16 19:46:34 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2012.01.04 13:14:27 | 027,359,820 | ---- | C] () -- C:\Programme\Anki.exe [2011.11.02 09:53:25 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2011.06.28 09:09:37 | 000,000,378 | ---- | C] () -- C:\WINDOWS\lexstat.ini [2011.06.28 09:07:44 | 024,129,024 | ---- | C] () -- C:\Programme\CJA2200GE.EXE [2011.06.28 08:51:12 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbvvs.dll [2011.06.28 08:51:12 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\INSTMON.EXE [2011.06.28 08:50:48 | 000,000,187 | ---- | C] () -- C:\WINDOWS\System32\lxbvcoin.ini [2011.06.28 08:47:54 | 043,905,792 | ---- | C] () -- C:\Programme\CJA2200EN.zip [2011.04.13 12:11:07 | 000,005,115 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mtbjfghn.xbe [2011.04.07 19:38:18 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2011.04.04 16:08:09 | 000,009,347 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Kommagetrennte Werte (Windows).EML [2009.12.07 12:49:52 | 000,053,248 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.12.04 19:32:11 | 000,000,430 | ---- | C] () -- C:\Dokumente und Einstellungen\Saleskonzept\desktopstate ========== ZeroAccess Check ========== [2010.12.09 17:15:07 | 000,002,048 | -HS- | M] () -- C:\WINDOWS\Installer\{699a11bc-b855-dba1-b563-e3c0eb729e76}\@ [2010.12.09 17:15:07 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer\{699a11bc-b855-dba1-b563-e3c0eb729e76}\L [2012.09.21 21:03:24 | 000,000,000 | -HSD | M] -- C:\WINDOWS\Installer\{699a11bc-b855-dba1-b563-e3c0eb729e76}\U [2012.09.14 22:10:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Dropbox\l [2012.09.14 10:39:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Dropbox\installer\l [2012.09.21 22:24:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Dropbox\shellext\l [2012.06.20 13:12:58 | 000,000,076 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Anwendungsdaten\Mozilla\Firefox\Profiles\ieavlqk5.default\extensions\toolbar@ask.com\chrome\skin\l.png [2012.07.03 11:23:01 | 000,002,048 | -HS- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\{699a11bc-b855-dba1-b563-e3c0eb729e76}\@ [2010.12.09 17:15:07 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\{699a11bc-b855-dba1-b563-e3c0eb729e76}\L [2012.07.05 03:12:02 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\{699a11bc-b855-dba1-b563-e3c0eb729e76}\U [2012.07.03 11:29:04 | 000,001,696 | ---- | M] () -- C:\Dokumente und Einstellungen\Saleskonzept\Lokale Einstellungen\Anwendungsdaten\{699a11bc-b855-dba1-b563-e3c0eb729e76}\U\00000001.@ [2009.12.12 19:12:56 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini < End of report > |
| Themen zu Chatzum -> lässt sich nicht entfernen! |
| adobe, antivir, avg, avira, avira searchfree toolbar, bho, bonjour, chatzum, converter, desktop, dvdvideosoft ltd., einstellungen, entfernen, error, firefox, flash player, format, home, iminent, logfile, lässt sich nicht entfernen, mozilla, mp3, plug-in, problem, realtek, registry, scan, searchsafer, security, senden, software |
Baum-Darstellung