Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Windows Vista: Erst BKA und jetzt GVU Trojaner....

Windows Vista: Erst BKA und jetzt GVU Trojaner....


Plagegeister aller Art und deren Bekämpfung: Windows Vista: Erst BKA und jetzt GVU Trojaner....

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

 
Vorheriger Beitrag Vorheriger Beitrag   Nächster Beitrag Nächster Beitrag
Alt 04.10.2012, 08:52   #1
LuDaCriSoNe
 
Windows Vista: Erst BKA und jetzt GVU Trojaner.... - Standard

Windows Vista: Erst BKA und jetzt GVU Trojaner....


Hallo ihr lieben

Ich habe mich hier angemeldet, weil sich meine Freundin auf Ihrem Laptop 2 Trojaner eingefangen hat. Es fing plötzlich am Montag an. Da tauchte dieser BKA Trojaner auf, der gerne eine Zahlung mit Ukash hätte.

Nach einer längeren Internet Recherche, habe ich gelesen das dort eine Systemwiederherstellung helfen würde. Also habe ich mich im abgesicherten Modus mit Eingabeaufforderung angemeldet und rstrui.exe ausgeführt.

Das hat auch funktioniert, der Laptop lief danach wieder wie vorher ohne Probleme.

Jetzt wollte meine Freundin gestern etwas am Laptop machen und hatte ihn hochgefahren. Nachdem kompletten hochfahren, kam dann einfach der GVU Trojaner Sperrbildschirm.... Also hatte ich es wieder mit einer Wiederherstellung probiert, klappte auch, aber der Trojaner kam wieder. Danach habe ich mir die Kaspersky Windows Unlocker Software besorgt, ausgeführt und neu gestartet. Es dauerte leider nicht lange und der Bildschirm wurde wieder gesperrt.

Ich kann nicht verstehen, wieso der Laptop aufeinmal so anfällig ist. Wir nutzen beide Norton 360 Online, und diese Software sagte vorher noch es wäre alles okay. Beim Scan wurde auch nichts gefunden.

Jetzt habe ich mich hier etwas erkundigt, und mir im abgesicherten Modus OTL und Malwarebytes runtergeladen. Beide Programme habe ich bereits durchlaufen lassen und Malwarebytes hat 7 Infizierte Dateien gefunden, die ich dann gelöscht habe.

Hier die Log Files:
USER & PC Name = XXX

Code:
ATTFilter
OTL.txt 
OTL logfile created on: 04.10.2012 08:00:49 - Run 1
OTL by OldTimer - Version 3.2.70.2     Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 82,50% Memory free
7,18 Gb Paging File | 6,79 Gb Available in Paging File | 94,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 88,30 Gb Free Space | 59,24% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 136,42 Gb Free Space | 99,34% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\XXX\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_11_4_402_278.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files\WinRAR\rarext.dll ()
MOD - C:\Program Files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll ()
MOD - C:\Program Files\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (N360) -- C:\Program Files\Norton 360\Engine\3.8.3.6\ccSvcHst.exe (Symantec Corporation)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (SearchAnonymizer) -- C:\Users\XXX\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe ()
SRV - (SRS_VolSync_Service) -- C:\Program Files\SRS Labs\SRS Premium Sound\SRS_VolSync.exe (SRS Labs, Inc.)
SRV - (ASLDRService) -- C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe ()
SRV - (ADSMService) -- C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe (ASUSTek Computer Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
SRV - (ATKGFNEXSrv) -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ()
SRV - (EPSON_PM_RPCV4_01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20121003.002\NAVEX15.SYS File not found
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20121003.002\NAVENG.SYS File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (eeCtrl) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20121002.001\IDSvix86.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (ccHP) -- C:\Windows\System32\drivers\N360\0308030.006\cchpx86.sys (Symantec Corporation)
DRV - (SYMTDI) -- C:\Windows\System32\drivers\N360\0308030.006\symtdi.sys (Symantec Corporation)
DRV - (SYMFW) -- C:\Windows\System32\drivers\N360\0308030.006\symfw.sys (Symantec Corporation)
DRV - (SYMNDISV) -- C:\Windows\System32\drivers\N360\0308030.006\symndisv.sys (Symantec Corporation)
DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\Windows\System32\drivers\N360\0308030.006\SymEFA.sys (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\System32\drivers\N360\0308030.006\srtsp.sys (Symantec Corporation)
DRV - (BHDrvx86) -- C:\Windows\System32\drivers\N360\0308030.006\BHDrvx86.sys (Symantec Corporation)
DRV - (SRTSPX) -- C:\Windows\System32\drivers\N360\0308030.006\srtspx.sys (Symantec Corporation)
DRV - (SymIM) -- C:\Windows\System32\drivers\SymIMV.sys (Symantec Corporation)
DRV - (AsDsm) -- C:\Windows\System32\drivers\AsDsm.sys (ASUSTek Computer Inc)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (SRS_PremiumSound_Service) -- C:\Windows\System32\drivers\SRS_PremiumSound_i386.sys ()
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (nvstor32) -- C:\Windows\System32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (kbfiltr) -- C:\Windows\System32\drivers\kbfiltr.sys ( )
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (SNP2UVC) -- C:\Windows\System32\drivers\snp2uvc.sys ()
DRV - (CRFILTER) -- C:\Windows\System32\drivers\CRFILTER.sys (Generic)
DRV - (ASMMAP) -- C:\Program Files\ATKGFNEX\ASMMAP.sys ()
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=ASUS&bmod=ASUS
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com.anonymize-me.de/?anonymto=687474703A2F2F7365617263682E6C6976652E636F6D2F726573756C74732E617370783F713D7B7365617263685465726D737D267372633D7B72656665727265723A736F757263653F7D&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=U3&apn_dtid=YYYYYYYYDE&apn_uid=2A60E630-E73C-480E-9831-A29AC924F35A&apn_sauid=FB9639B9-C3E6-4579-8934-E442DD948EA1
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{1AC7DA71-3D8E-451E-AE4C-D541B0903131}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{3FE9274E-3933-4216-9FC2-49C5895F66B0}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{5EB1BBAE-0F87-461A-9CFE-4A3F525036EB}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{661EED24-9CCC-4EF0-A939-0A472EB7AFEA}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUS_deDE342
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{8ADA9A31-0070-4D0D-BD1F-9955DA92DB51}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\SearchScopes\{F5B3B830-613E-427F-B6F6-775EA251D1B6}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=3b347159-bd98-42a8-992b-6deb65d3e2fd&pid=murb&mode=bounce
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.meinvz.net/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7
FF - prefs.js..extensions.enabledItems: {AA994882-F391-4d2e-806F-8908DA4814ED}:2.11.9
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: c:\Program Files\Sony\Media Go\npmediago.dll (Sony Creative Software Inc)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\ [2011.10.11 13:46:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.08 12:54:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.08 12:54:02 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.09.08 12:54:11 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.09.08 12:54:02 | 000,000,000 | ---D | M]
 
[2009.08.29 22:05:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2012.06.25 17:53:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\ozrd7br3.default\extensions
[2010.04.28 21:27:13 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\ozrd7br3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.06.24 17:21:33 | 000,002,408 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\askcom.xml
[2012.06.20 06:44:32 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-1.xml
[2011.12.06 06:09:12 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-10.xml
[2012.06.24 17:21:28 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-11.xml
[2012.06.24 17:51:38 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-12.xml
[2011.03.15 20:37:46 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-2.xml
[2011.03.29 14:00:27 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-3.xml
[2011.03.29 19:41:31 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-4.xml
[2011.06.15 11:18:04 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-5.xml
[2011.06.28 18:24:34 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-6.xml
[2011.08.29 13:25:55 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-7.xml
[2011.10.20 19:29:18 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-8.xml
[2011.11.04 15:27:55 | 000,000,950 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin-9.xml
[2010.12.08 07:51:30 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\icqplugin.xml
[2011.01.01 17:57:11 | 000,001,218 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\kikin-search.xml
[2010.05.14 07:44:05 | 000,002,041 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{A3D7305C-0C49-4C43-93F4-E42E7FE945E2}.xml
[2010.05.14 07:44:05 | 000,002,152 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{D3717DB6-E0B2-4656-B572-C26AB1C0F23E}.xml
[2010.05.14 07:44:05 | 000,001,834 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\mozilla\firefox\profiles\ozrd7br3.default\searchplugins\{DB44FC55-F071-45EF-A618-6D557C85E264}.xml
[2012.10.04 00:16:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.09.08 12:53:59 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Program Files\mozilla firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.09.08 12:54:11 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.06.15 00:46:57 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.01 17:07:56 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.06.15 00:46:57 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.15 00:46:57 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.15 00:46:57 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.15 00:46:56 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.8.3.6\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Program Files\kikin\ie_kikin.dll (kikin)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation)
O4 - HKLM..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exe (ATK)
O4 - HKLM..\Run: [ADSMTray] C:\Program Files\ASUS\ASUS Data Security Manager\ADSMTray.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (AlcorMicro Co., Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\AsScrProlog.exe ()
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files\ASUS\ATKOSD2\ATKOSD2.exe (ASUS)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DisableS3S4] c:\DisableS3S4.cmd File not found
O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)
O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [Ocs_SM] C:\Users\Miri\AppData\Roaming\OCS\SM\SearchAnonymizer.exe (OCS)
O4 - HKLM..\Run: [P2Go_Menu] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Wireless Console 3] C:\Program Files\ASUS\Wireless Console 3\wcourier.exe ()
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000..\Run: [ALBATTTOOL] C:\Program Files\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe (AkkuLine.de)
O4 - HKU\S-1-5-21-1510155998-2412716386-4037089523-1000..\Run: [ICQ] C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O4 - Startup: C:\Users\Miri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Miri\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Program Files\kikin\ie_kikin.dll (kikin)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{156BAF28-F88F-4754-AC5D-370EA53622DA}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\symres {AA1061FE-6C41-421f-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.8.3.6\coIEPlg.dll (Symantec Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Miri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Miri\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{189a3b69-6a90-11df-963b-0026189eadce}\Shell - "" = AutoRun
O33 - MountPoints2\{189a3b69-6a90-11df-963b-0026189eadce}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{7a38294f-a3a0-11df-b9a8-806e6f6e6963}\Shell\AutoRun\command - "" = F:\programs\nu2menu\nu2menu.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.10.04 07:54:20 | 000,601,088 | ---- | C] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.10.04 07:49:59 | 010,524,080 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\XXX\Desktop\mbam-setup-1.65.0.1400.exe
[2012.10.03 23:06:22 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2012.10.03 23:06:19 | 000,000,000 | ---D | C] -- C:\4ed1fa912e6d986eeaf033225816dd
[2012.10.03 19:04:30 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.10.03 19:04:17 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.10.03 19:03:54 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.10.03 19:03:54 | 000,093,672 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.10.03 19:03:53 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.10.01 12:21:08 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
[2012.10.01 11:15:15 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\hellomoto
[2012.09.23 15:39:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\Application Data
[2012.09.08 12:53:58 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.09.06 13:13:45 | 000,028,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mdimon.dll
[2012.09.05 14:36:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell Inc
[2012.09.05 14:36:07 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Deployment
[2012.09.05 14:36:07 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\Apps
[2012.09.05 11:14:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PE Builder
[2012.09.05 11:14:42 | 000,000,000 | ---D | C] -- C:\pebuilder3110a
[2012.09.04 15:27:11 | 000,000,000 | ---D | C] -- C:\UBCD4Win
[2012.09.04 11:42:29 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2012.09.04 11:42:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Canneverbe Limited
[2012.09.04 11:42:11 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP
 
========== Files - Modified Within 30 Days ==========
 
[2012.10.04 07:54:20 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Users\XXX\Desktop\OTL.exe
[2012.10.04 07:50:06 | 010,524,080 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\XXX\Desktop\mbam-setup-1.65.0.1400.exe
[2012.10.04 07:38:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.10.04 00:25:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.04 00:25:24 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.04 00:21:22 | 000,031,776 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.10.04 00:16:45 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.10.04 00:16:34 | 000,031,776 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.10.04 00:01:20 | 083,023,306 | ---- | M] () -- C:\ProgramData\0tbpw.pad
[2012.10.03 22:34:19 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.10.03 20:05:36 | 000,000,680 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2012.10.03 19:03:43 | 000,093,672 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll
[2012.10.03 19:03:35 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe
[2012.10.03 19:03:35 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
[2012.10.03 19:03:34 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe
[2012.10.03 19:03:32 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npdeployJava1.dll
[2012.10.03 19:03:32 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll
[2012.10.03 18:07:16 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EABF226A-D64D-4372-B904-43E4DC0EA6E1}.job
[2012.10.02 17:39:01 | 000,000,238 | ---- | M] () -- C:\Windows\tasks\Epson Printer Software Downloader.job
[2012.10.01 12:21:36 | 000,000,761 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.10.01 12:21:08 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
[2012.09.22 18:34:16 | 000,696,240 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.09.22 18:34:16 | 000,073,136 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.09.06 18:45:02 | 000,397,352 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.09.06 13:13:47 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI
[2012.09.05 23:24:27 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.05 23:24:27 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.05 23:24:27 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.05 23:24:27 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.05 15:20:02 | 000,033,280 | ---- | M] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.04 11:42:17 | 000,001,741 | ---- | M] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.09.04 11:39:50 | 000,001,770 | ---- | M] () -- C:\Users\XXX\Desktop\Continue SweetIM Installation.lnk
[2012.09.04 11:27:33 | 011,470,848 | ---- | M] () -- C:\Users\XXX\Desktop\KNOPPIX_V7.0.4bootonly-2012-08-20-DE.iso
 
========== Files Created - No Company Name ==========
 
[2012.10.01 12:21:36 | 000,000,761 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.10.01 12:21:31 | 083,023,306 | ---- | C] () -- C:\ProgramData\0tbpw.pad
[2012.09.06 13:13:47 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.09.04 11:42:17 | 000,001,741 | ---- | C] () -- C:\Users\Public\Desktop\CDBurnerXP.lnk
[2012.09.04 11:42:17 | 000,001,691 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
[2012.09.04 11:39:36 | 000,001,770 | ---- | C] () -- C:\Users\XXX\Desktop\Continue SweetIM Installation.lnk
[2012.09.04 11:27:18 | 011,470,848 | ---- | C] () -- C:\Users\XXX\Desktop\KNOPPIX_V7.0.4bootonly-2012-08-20-DE.iso
[2012.08.26 19:47:40 | 000,013,054 | ---- | C] () -- C:\Users\XXX\Gesa.ods
[2012.08.19 20:02:25 | 000,022,221 | ---- | C] () -- C:\Users\XXX\1. Mahnung Nintendo 3DS.odt
[2012.06.15 07:44:34 | 000,243,637 | ---- | C] () -- C:\Users\XXX\Bestellung bei Mac.ods
[2012.06.08 15:10:20 | 000,036,175 | ---- | C] () -- C:\Users\XXX\Seraps Kredit.ods
[2011.06.20 19:12:19 | 000,008,142 | ---- | C] () -- C:\Users\XXX\ESt2010_XXX_XXX.elfo
[2011.06.20 18:58:15 | 000,008,876 | ---- | C] () -- C:\Users\XXX\ESt2009_XXX_XXX.elfo
[2011.04.19 09:49:04 | 000,001,940 | ---- | C] () -- C:\Users\XXX\AppData\Local\{96C87F53-AC72-4604-A9CC-186A49F17F3C}.ini
[2010.11.06 15:28:08 | 000,004,096 | -H-- | C] () -- C:\Users\XXX\AppData\Local\keyfile3.drm
[2010.10.21 06:29:53 | 000,000,680 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2009.10.02 16:05:32 | 000,031,776 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.10.02 16:04:21 | 000,031,776 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009.08.30 17:39:40 | 000,033,280 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2011.01.21 17:46:32 | 011,582,464 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.08.05 10:55:07 | 000,615,424 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2008.01.21 04:24:03 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.09.04 11:42:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2010.05.14 07:46:57 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Desktopicon
[2011.10.27 11:24:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\elsterformular
[2012.08.28 13:49:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Epson
[2012.10.01 11:15:25 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\hellomoto
[2012.06.27 18:06:11 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2012.10.03 19:38:13 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\kikin
[2009.08.30 18:46:27 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\McLoad
[2010.05.14 07:44:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OCS
[2011.02.02 22:04:11 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2010.05.14 07:44:06 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Opera
[2010.03.31 13:16:48 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony
[2010.03.31 13:12:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony Setup
 
========== Purity Check ==========
 
 

< End of report >
Code:
ATTFilter
Extras.txt

OTL Extras logfile created on: 04.10.2012 08:00:49 - Run 1
OTL by OldTimer - Version 3.2.70.2     Folder = C:\Users\XXX\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,50 Gb Total Physical Memory | 2,89 Gb Available Physical Memory | 82,50% Memory free
7,18 Gb Paging File | 6,79 Gb Available in Paging File | 94,56% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 149,04 Gb Total Space | 88,30 Gb Free Space | 59,24% Space Free | Partition Type: NTFS
Drive D: | 137,33 Gb Total Space | 136,42 Gb Free Space | 99,34% Space Free | Partition Type: NTFS
 
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_USERS\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Unable to open value key
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Unable to open value key
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Unable to open value key
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1051584D-DBF7-42CB-83C0-D8A1E220272B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{151208DE-A18D-4F11-A84D-AF36A31D931B}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{181AB666-8F89-4965-829E-039887060EF7}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{1F5C3E3E-3729-4D4B-899D-EB44685D0346}" = lport=3390 | protocol=6 | dir=in | app=system | 
"{22E50670-BB2E-463E-8554-4787EBF73862}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{2C26C34F-1BFE-49E4-96EA-32CF36A437A2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{376BA189-5C37-450C-A1DE-4BA30A19379C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{43211A80-C1D2-4D6F-9502-B2615BBD951F}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{4E57C697-1E2E-452B-8A5C-57F1693B6878}" = rport=137 | protocol=17 | dir=out | app=system | 
"{57108E19-5404-4726-A74F-90406A31C7D1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{63F3B047-3F0F-4CCA-A8C9-B47D3E14E05A}" = lport=139 | protocol=6 | dir=in | app=system | 
"{66CF180B-6F8B-4570-BEE5-7630CB82A6F6}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{68417C0E-58F5-49C4-A1CA-2509E731F64C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6FAE2B0B-202F-4DF0-BAC6-018275CE0EEF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{78E494E6-239C-4BB1-BDEE-6343DECED24F}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7C3CB7F3-9689-4C95-A2AD-DBF20A971581}" = lport=554 | protocol=6 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{82E82782-E56E-4251-92C3-E78BED291D5A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{83BBAB47-AF41-4B12-A41A-A1B71B59B10D}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{848B17EF-2CB4-4809-8741-6AFD61C8968B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{9C25C8EB-A7D7-46DB-B9E6-18F04927F56C}" = lport=445 | protocol=6 | dir=in | app=system | 
"{9DBCD191-C015-4807-BA0D-C6AD4A3E32D6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{9E10A108-A3E5-4261-95F4-69AB7402ABE2}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A719CF19-89A2-4A72-87C9-B99D9F2A9E7E}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A8DEC781-3D17-4CA8-9EF0-DF4EA5C96A41}" = rport=139 | protocol=6 | dir=out | app=system | 
"{AC1781DC-19D8-4357-B872-D3895EE2DDB1}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{AC28EF28-852E-4671-A9BD-3FE2E36E7857}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{AD0F3A5A-668B-411D-99EA-2CD0416C31BD}" = lport=10244 | protocol=6 | dir=in | app=system | 
"{B5CC27FC-623E-4B4E-98BF-478EDBD3A365}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{B6BBC4FF-0421-4F10-9F66-DD0C6660DBD3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{B750A3DB-C6FB-45B9-B837-01320B5D08E2}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B8898A27-A33E-41BE-9F5F-6032E7874FC5}" = lport=7777 | protocol=17 | dir=in | app=%systemroot%\ehome\ehshell.exe | 
"{BCBB4BCC-FD46-40ED-904D-A426FC9B0635}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{BEABC88E-051F-4BDE-9983-9876969740B3}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{CBFAD0E0-AEF9-49D4-98EB-E3D5D34ADAEE}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{D985AE71-8C36-4983-8F23-236AE25810B4}" = lport=137 | protocol=17 | dir=in | app=system | 
"{E174E308-E945-4ACF-B112-9E2D2C61D474}" = lport=138 | protocol=17 | dir=in | app=system | 
"{E497F5BE-F959-46D8-AE89-E5F50986DD2B}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{E4D5104F-F809-4550-A14A-16B1FFEC8C56}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{EB4512F6-76FD-4896-B6C9-D8747960869C}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{EE525947-B792-44C0-9F7F-23025ACB3302}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{F2488319-7721-4A99-A92F-C3B3CB5A0B1F}" = rport=10244 | protocol=6 | dir=out | app=system | 
"{F2874292-07B7-4F70-A616-E2E17AEC551E}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F96746C3-51B7-4373-B65B-1355F3F3DA22}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{FA048CBF-AD70-49DB-8F58-8CED5E531E68}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05785197-1FB8-4377-932F-26D0E72A4DC5}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{0BF5D8CE-A74A-40DD-9735-FC3D3B27693E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{101E655B-6A77-4B3F-A728-4511F632C38C}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe | 
"{2A4C372F-A3ED-4EA7-B449-274560D42360}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{2ED611F3-1D2A-4E27-9C07-8C9629E6A3F5}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{2F61DF70-00DC-45FA-ADDD-B4FC3E204D38}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{3ECA4C95-3A34-4490-82EF-438409EAAC23}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{3EFDC893-D4FE-418B-92F3-E5336A9B8665}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{4B7E2252-C93A-47AE-B0F3-E2735D0FF917}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{50ABDB24-FC97-49D9-B113-27F37B3E5960}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{527CECDB-0D82-4F4B-AE17-EBA0F28D8A42}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{5D7276AE-8F92-440F-9DE0-A9A103725772}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{641B0709-37C0-4701-92EF-7BA0D0E52606}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{683E987B-F5E0-45A4-BF5A-F02ED78BE4EA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6C775624-04BF-45C2-8312-2991AC2588DE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{6D77B83E-790F-4A64-82BC-49A488C52FA2}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{6EEFB2D7-8E27-4B69-A9D6-8D004A1B74FC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{7188CA24-E794-4802-A127-D72EF080F6F3}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{781F75C1-F343-4604-9DE0-8317AD2D9113}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7A996AEF-318B-4424-8CB8-C6CE386D40AB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{7EA80B0E-7C06-4880-9675-F5034166874F}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{839D2B0F-BB9C-4877-818E-342B68B5A5DE}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | 
"{8663DE92-6508-4C67-B39C-3599E75CB13E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{8AC7C78A-83A9-42F5-8CDB-41E2C57337C1}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{92F38F8E-D86F-4BA8-BDDB-EB7A3F4B88D2}" = protocol=6 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{935F72A1-74E9-484A-BBD6-191379144BDF}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{940C28AA-685C-470E-9440-D9866525B28B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{99856D25-F696-4921-A4A1-1B4D22DD1799}" = protocol=6 | dir=out | app=%systemroot%\ehome\mcx2prov.exe | 
"{9AE88D2E-49E2-4F7A-AE13-ADF20D171AC8}" = protocol=17 | dir=out | app=%systemroot%\ehome\ehshell.exe | 
"{A6489000-AF05-4DFA-A6AA-89F72BEF34E9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{AA5E05D0-B0F0-4B97-998A-087C4E1F29E7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{AC4187F1-4D60-4E0C-9819-31D06488D701}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
"{B08FDFD0-690D-49EA-BAFB-49276B1944D8}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B671CF12-5386-477A-A88E-AE5882D158E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{BF9C96B8-5F89-4DBD-96EC-CB0F82E4F46D}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{C0A0CD1F-11A2-4A4B-8788-BF5134342662}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | 
"{E9B9917A-2CF3-4CCE-93BF-4882ADA3F41A}" = protocol=6 | dir=out | app=system | 
"{F242E047-97E7-4E5B-AFBA-F34B536EA9E2}" = protocol=6 | dir=out | svc=mcx2svc | app=%systemroot%\system32\svchost.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0969AF05-4FF6-4C00-9406-43599238DE0D}" = ASUS Splendid Video Enhancement Technology
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}" = LightScribe System Software  1.14.17.1
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = ASUS LifeFrame3
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}" = Wireless Console 3
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{23B8A91D-680B-462B-87AD-3D70F7341731}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 7
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3B05F2FB-745B-4012-ADF2-439F36B2E70B}" = ATKOSD2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B6B024F-F6D4-4A7B-8ADA-F9F8370320CC}" = SRS Premium Sound
"{586509F0-350D-48B5-B763-9CC2F8D96C4C}" = Windows Live Sync
"{5FF02438-DDE5-4D8E-8291-577CC1A2C014}" = AkkuLine Batterie-Tool
"{64452561-169F-4A36-A2FF-B5E118EC65F5}" = ASUS SmartLogon
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7B15D70E-9449-4CFB-B9BC-798465B2BD5C}" = Norton Internet Security
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{850C7BD3-9F3F-46AD-9396-E7985B38C55E}" = Windows Live Fotogalerie
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8136 8168 8169 Ethernet Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-040C-0000-0000000FF1CE}" = Microsoft Office Access MUI (French) 2007
"{90120000-0015-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0410-0000-0000000FF1CE}" = Microsoft Office Access MUI (Italian) 2007
"{90120000-0015-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0413-0000-0000000FF1CE}" = Microsoft Office Access MUI (Dutch) 2007
"{90120000-0015-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0413-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Dutch) 2007
"{90120000-0016-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0413-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Dutch) 2007
"{90120000-0018-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-040C-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (French) 2007
"{90120000-0019-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0410-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Italian) 2007
"{90120000-0019-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0413-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Dutch) 2007
"{90120000-0019-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-040C-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (French) 2007
"{90120000-001A-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0410-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Italian) 2007
"{90120000-001A-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0413-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Dutch) 2007
"{90120000-001A-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-040C-0000-0000000FF1CE}_PROHYBRIDR_{CF3C20A6-47B7-48DA-95C1-6FBB5A439AF8}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0410-0000-0000000FF1CE}_PROHYBRIDR_{7F40286D-09A7-4DC0-A2A4-AA18D026D369}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0413-0000-0000000FF1CE}" = Microsoft Office Word MUI (Dutch) 2007
"{90120000-001B-0413-0000-0000000FF1CE}_PROHYBRIDR_{26257879-B20D-4D30-A429-B387A4890929}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0401-0000-0000000FF1CE}_PROHYBRIDR_{3E8EA473-ECCE-405F-A9CA-59446AEADD3A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0413-0000-0000000FF1CE}_PROHYBRIDR_{2C95E7EE-FEA7-4B3A-A6E5-DF90A88B816A}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-002C-0413-0000-0000000FF1CE}" = Microsoft Office Proofing (Dutch) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-040C-0000-0000000FF1CE}_PROHYBRIDR_{8283FD64-6A3B-4104-9E12-7CA25EF29A1A}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0410-0000-0000000FF1CE}_PROHYBRIDR_{C0C7E58F-D0A1-4102-855B-0B7AA2E8F1C1}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0413-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Dutch) 2007
"{90120000-006E-0413-0000-0000000FF1CE}_PROHYBRIDR_{1D12BC91-360E-424C-97C4-813651313660}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91130407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0407-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}" = ASUS Power4Gear Hybrid
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D48531D-2135-49FC-BC29-ACCDA5396A76}" = ASUS MultiFrame
"{A7496F46-78AE-4DB2-BCF5-95F210FA6F96}" = Windows Live Movie Maker
"{A9FEB6D7-9C52-49FC-B956-7AB275B78890}" = ASUS FancyStart
"{AC76BA86-7AD7-1031-7B44-A90100000001}" = Adobe Reader 9.0.1 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF4434001}" = Epson Printer Software Downloader
"{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D16A31F9-276D-4968-A753-FFEAC56995D0}" = Epson Print CD
"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service
"{DA41F9E9-B878-467F-95E7-27E4D1943533}" = Multimedia Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = kikin plugin (murb.com Edition) 2.2
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera
"{EFC04D3F-A152-47E7-8517-EE0F6201AFEF}" = Apple Mobile Device Support
"{EFCEF949-9821-4759-A573-3EB8C857DF46}" = Windows Live Family Safety
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA2092C5-7979-412D-A962-6485274AE1EE}" = ASUS Data Security Manager
"{FBE5AA96-22F0-4C4A-8E92-4BE3498D4CCB}" = Media Go
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Elantech" = ETDWare PS/2-x86 7.0.5.3 WHQL
"ElsterFormular für Privatanwender 12.2.1.6570p" = ElsterFormular für Privatanwender
"Epson Printer Software Downloader" = Epson Printer Software Downloader
"EPSON PX650 Series" = EPSON PX650 Series Printer Uninstall
"EPSON Scanner" = EPSON Scan
"Epson Stylus Photo PX650_TX650 Benutzerhandbuch" = Epson Stylus Photo PX650_TX650 Handbuch
"ICQ Password" = ICQ Password
"ICQToolbar" = ICQ Toolbar
"Icy Tower v1.4_is1" = Icy Tower v1.4
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}" = AmIcoSingLun
"McLoad Preinstaller" = McLoad Preinstaller
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"N360" = Norton 360
"NVIDIA Drivers" = NVIDIA Drivers
"PE Builder_is1" = PE Builder 3.1.10a
"Picasa 3" = Picasa 3
"PROHYBRIDR" = 2007 Microsoft Office system
"SearchAnonymizer" = SearchAnonymizer
"USB 2.0 1.3M UVC WebCam" = USB 2.0 1.3M UVC WebCam
"USB Mass Storage Filter Driver" = Multimedia Card Reader
"VLC media player" = VLC media player 1.0.2
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1510155998-2412716386-4037089523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"bd4d3a0508d364f5" = Dell Driver Download Manager
"Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de)
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 15.08.2011 12:27:51 | Computer Name = XXX| Source = Windows Search Service | ID = 3013
Description = 
 
Error - 16.08.2011 00:41:34 | Computer Name = XXX| Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 16.08.2011 00:41:54 | Computer Name = XXX| Source = WinMgmt | ID = 10
Description = 
 
[ Media Center Events ]
Error - 12.06.2010 18:58:55 | Computer Name = XXX| Source = Mcx2Dvcs | ID = 401
Description = 
 
[ System Events ]
Error - 04.10.2012 01:39:03 | Computer Name = XXX| Source = DCOM | ID = 10005
Description = 
 
Error - 04.10.2012 01:39:08 | Computer Name = XXX| Source = DCOM | ID = 10005
Description = 
 
Error - 04.10.2012 01:39:07 | Computer Name = XXX| Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = 
 
Error - 04.10.2012 01:39:13 | Computer Name = XXX| Source = DCOM | ID = 10005
Description = 
 
Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001
Description = 
 
Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001
Description = 
 
Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7001
Description = 
 
Error - 04.10.2012 01:40:13 | Computer Name = XXX| Source = Service Control Manager | ID = 7026
Description = 
 
Error - 04.10.2012 01:40:49 | Computer Name = XXX| Source = Service Control Manager | ID = 7001
Description = 
 
Error - 04.10.2012 01:55:42 | Computer Name = XXX| Source = DCOM | ID = 10005
Description = 
 
 
< End of report >
Code:
ATTFilter
 Malwarebytes Anti-Malware  1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.04.03

Windows Vista Service Pack 1 x86 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 7.0.6001.18000
XXX :: XXX [Administrator]

04.10.2012 08:19:25
mbam-log-2012-10-04 (08-24-07).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 194815
Laufzeit: 3 Minute(n), 56 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\Users\XXX\AppData\Roaming\hellomoto (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.

Infizierte Dateien: 6
C:\Users\XXX\AppData\Local\Temp\wpbt0.dll (Trojan.FakeMS) -> Keine Aktion durchgeführt.
C:\Users\XXX\Downloads\PDFCreatorSetup.exe (Adware.Agent) -> Keine Aktion durchgeführt.
C:\ProgramData\lsass.exe (Trojan.Delf) -> Keine Aktion durchgeführt.
C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Keine Aktion durchgeführt.
C:\Users\XXX\AppData\Roaming\hellomoto\TujP.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.
C:\Users\XXX\AppData\Roaming\hellomoto\BukF.dat (Trojan.Ransom.FGen) -> Keine Aktion durchgeführt.

(Ende)
Malwarebytes Anti-Malware hat also 7 Dateien gefunden und ich habse gelöscht. Muss ich jetzt nochmal OTL durchlaufen lassen ? Kann ich den Laptop nun wieder normal hochfahren ?

Gibt es eine Methode um das System zu prüfen, ob es noch irgendwelche Löcher gibt ? Wir müssen nämlich noch Updates installieren, da meine Freundin das leider NIE gemacht hat.

Eine Frage hätte ich noch; Mein Desktop Rechner und der Laptop von meiner Freundin, laufen über einen W-Lan Router von Alice. Mein Desktop Rechner ist immer auf den neusten Stand, habe ihn vor kurzem erst neu auspielen müssen wegen HDD Defekt. Ist es möglich das sich mein Rechner auch Infiziert ? Der Laptop und mein Rechner sind ja übers Netzwerk verbunden.

Schonmal vielen Dank für die Hilfe

 

Themen zu Windows Vista: Erst BKA und jetzt GVU Trojaner....
bho, bonjour, continue, error, excel, firefox, flash player, frage, gfnexsrv.exe, home, infizierte dateien, install.exe, internet, kaspersky, logfile, mozilla, object, office 2007, plug-in, realtek, registry, scan, security, software, svchost.exe, sweetim, symantec, tower, trojaner, usb, usb 2.0, vista, windows, zahlung


« Ihr Computer wurde durch das system der automatischen Informationskontrolle gesperrt | Bka - Trojaner Problem »


Ähnliche Themen: Windows Vista: Erst BKA und jetzt GVU Trojaner....


  1. win7 Trojaner erst gendropper jetzt win32/toolbar. visicom a, conduit, systweak h, your file downloader
    Log-Analyse und Auswertung - 20.11.2014 (15)
  2. Windows 7, erst gesperrt, jetzt fährt er nicht mehr hoch
    Plagegeister aller Art und deren Bekämpfung - 10.05.2014 (69)
  3. Avira erst verschwunden und jetzt durch Gruppenrichtlinien blockier. Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 02.03.2014 (3)
  4. Formatieren ohne Windows-CD, Ursprungsbetriebsystem Vista, jetzt aber Win7
    Alles rund um Windows - 01.12.2013 (2)
  5. immer wieder pop-up erst von longfintuna und jetzt von salesresourcepartners
    Plagegeister aller Art und deren Bekämpfung - 30.10.2013 (17)
  6. Windows Vista: Avira Antivir meldet erst ADWARE/bProtect.D einige Tage später TR/Fakeadb.A
    Log-Analyse und Auswertung - 26.10.2013 (17)
  7. Windows Vista: Fake-nachricht Bundespolizei - jetzt weißer Bildschirm beim hochfahren
    Log-Analyse und Auswertung - 07.08.2013 (15)
  8. Erst AVA Professional Virus, jetzt startet IE automatisch mit Werbung
    Plagegeister aller Art und deren Bekämpfung - 22.03.2013 (2)
  9. (2x) erst verschlüsselungstrojaner und jetzt sendet mein emailaccount
    Mülltonne - 18.06.2012 (1)
  10. Erst abnow.com jetzt keine Internetverbindung mehr
    Plagegeister aller Art und deren Bekämpfung - 07.03.2012 (7)
  11. Erst can nott find dwlgina3.dll mit Blackscreen, jetzt den GEMA-Trojaner
    Plagegeister aller Art und deren Bekämpfung - 18.02.2012 (38)
  12. Erst BDS/Sinowal und jetzt BOO/Mebrot.A - ist das möglich?
    Plagegeister aller Art und deren Bekämpfung - 20.01.2012 (5)
  13. JavaExploit seit längerem auf PC - Jetzt erst der Fund?
    Log-Analyse und Auswertung - 14.12.2011 (1)
  14. Problem mit Vista-- erst csrss.exe jetzt kein Desktop mehr. HILFE!
    Plagegeister aller Art und deren Bekämpfung - 21.04.2011 (1)
  15. Erst Firefox Lahm, dann Meldungen, jetzt Trojaner
    Log-Analyse und Auswertung - 27.10.2010 (24)
  16. erst Trojaner und jetzt Backdoor 'BDS/Bredolab.UI'
    Plagegeister aller Art und deren Bekämpfung - 20.09.2009 (3)
  17. Erst smss.exe jetzt nvsvcd.exe - Bin verwirrt!
    Plagegeister aller Art und deren Bekämpfung - 13.10.2006 (1)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows Vista: Erst BKA und jetzt GVU Trojaner.... - Hallo ihr lieben Ich habe mich hier angemeldet, weil sich meine Freundin auf Ihrem Laptop 2 Trojaner eingefangen hat. Es fing plötzlich am Montag an. Da tauchte dieser BKA Trojaner - Windows Vista: Erst BKA und jetzt GVU Trojaner.......
Archiv
Du betrachtest: Windows Vista: Erst BKA und jetzt GVU Trojaner.... auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131