| |
| |||||||
Log-Analyse und Auswertung: GVU-Trojaner 2.04 (mit Webcam)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.12.2012, 12:20
| #1 |
| |  GVU-Trojaner 2.04 (mit Webcam) Hallo liebe Forumuser! Ich habe mir neulich einen GVU-Trojaner 2.04 eingefangen. Habe daraufhin direkt das BS neu aufgesetzt und einen scan mit Malwarebytes gemacht. Es wurden auch ein paar Viren gefunden, die ich direkt gelöscht habe. Mein System läuft jetzt stabil und es scheint alles in Ordnung zu sein. Dennoch habe ich Angst, dass Reste des Trojaners noch auf dem System sein könnten. Ich poste mal meine Logdatein. Ich hoffe ihr könnt mir helfen. _______________________ OTL logfile created on: 29.12.2012 11:54:40 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\dimer\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,12% Memory free 15,99 Gb Paging File | 13,54 Gb Available in Paging File | 84,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 195,21 Gb Total Space | 139,86 Gb Free Space | 71,64% Space Free | Partition Type: NTFS Drive D: | 1201,96 Gb Total Space | 458,01 Gb Free Space | 38,11% Space Free | Partition Type: NTFS Computer Name: DIMER-PC | User Name: dimer | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.29 11:47:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe PRC - [2012.12.25 08:15:12 | 000,034,784 | ---- | M] (GGS) -- C:\Users\dimer\AppData\Local\THORN\Thorn.exe PRC - [2012.12.15 22:23:21 | 001,807,800 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_5_502_135.exe PRC - [2012.12.14 20:32:29 | 003,084,688 | ---- | M] (Emsisoft GmbH) -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe PRC - [2012.12.12 16:30:38 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.12.12 16:30:34 | 000,384,800 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.12.12 16:30:34 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe PRC - [2012.11.29 09:26:08 | 000,916,960 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.08.17 04:37:56 | 000,277,504 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2012.08.17 04:37:50 | 000,007,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe ========== Modules (No Company Name) ========== MOD - [2012.12.15 22:23:21 | 014,586,296 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll MOD - [2012.12.01 22:01:51 | 001,233,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.WorkflowServ#\4a0913362049e731bb14c6462c09dd80\System.WorkflowServices.ni.dll MOD - [2012.12.01 22:01:33 | 001,153,536 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\949fb6acfbb4464bacdea87cc56b48b7\System.ServiceModel.Discovery.ni.dll MOD - [2012.12.01 22:01:33 | 000,373,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\6fec75cf21e2a14009ae3944bccd6ae4\System.ServiceModel.Routing.ni.dll MOD - [2012.12.01 22:01:32 | 000,084,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\c6063ba234104ac73a2ecca8efe29759\System.ServiceModel.Channels.ni.dll MOD - [2012.12.01 22:01:26 | 001,089,024 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\3206b636a30b2fecbd492762874ffa05\System.ServiceModel.Web.ni.dll MOD - [2012.12.01 22:00:14 | 001,550,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel#\ece50db06c9b24ff19502ae1cdae31b4\System.ServiceModel.Activities.ni.dll MOD - [2012.12.01 22:00:11 | 001,079,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\d9877a55720fcb067c6ab36f34d88018\System.IdentityModel.ni.dll MOD - [2012.12.01 22:00:10 | 018,208,256 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\4bddacaac6d3f45ecbed9973a86bf68b\System.ServiceModel.ni.dll MOD - [2012.12.01 22:00:00 | 000,027,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorDataMgrSvcInt#\7895827530bc6b81f399858827c8a392\IAStorDataMgrSvcInterfaces.ni.dll MOD - [2012.12.01 21:59:58 | 000,026,112 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorCommon\259e7f9290218b11c8e62d32c48c91b1\IAStorCommon.ni.dll MOD - [2012.12.01 21:59:56 | 000,361,472 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\IAStorUtil\339755c5e8e0ff20154fef6740ed1a2d\IAStorUtil.ni.dll MOD - [2012.12.01 21:59:50 | 001,812,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\5f1cf86d317a12ddd2b94066ddb6a82c\System.Xaml.ni.dll MOD - [2012.12.01 21:59:42 | 001,031,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\35c86495069fb1731d13f370db1696d3\System.Runtime.DurableInstancing.ni.dll MOD - [2012.12.01 21:59:41 | 002,659,328 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\9588de700ba160f3c26d2b9832c5ab90\System.Runtime.Serialization.ni.dll MOD - [2012.12.01 21:59:41 | 000,143,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\6f9b75af8cb0cbc358430c76a245eb7a\SMDiagnostics.ni.dll MOD - [2012.12.01 19:26:31 | 013,199,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\a9aa60064af8fb2fffa89a7e1ab9be48\System.Windows.Forms.ni.dll MOD - [2012.12.01 19:26:29 | 007,070,720 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8eb5dedb7c678e5087c3ae109f345705\System.Core.ni.dll MOD - [2012.12.01 19:26:26 | 005,618,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\1fea8d266adb312d528232fcc26accca\System.Xml.ni.dll MOD - [2012.12.01 19:26:25 | 001,007,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\b8f79f40049d0d27685ac0c79c797fd8\System.Configuration.ni.dll MOD - [2012.12.01 19:26:24 | 001,666,560 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\880ce3e4ae091231530c6c702061a154\System.Drawing.ni.dll MOD - [2012.12.01 19:26:23 | 009,099,776 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\56445f55ce34159a972c3b252d6a298c\System.ni.dll MOD - [2012.12.01 19:26:19 | 014,416,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\dbc34d53e1fbedabecd201fe4f264961\mscorlib.ni.dll MOD - [2012.11.29 09:26:21 | 002,397,152 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ========== Services (SafeList) ========== SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2012.12.25 08:15:12 | 000,034,784 | ---- | M] (GGS) [Auto | Running] -- C:\Users\dimer\AppData\Local\THORN\Thorn.exe -- (Thorn) SRV - [2012.12.15 22:23:21 | 000,250,808 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.14 20:32:29 | 003,084,688 | ---- | M] (Emsisoft GmbH) [Auto | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe -- (a2AntiMalware) SRV - [2012.12.12 16:30:38 | 000,085,280 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.12.12 16:30:34 | 000,109,344 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.11.29 14:50:25 | 003,463,080 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8) SRV - [2012.11.29 09:26:17 | 000,115,168 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2012.11.09 11:21:24 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.10.02 23:21:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.08.17 04:37:50 | 000,007,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2011.06.27 08:02:00 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2007.12.17 05:00:00 | 000,163,840 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE -- (EPSON_EB_RPCV4_01) SRV - [2007.01.11 05:02:00 | 000,126,464 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE -- (EPSON_PM_RPCV4_01) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.12.12 16:30:40 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.12.12 16:30:40 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.12.09 12:21:26 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV:64bit: - [2012.11.16 20:17:15 | 000,027,800 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.08.23 15:12:16 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt) DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 15:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.08.17 04:33:42 | 000,645,952 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA) DRV:64bit: - [2012.08.17 04:33:38 | 000,027,456 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorF.sys -- (iaStorF) DRV:64bit: - [2012.07.04 17:11:16 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2012.07.04 17:11:16 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2012.07.04 17:10:35 | 000,360,832 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2012.07.04 17:10:35 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2012.07.04 17:10:33 | 000,194,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2012.07.04 17:10:33 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2012.07.04 17:04:28 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.07.03 16:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.03.31 01:22:48 | 000,120,920 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2012.01.25 11:23:10 | 000,398,112 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2010.11.21 04:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub) DRV:64bit: - [2010.11.21 04:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV:64bit: - [2010.11.21 04:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012.04.30 18:45:28 | 000,066,320 | ---- | M] (Emsisoft GmbH) [File_System | On_Demand | Running] -- C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys -- (a2acc) DRV - [2011.05.19 14:10:34 | 000,023,208 | ---- | M] (Emsi Software GmbH) [Kernel | System | Running] -- C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys -- (A2DDA) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:17.0.1 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll () FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2012.12.15 12:32:56 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.12.04 18:42:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 17.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.12.01 11:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Extensions [2012.12.01 11:17:31 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Extensions\prism@developer.mozilla.org [2012.12.16 13:59:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\Firefox\Profiles\z9ir7jeg.default\extensions [2012.12.16 13:59:37 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\dimer\AppData\Roaming\mozilla\firefox\profiles\z9ir7jeg.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012.12.04 18:42:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [2012.11.29 09:26:57 | 000,262,112 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.11.29 10:19:31 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.11.29 10:19:31 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.11.29 10:19:31 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.11.29 10:19:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.11.29 10:19:31 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.11.29 10:19:31 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.google.com/ CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google  riginalQueryForSuggestion}{google:assistedQueryStats}{google:se archFieldtrialParameter}sourceid=chrome&ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter} CHR - homepage: hxxp://www.google.com/ CHR - plugin: Shockwave Flash (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\dimer\AppData\Local\Google\Chrome\Application\23.0.1271.97\pdf.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Google Update (Enabled) = C:\Users\dimer\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll CHR - Extension: Google Drive = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: Google-Suche = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: AdBlock = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.54_0\ CHR - Extension: Skype Click to Call = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\ CHR - Extension: DVDVideoSoft Browser Extension = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\ CHR - Extension: Google Mail = C:\Users\dimer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found O8 - Extra context menu item: An OneNote s&enden - res://C:\PROGRA~2\MICROS~2\Office14\ONBttnIE.dll/105 File not found O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{76017C88-37EB-4179-9241-6B361870409A}: DhcpNameServer = 192.168.0.1 O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell - "" = AutoRun O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\AutoRun\command - "" = F:\SETUP.EXE O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\configure\command - "" = F:\SETUP.EXE O33 - MountPoints2\{bf7ea3a1-41e5-11e2-a53a-000129a610b3}\Shell\install\command - "" = F:\SETUP.EXE O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.12.29 11:47:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe [2012.12.28 23:21:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVIedit by Alexander Milukov [2012.12.28 23:19:20 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\IrfanView [2012.12.28 23:19:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IrfanView [2012.12.23 08:49:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\ru-RU [2012.12.23 08:49:32 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\ru [2012.12.23 08:49:24 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\ru [2012.12.23 08:49:19 | 000,000,000 | ---D | C] -- C:\Windows\ru-RU [2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\uk-UA [2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\en-US [2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\en [2012.12.23 08:45:58 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\0409 [2012.12.23 08:45:51 | 000,000,000 | ---D | C] -- C:\Windows\uk-UA [2012.12.23 08:45:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\en [2012.12.23 08:45:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\0409 [2012.12.23 08:45:41 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\uk-UA [2012.12.21 16:13:16 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Epson [2012.12.21 13:49:59 | 000,000,000 | ---D | C] -- C:\ProgramData\UDL [2012.12.21 13:49:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software [2012.12.21 13:48:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Epson Software [2012.12.21 13:48:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY FineReader 6.0 Sprint [2012.12.21 13:48:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ABBYY FineReader 6.0 Sprint [2012.12.21 13:25:55 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON [2012.12.21 13:25:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON [2012.12.21 13:25:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\epson [2012.12.21 13:23:41 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\ElevatedDiagnostics [2012.12.18 19:02:43 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\THORN [2012.12.15 22:23:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Macromedia [2012.12.15 22:23:23 | 000,000,000 | ---D | C] -- C:\ProgramData\McAfee [2012.12.15 12:33:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers [2012.12.15 12:32:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoft [2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft [2012.12.15 12:32:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2012.12.14 20:25:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware [2012.12.14 20:25:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Emsisoft Anti-Malware [2012.12.14 20:25:35 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Anti-Malware [2012.12.14 14:20:25 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Downloads [2012.12.14 14:20:23 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\sabnzbd [2012.12.12 17:51:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\i4j_jres [2012.12.09 12:32:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\Documents\Outlook-Dateien [2012.12.09 12:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint [2012.12.09 12:25:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2012.12.09 12:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services [2012.12.09 12:25:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER [2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework [2012.12.09 12:25:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2012.12.09 12:24:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8 [2012.12.09 12:24:00 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office [2012.12.09 12:23:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services [2012.12.09 12:23:49 | 000,000,000 | ---D | C] -- C:\Windows\SHELLNEW [2012.12.09 12:23:33 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Microsoft Help [2012.12.09 12:23:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2012.12.09 12:23:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2012.12.09 12:23:10 | 000,000,000 | RH-D | C] -- C:\MSOCache [2012.12.09 12:21:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite [2012.12.09 12:21:26 | 000,283,200 | ---- | C] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2012.12.09 12:21:23 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\DAEMON Tools Lite [2012.12.09 12:21:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DAEMON Tools Lite [2012.12.09 12:20:44 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Lite [2012.12.08 14:51:05 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\BullGuard [2012.12.08 14:51:00 | 000,000,000 | ---D | C] -- C:\ProgramData\BullGuard [2012.12.07 20:14:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\uTorrent [2012.12.07 20:13:36 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\uTorrent [2012.12.06 21:04:47 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\ImgBurn [2012.12.06 20:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn [2012.12.06 20:57:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ImgBurn [2012.12.04 19:27:29 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Wargaming.net [2012.12.04 18:42:11 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Mozilla [2012.12.04 18:42:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2012.12.04 18:36:13 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx [2012.12.02 13:50:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\dvdcss [2012.12.02 13:50:05 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\vlc [2012.12.02 13:50:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2012.12.02 13:49:55 | 000,000,000 | ---D | C] -- C:\Program Files\VideoLAN [2012.12.01 19:03:48 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Diagnostics [2012.12.01 18:52:22 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Macromedia [2012.12.01 18:52:19 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Adobe [2012.12.01 18:51:58 | 000,000,000 | ---D | C] -- C:\Program Files\Google [2012.12.01 18:51:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2012.12.01 18:51:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2012.12.01 18:51:44 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2012.12.01 18:51:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2012.12.01 11:45:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Thunderbird [2012.12.01 11:45:00 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Thunderbird [2012.12.01 11:44:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2012.12.01 11:44:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2012.12.01 11:22:08 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\TeamViewer [2012.12.01 11:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\id Software [2012.12.01 11:20:10 | 000,000,000 | ---D | C] -- C:\ProgramData\id Software [2012.12.01 11:19:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TeamViewer [2012.12.01 11:19:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip [2012.12.01 11:19:19 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2012.12.01 11:17:31 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Mozilla [2012.12.01 11:17:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QLPrism [2012.12.01 10:48:55 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Abelssoft [2012.11.30 23:58:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Syncopate [2012.11.30 23:58:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Nexon [2012.11.30 23:54:14 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Avira [2012.11.30 23:53:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\TS3Client [2012.11.30 23:53:45 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\NVIDIA [2012.11.30 23:53:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\GameNet [2012.11.30 23:53:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combat Arms [2012.11.30 23:50:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Skype [2012.11.30 23:50:52 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2012.11.30 23:50:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.11.30 23:50:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.11.30 23:50:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2012.11.30 23:50:08 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client [2012.11.30 23:50:07 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\TeamSpeak 3 Client [2012.11.30 23:48:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2012.11.30 23:48:50 | 000,129,216 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.11.30 23:48:50 | 000,099,912 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012.11.30 23:48:50 | 000,027,800 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys [2012.11.30 23:48:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2012.11.30 23:48:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira [2012.11.30 23:40:37 | 000,000,000 | ---D | C] -- C:\NVIDIA [2012.11.30 23:38:13 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\InstallShield [2012.11.30 23:30:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel Corporation [2012.11.30 23:29:45 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Intel Corporation [2012.11.30 23:29:30 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Google [2012.11.30 23:29:18 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Deployment [2012.11.30 23:29:18 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Apps [2012.11.30 23:23:23 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\RTCOM [2012.11.30 23:23:23 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek [2012.11.30 23:23:16 | 002,080,120 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib64.dll [2012.11.30 23:23:15 | 000,518,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll [2012.11.30 23:23:15 | 000,211,184 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll [2012.11.30 23:23:15 | 000,198,896 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll [2012.11.30 23:23:15 | 000,155,888 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll [2012.11.30 23:23:14 | 002,028,920 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ64.dll [2012.11.30 23:23:14 | 000,834,936 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll [2012.11.30 23:23:14 | 000,375,128 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll [2012.11.30 23:23:14 | 000,318,808 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll [2012.11.30 23:23:14 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll [2012.11.30 23:23:14 | 000,310,104 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll [2012.11.30 23:23:14 | 000,204,120 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll [2012.11.30 23:23:14 | 000,101,208 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll [2012.11.30 23:23:14 | 000,078,680 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll [2012.11.30 23:23:13 | 002,535,008 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll [2012.11.30 23:23:12 | 000,110,592 | ---- | C] (Real Sound Lab SIA) -- C:\Windows\SysNative\CONEQMSAPOGUILibrary.dll [2012.11.30 23:23:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Realtek [2012.11.30 23:23:11 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Temp [2012.11.30 23:22:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Marvell [2012.11.30 23:22:35 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2012.11.30 23:22:35 | 000,000,000 | ---D | C] -- C:\RaidTool [2012.11.30 23:22:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JMicron Technology Corp [2012.11.30 23:22:28 | 000,000,000 | ---D | C] -- C:\Windows\RaidTool [2012.11.30 23:22:12 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel [2012.11.30 23:16:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.11.30 23:13:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2012.11.30 23:12:33 | 000,053,248 | ---- | C] (Windows XP Bundled build C-Centric Single User) -- C:\Windows\SysWow64\CSVer.dll [2012.11.30 23:12:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel [2012.11.30 23:12:22 | 000,000,000 | ---D | C] -- C:\Intel [2012.11.30 23:00:28 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\DriverGenius [2012.11.30 22:59:37 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA [2012.11.30 22:59:10 | 000,000,000 | ---D | C] -- C:\ProgramData\DriverGenius [2012.11.30 22:59:07 | 000,060,776 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll [2012.11.30 22:59:07 | 000,052,584 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll [2012.11.30 22:58:48 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation [2012.11.30 22:58:46 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation [2012.11.30 22:58:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation [2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\Virtual Machines [2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\Searches [2012.11.30 22:58:06 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2012.11.30 22:57:59 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Roaming\Identities [2012.11.30 22:57:58 | 000,000,000 | R--D | C] -- C:\Users\dimer\Contacts [2012.11.30 22:57:56 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\VirtualStore [2012.11.30 22:57:51 | 000,000,000 | --SD | C] -- C:\Users\dimer\AppData\Roaming\Microsoft [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Videos [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Saved Games [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Pictures [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Music [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Links [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Favorites [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Downloads [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Documents [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\Desktop [2012.11.30 22:57:51 | 000,000,000 | R--D | C] -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Vorlagen [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Verlauf [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Temporary Internet Files [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Startmenü [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\SendTo [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Recent [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Netzwerkumgebung [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Lokale Einstellungen [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Videos [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Musik [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Eigene Dateien [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Documents\Eigene Bilder [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Druckumgebung [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Cookies [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\AppData\Local\Anwendungsdaten [2012.11.30 22:57:51 | 000,000,000 | -HSD | C] -- C:\Users\dimer\Anwendungsdaten [2012.11.30 22:57:51 | 000,000,000 | -H-D | C] -- C:\Users\dimer\AppData [2012.11.30 22:57:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Temp [2012.11.30 22:57:51 | 000,000,000 | ---D | C] -- C:\Users\dimer\AppData\Local\Microsoft [2012.11.30 22:50:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2012.11.30 22:49:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2012.11.30 22:49:02 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2012.11.30 22:49:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2012.11.30 22:48:46 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2012.11.30 22:48:46 | 000,000,000 | ---D | C] -- C:\Program Files\Windows XP Mode [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Recovery [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Programme [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2012.11.30 22:47:41 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2012.11.30 22:47:40 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2012.11.30 22:41:30 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2012.11.30 22:41:01 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2012.11.30 22:40:03 | 000,000,000 | ---D | C] -- C:\Windows\Panther ========== Files - Modified Within 30 Days ========== [2012.12.29 11:53:20 | 000,000,000 | ---- | M] () -- C:\Users\dimer\defogger_reenable [2012.12.29 11:47:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dimer\Desktop\OTL.exe [2012.12.29 11:47:15 | 000,050,477 | ---- | M] () -- C:\Users\dimer\Desktop\Defogger.exe [2012.12.29 11:06:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.29 10:55:20 | 000,023,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.29 10:55:20 | 000,023,872 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.29 10:54:43 | 002,491,104 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.12.29 10:54:43 | 000,718,106 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat [2012.12.29 10:54:43 | 000,702,554 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.12.29 10:54:43 | 000,655,930 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.12.29 10:54:43 | 000,150,586 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat [2012.12.29 10:54:43 | 000,149,608 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.12.29 10:54:43 | 000,122,300 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.12.29 10:47:57 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\CheckDriveBackgroundGuard.job [2012.12.29 10:47:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.29 10:47:42 | 2146,021,375 | -HS- | M] () -- C:\hiberfil.sys [2012.12.28 23:35:45 | 1686,039,324 | ---- | M] () -- C:\Users\dimer\Desktop\shot0262.avi [2012.12.23 08:49:13 | 000,336,704 | ---- | M] () -- C:\Windows\SysNative\perfi019.dat [2012.12.23 08:49:13 | 000,039,446 | ---- | M] () -- C:\Windows\SysNative\perfd019.dat [2012.12.21 16:12:23 | 000,409,312 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.12.21 13:46:14 | 000,000,934 | ---- | M] () -- C:\Users\Public\Desktop\EPSON Scan.lnk [2012.12.18 15:26:56 | 000,000,382 | ---- | M] () -- C:\Windows\SysWow64\SystemPreferences.xml [2012.12.18 09:32:04 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.12.15 12:32:57 | 000,001,402 | ---- | M] () -- C:\Users\dimer\Desktop\Free YouTube to MP3 Converter.lnk [2012.12.14 20:25:58 | 000,001,095 | ---- | M] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2012.12.12 18:35:40 | 001,645,800 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.12.12 18:35:24 | 000,001,090 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2012.12.12 16:30:40 | 000,129,216 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys [2012.12.12 16:30:40 | 000,099,912 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys [2012.12.09 12:25:37 | 000,003,231 | ---- | M] () -- C:\Users\dimer\Desktop\Microsoft Outlook 2010.lnk [2012.12.09 12:21:55 | 000,001,954 | ---- | M] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2012.12.09 12:21:26 | 000,283,200 | ---- | M] (DT Soft Ltd) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys [2012.12.07 20:14:20 | 000,000,947 | ---- | M] () -- C:\Users\Public\Desktop\µTorrent.lnk [2012.12.06 20:57:55 | 000,001,869 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2012.12.01 11:17:25 | 000,255,468 | ---- | M] () -- C:\Windows\QLPrism Uninstaller.exe [2012.12.01 11:17:25 | 000,000,836 | ---- | M] () -- C:\Users\Public\Desktop\QLPrism Config Utility.lnk [2012.12.01 11:17:25 | 000,000,743 | ---- | M] () -- C:\Users\Public\Desktop\QLPrism.lnk [2012.11.30 23:53:40 | 000,000,753 | ---- | M] () -- C:\Users\dimer\Desktop\Combat Arms.lnk [2012.11.30 23:53:40 | 000,000,605 | ---- | M] () -- C:\Users\dimer\Desktop\GameNet.lnk [2012.11.30 23:50:52 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.11.30 23:50:09 | 000,001,211 | ---- | M] () -- C:\Users\dimer\Desktop\TeamSpeak 3 Client.lnk [2012.11.30 22:44:32 | 000,161,548 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2012.11.30 22:44:32 | 000,161,548 | ---- | M] () -- C:\Windows\SysNative\license.rtf ========== Files Created - No Company Name ========== [2012.12.29 11:53:20 | 000,000,000 | ---- | C] () -- C:\Users\dimer\defogger_reenable [2012.12.29 11:47:08 | 000,050,477 | ---- | C] () -- C:\Users\dimer\Desktop\Defogger.exe [2012.12.28 23:35:26 | 1686,039,324 | ---- | C] () -- C:\Users\dimer\Desktop\shot0262.avi [2012.12.23 08:49:57 | 000,336,704 | ---- | C] () -- C:\Windows\SysNative\perfi019.dat [2012.12.23 08:49:56 | 000,718,106 | ---- | C] () -- C:\Windows\SysNative\perfh019.dat [2012.12.23 08:49:56 | 000,150,586 | ---- | C] () -- C:\Windows\SysNative\perfc019.dat [2012.12.23 08:49:56 | 000,039,446 | ---- | C] () -- C:\Windows\SysNative\perfd019.dat [2012.12.21 13:47:01 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat [2012.12.21 13:47:01 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat [2012.12.21 13:47:01 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat [2012.12.21 13:47:01 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat [2012.12.21 13:47:01 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat [2012.12.21 13:47:01 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat [2012.12.21 13:47:01 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat [2012.12.21 13:47:01 | 000,013,732 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_EN.cfg [2012.12.21 13:47:01 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat [2012.12.21 13:47:01 | 000,006,442 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_IT.cfg [2012.12.21 13:47:01 | 000,006,347 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_PT.cfg [2012.12.21 13:47:01 | 000,006,347 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_BP.cfg [2012.12.21 13:47:01 | 000,006,335 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_GE.cfg [2012.12.21 13:47:01 | 000,006,195 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_FR.cfg [2012.12.21 13:47:01 | 000,006,195 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_CF.cfg [2012.12.21 13:47:01 | 000,006,122 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_DU.cfg [2012.12.21 13:47:01 | 000,006,103 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_ES.cfg [2012.12.21 13:47:01 | 000,005,817 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_KO.cfg [2012.12.21 13:47:01 | 000,005,436 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_SC.cfg [2012.12.21 13:47:01 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat [2012.12.21 13:47:01 | 000,002,889 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_RU.cfg [2012.12.21 13:47:01 | 000,002,426 | ---- | C] () -- C:\Windows\SysWow64\EPPICLocal_TC.cfg [2012.12.21 13:47:01 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat [2012.12.21 13:47:01 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat [2012.12.21 13:47:01 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat [2012.12.21 13:47:01 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat [2012.12.21 13:47:01 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat [2012.12.21 13:47:01 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat [2012.12.21 13:47:01 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat [2012.12.21 13:47:01 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat [2012.12.21 13:47:01 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat [2012.12.21 13:47:01 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini [2012.12.21 13:25:27 | 000,000,934 | ---- | C] () -- C:\Users\Public\Desktop\EPSON Scan.lnk [2012.12.18 15:26:56 | 000,000,382 | ---- | C] () -- C:\Windows\SysWow64\SystemPreferences.xml [2012.12.18 09:32:04 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2012.12.15 12:32:57 | 000,001,402 | ---- | C] () -- C:\Users\dimer\Desktop\Free YouTube to MP3 Converter.lnk [2012.12.14 20:25:58 | 000,001,095 | ---- | C] () -- C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk [2012.12.12 18:35:24 | 000,001,102 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk [2012.12.12 18:35:24 | 000,001,090 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 8.lnk [2012.12.09 12:25:37 | 000,003,231 | ---- | C] () -- C:\Users\dimer\Desktop\Microsoft Outlook 2010.lnk [2012.12.09 12:21:55 | 000,001,954 | ---- | C] () -- C:\Users\Public\Desktop\DAEMON Tools Lite.lnk [2012.12.07 20:14:20 | 000,000,947 | ---- | C] () -- C:\Users\Public\Desktop\µTorrent.lnk [2012.12.06 20:57:55 | 000,001,881 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn.lnk [2012.12.06 20:57:55 | 000,001,869 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2012.12.04 18:42:09 | 000,001,163 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.12.01 18:51:46 | 000,000,884 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.12.01 11:17:25 | 000,255,468 | ---- | C] () -- C:\Windows\QLPrism Uninstaller.exe [2012.12.01 11:17:25 | 000,000,836 | ---- | C] () -- C:\Users\Public\Desktop\QLPrism Config Utility.lnk [2012.12.01 11:17:25 | 000,000,743 | ---- | C] () -- C:\Users\Public\Desktop\QLPrism.lnk [2012.12.01 10:48:57 | 000,000,288 | ---- | C] () -- C:\Windows\tasks\CheckDriveBackgroundGuard.job [2012.11.30 23:53:40 | 000,000,753 | ---- | C] () -- C:\Users\dimer\Desktop\Combat Arms.lnk [2012.11.30 23:53:40 | 000,000,605 | ---- | C] () -- C:\Users\dimer\Desktop\GameNet.lnk [2012.11.30 23:53:40 | 000,000,605 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameNet.lnk [2012.11.30 23:50:52 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2012.11.30 23:50:09 | 000,001,211 | ---- | C] () -- C:\Users\dimer\Desktop\TeamSpeak 3 Client.lnk [2012.11.30 23:23:46 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf [2012.11.30 23:23:14 | 000,336,393 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT [2012.11.30 23:20:03 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf [2012.11.30 22:59:20 | 003,536,817 | ---- | C] () -- C:\Windows\SysNative\nvcoproc.bin [2012.11.30 22:58:12 | 000,001,409 | ---- | C] () -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2012.11.30 22:58:08 | 000,001,443 | ---- | C] () -- C:\Users\dimer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2012.11.30 22:57:38 | 000,210,944 | ---- | C] () -- C:\Windows\SysWow64\msvcrt10.dll [2012.11.30 22:54:51 | 001,645,800 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2012.11.30 22:43:59 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2012.11.30 22:41:01 | 2146,021,375 | -HS- | C] () -- C:\hiberfil.sys [2011.12.14 04:55:24 | 000,081,920 | ---- | C] () -- C:\Windows\qlprism-uninstall.exe ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2012.12.09 12:33:57 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\BullGuard [2012.12.09 12:22:43 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DAEMON Tools Lite [2012.12.16 21:39:31 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoft [2012.12.15 12:33:00 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\DVDVideoSoftIEHelpers [2012.12.21 16:13:19 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Epson [2012.12.24 21:05:05 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\ImgBurn [2012.12.28 23:19:20 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\IrfanView [2012.12.12 22:12:13 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\TeamViewer [2012.12.01 11:45:00 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Thunderbird [2012.12.28 22:43:11 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\TS3Client [2012.12.29 00:37:33 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\uTorrent [2012.12.04 19:27:29 | 000,000,000 | ---D | M] -- C:\Users\dimer\AppData\Roaming\Wargaming.net ========== Purity Check ========== < End of report > __________________ OTL Extras logfile created on: 29.12.2012 11:54:40 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\dimer\Desktop 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 8,00 Gb Total Physical Memory | 6,17 Gb Available Physical Memory | 77,12% Memory free 15,99 Gb Paging File | 13,54 Gb Available in Paging File | 84,63% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 195,21 Gb Total Space | 139,86 Gb Free Space | 71,64% Space Free | Partition Type: NTFS Drive D: | 1201,96 Gb Total Space | 458,01 Gb Free Space | 38,11% Space Free | Partition Type: NTFS Computer Name: DIMER-PC | User Name: dimer | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN) Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{09608106-555D-4409-9B7F-628164C1C7E7}" = lport=10243 | protocol=6 | dir=in | app=system | "{1173AE40-F1DB-43D7-BB43-3CBE78A6F912}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe | "{18382545-D3AF-4FE8-91D4-8E5B62747530}" = lport=139 | protocol=6 | dir=in | app=system | "{1E372CCB-9734-492F-9988-F11C0078A98C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{372FE31F-9F3A-43C8-A498-9C39DA9A1749}" = lport=445 | protocol=6 | dir=in | app=system | "{3C6B3910-E2B8-4EFB-9B89-B5A76523DE2D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{4C8F2E23-7FE2-489D-AF16-DD2CC05A408F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{59212316-839B-4C8F-A8A8-ACFDFCF525D9}" = lport=138 | protocol=17 | dir=in | app=system | "{594623C2-BCE6-4F62-808C-5161B8000053}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{72625E8D-59F7-4556-9043-5DAAE29FEBBC}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{898947B7-62D0-4AC4-8E4F-4C84B069A54C}" = lport=2869 | protocol=6 | dir=in | app=system | "{8C24114A-85C6-4BBE-A80D-CD3EE9BE8A79}" = rport=137 | protocol=17 | dir=out | app=system | "{8F67EB94-C7B4-4BA4-91AA-10B89A93258D}" = rport=139 | protocol=6 | dir=out | app=system | "{91A13E47-B60A-4B25-A36B-A58E0C59323D}" = lport=137 | protocol=17 | dir=in | app=system | "{961E5EE3-FD91-4C37-9C01-77B35954F2EB}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{B1C8F1D1-FB4B-4B3D-83C0-877E34DDCB66}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{BBC56CFC-5379-49D9-B2CB-8FDEA0C1EEF0}" = rport=10243 | protocol=6 | dir=out | app=system | "{CAA982E6-AB62-46FC-9CFC-DAD9BD2AD469}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{CC659CA4-7CEE-46C6-9F42-D6256F9CED86}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{D46B0D46-3378-4EF5-A39E-CD82A328FAF9}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{DF30C633-F777-4819-B076-DF6438ADC861}" = rport=138 | protocol=17 | dir=out | app=system | "{EC6688EF-710A-47F7-9415-F19C2A387A69}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{F55CE29D-9D7E-4719-9E64-6985625445AD}" = rport=445 | protocol=6 | dir=out | app=system | "{F71DFD39-F8E0-449A-9B28-2CD6205E736E}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{01ECE994-96B4-4E6A-892A-6F714AFE2517}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{06E118DF-2165-411C-B26E-737D09EEE884}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{13E38B4B-9917-460F-90CF-46A77ED86BC5}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | "{18A80F7D-70A1-46F3-91A3-BA9C28436DA8}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{24E62885-5289-4EA3-9D93-0D971B3690E6}" = protocol=6 | dir=in | app=d:\spiele\qgna\qgna.exe | "{279651D0-6A2B-4852-A008-D5FB4ED5C941}" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\is-6ka59.tmp\setup31533.tmp | "{2803BB25-CEB6-424D-B44B-6A965DE96922}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{32B15FC6-6E91-48E6-AD22-027474003C67}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | "{32F5EA73-D926-4E01-B90C-7D8C20228530}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{377CEA38-2926-41ED-B7CD-CE0E34EBBBFC}" = protocol=17 | dir=in | app=d:\spiele\qgna\games\ca\live\nmservice.exe | "{37D3FE7B-825D-41D1-94AD-2D2D34C76267}" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\is-pnq4s.tmp\ca_install_1894711.tmp | "{40C81F6B-3ED2-4D03-8FF1-B11A4DD0FABC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{4C897053-AD4B-41D8-A14E-EC8656473D04}" = protocol=6 | dir=in | app=d:\spiele\qgna\games\ca\live\nmservice.exe | "{4D7887ED-E676-4104-BDC0-28DE7FDED6A2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{4EB5B319-88D8-45EE-BCAC-2C1DD9C50975}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{52149F76-8D08-4049-BC17-DDBDDCD5B7C4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{615C5B89-1486-46A3-9BB3-4B3880825871}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | "{6ADF39F5-851D-4250-83D8-7ABC901E2D6D}" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\is-6ka59.tmp\setup31533.tmp | "{7734CFBE-2F25-4D9F-864B-4702B534DB48}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{7B5B9908-C711-4A5E-B008-AF9B7DAAFC7F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{7D014E6D-EC2E-4AD0-8D34-85DAF968FF19}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{7D9D8A96-DB49-4451-BFDA-51C2C534D7E4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{844BC7FE-0DC9-490A-BCE4-5BC3CED448D5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | "{850E8545-E306-4439-AC67-8642349B8922}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{88F3F657-F731-4004-86C9-206BD0383768}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{8A864670-751F-4C35-AF63-C8B477D64D47}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{92267973-0B7B-406A-B7AC-5F8534022CFD}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{AC9F0C57-2B64-4836-AF46-9126D0E461AE}" = protocol=17 | dir=in | app=d:\spiele\qgna\qgna.exe | "{B091D84C-76E2-4B84-B819-5457BA353F0B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{C3EFBBDB-8AE8-4159-B11F-97E16EE0330D}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | "{C4CF85BB-374C-46CD-9067-85E7261B5CF8}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{CA2C23E7-F05E-49EB-A0F7-6C5D743C296C}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | "{CC2478D2-127E-4FAC-9614-03FBC574E307}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe | "{DBF49DF5-AE10-4105-BD0D-BC77B3F67AC0}" = protocol=58 | dir=in | app=system | "{DED39017-FF5A-4456-8035-2B0702A52316}" = protocol=6 | dir=out | app=system | "{E3D1FF1B-0B25-45DA-970F-30F434C170B6}" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\is-pnq4s.tmp\ca_install_1894711.tmp | "{F1340D31-1DB1-4D66-98CE-0CBE83197FA2}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe | "{F895E680-021C-41A4-B687-CA4108E7A8A5}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{F94A96FE-E0B4-4FD6-921F-B3D89DCAFBFA}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 | "{FCDCDEC9-6CA1-4CAF-9A67-A2F51D1ED98B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "TCP Query User{060049A3-664B-4B6B-BE1B-B3BB8D5F0AFD}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe | "TCP Query User{49EE72DA-F96C-4D36-82D9-29ADF5FB624E}C:\users\dimer\appdata\local\temp\keygen.exe" = protocol=6 | dir=in | app=c:\users\dimer\appdata\local\temp\keygen.exe | "TCP Query User{A14EB1D7-9B82-446A-9BF5-C29838EB4FF0}D:\spiele\wot\wotlauncher.exe" = protocol=6 | dir=in | app=d:\spiele\wot\wotlauncher.exe | "TCP Query User{A5C93B01-1B0B-43B1-8BF6-D70934ACE133}D:\spiele\wot\worldoftanks.exe" = protocol=6 | dir=in | app=d:\spiele\wot\worldoftanks.exe | "TCP Query User{FD2AA9C5-D8D4-4525-B4E1-0D9FEC98C567}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "UDP Query User{06E00805-77B2-4683-8084-C94706F511F4}C:\program files (x86)\jdownloader 2\jdownloader 2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\jdownloader 2\jdownloader 2.exe | "UDP Query User{15EAEDB7-BEFF-427A-B1B3-0716182CD668}D:\spiele\wot\wotlauncher.exe" = protocol=17 | dir=in | app=d:\spiele\wot\wotlauncher.exe | "UDP Query User{7B18EF19-1C5A-478E-A302-B95958B21FDE}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "UDP Query User{C04709A8-5397-4488-9349-C419AF5D67F1}D:\spiele\wot\worldoftanks.exe" = protocol=17 | dir=in | app=d:\spiele\wot\worldoftanks.exe | "UDP Query User{DC4FB20E-3FA5-4C8F-BA65-2824B6021183}C:\users\dimer\appdata\local\temp\keygen.exe" = protocol=17 | dir=in | app=c:\users\dimer\appdata\local\temp\keygen.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition) "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6276 "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010 "{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010 "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{B0A5A6EE-F8BA-48B1-BB32-BAC17E96C2B4}" = Microsoft Visual J# 2.0 Redistributable Package - SE (x64) "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.97 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "A8C0F819-A08C-4F1A-95D1-B8ADAA6417B2_is1" = Combat Arms "EPSON SX210 Series" = Druckerdeinstallation für EPSON SX210 Series "VLC media player" = VLC media player 2.0.4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX "{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{85467CBC-7A39-33C9-8940-D72D9269B84F}" = Microsoft Visual F# 2.0 Runtime "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 "{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2 "{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010 "{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010 "{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010 "{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010 "{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010 "{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010 "{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010 "{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010 "{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUS_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010 "{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUS_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010 "{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010 "{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUS_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010 "{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUS_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010 "{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010 "{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUS_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010 "{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010 "{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUS_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6276 "{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call "{BC30E5E7-047D-4232-A7E8-F2CB7CC7B2E0}_is1" = Emsisoft Anti-Malware "{EA17F4FC-FDBF-4CF8-A529-2D983132D053}" = Skype™ 6.0 "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FA66CFD7-0977-4C45-AACD-A8BB994B1A05}" = Quake Live Mozilla Plugin "2DC74854-88F0-4543-9AC5-3ACABFABA8F4_is1" = QGNA "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Avira AntiVir Desktop" = Avira Free Antivirus "DAEMON Tools Lite" = DAEMON Tools Lite "EPSON Scanner" = EPSON Scan "Epson Stylus SX210_SX410_TX210_TX410 Benutzerhandbuch" = Epson Stylus SX210_SX410_TX210_TX410 Handbuch "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212 "ImgBurn" = ImgBurn "IrfanView" = IrfanView (remove only) "Marvell Miniport Driver" = Marvell Miniport Driver "Mozilla Firefox 17.0.1 (x86 de)" = Mozilla Firefox 17.0.1 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Office14.PROPLUS" = Microsoft Office Professional Plus 2010 "QLPrism" = QLPrism "TeamViewer 8" = TeamViewer 8 "uTorrent" = µTorrent ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "TeamSpeak 3 Client" = TeamSpeak 3 Client ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 23.12.2012 15:06:24 | Computer Name = dimer-PC | Source = MsiInstaller | ID = 11609 Description = Error - 23.12.2012 15:07:15 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10 Description = Error - 23.12.2012 17:23:07 | Computer Name = dimer-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: engine.exe, Version: 0.0.0.0, Zeitstempel: 0x50d426e0 Name des fehlerhaften Moduls: nmconew.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5006ab9b Ausnahmecode: 0xc0000005 Fehleroffset: 0x21f3009d ID des fehlerhaften Prozesses: 0x6c4 Startzeit der fehlerhaften Anwendung: 0x01cde1410ffb1bd2 Pfad der fehlerhaften Anwendung: D:\Spiele\QGNA\Games\CA\live\engine.exe Pfad des fehlerhaften Moduls: nmconew.dll Berichtskennung: f128b949-4d46-11e2-b671-000129a610b3 Error - 24.12.2012 04:42:52 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10 Description = Error - 24.12.2012 16:10:47 | Computer Name = dimer-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: setup.exe_unknown, Version: 0.0.0.0, Zeitstempel: 0x4b989e44 Name des fehlerhaften Moduls: setup.exe, Version: 0.0.0.0, Zeitstempel: 0x4b989e44 Ausnahmecode: 0x40000015 Fehleroffset: 0x0000d8c5 ID des fehlerhaften Prozesses: 0x7ec Startzeit der fehlerhaften Anwendung: 0x01cde212a2f37bca Pfad der fehlerhaften Anwendung: E:\setup.exe Pfad des fehlerhaften Moduls: E:\setup.exe Berichtskennung: 00e33a02-4e06-11e2-8f83-000129a610b3 Error - 24.12.2012 16:11:54 | Computer Name = dimer-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: SETUP.EXE_unknown, Version: 0.0.0.0, Zeitstempel: 0x4b989e44 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.17965, Zeitstempel: 0x506dbe50 Ausnahmecode: 0xe06d7363 Fehleroffset: 0x0000c41f ID des fehlerhaften Prozesses: 0x944 Startzeit der fehlerhaften Anwendung: 0x01cde212dbc01c33 Pfad der fehlerhaften Anwendung: E:\SETUP.EXE Pfad des fehlerhaften Moduls: C:\Windows\syswow64\KERNELBASE.dll Berichtskennung: 2901bdf5-4e06-11e2-8f83-000129a610b3 Error - 25.12.2012 03:55:00 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10 Description = Error - 28.12.2012 09:13:27 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10 Description = Error - 28.12.2012 16:24:12 | Computer Name = dimer-PC | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: engine.exe, Version: 0.0.0.0, Zeitstempel: 0x50d426e0 Name des fehlerhaften Moduls: nmconew.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5006ab9b Ausnahmecode: 0xc0000005 Fehleroffset: 0x2203009d ID des fehlerhaften Prozesses: 0xa90 Startzeit der fehlerhaften Anwendung: 0x01cde526cf3b26d2 Pfad der fehlerhaften Anwendung: D:\Spiele\QGNA\Games\CA\live\engine.exe Pfad des fehlerhaften Moduls: nmconew.dll Berichtskennung: 8a4d5c7c-512c-11e2-bb01-000129a610b3 Error - 29.12.2012 05:49:34 | Computer Name = dimer-PC | Source = WinMgmt | ID = 10 Description = [ System Events ] Error - 24.12.2012 15:51:36 | Computer Name = dimer-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 24.12.2012 15:51:37 | Computer Name = dimer-PC | Source = Disk | ID = 262155 Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 24.12.2012 16:10:01 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:10:07 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:10:16 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:10:24 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:10:32 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:11:36 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:11:43 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. Error - 24.12.2012 16:11:51 | Computer Name = dimer-PC | Source = cdrom | ID = 262151 Description = Fehlerhafter Block bei Gerät \Device\CdRom0. < End of report > |
|
29.12.2012, 18:37
| #2 |
| /// Malware-holic   |  GVU-Trojaner 2.04 (mit Webcam) Hi
__________________also wenn du schon nach dem neu aufsätzen schadsoftware hast, hast du was falsch gemacht, und solltest evtl. noch mal neu aufsetzem. Schau wir mal. http://www.trojaner-board.de/125889-...en-posten.html poste Malwarebytes logs mit Funden
__________________ |
|
| Themen zu GVU-Trojaner 2.04 (mit Webcam) |
| adblock, antivir, autorun, avira, bho, converter, emsisoft, error, firefox, flash player, helper, homepage, installation, jdownloader, logfile, mozilla, mp3, msiinstaller, msvcrt, nvidia update, plug-in, realtek, registry, scan, security, senden, svchost.exe, system, teamspeak, viren, visual studio, windows, windows xp |
Linear-Darstellung
