| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: w32/Infector Virus!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
27.03.2013, 13:46
| #1 |
 |  w32/Infector Virus! Hallo liebe Trojaner Board Leute, Ich habe folgendes Problem, mein Vater hat eine E-Mail der Deutschen Post geöffnet und eine Datei dabei heruntergeldaden die den Namen "DeutschePost_ID672146-251"hat. Dort drin befindet sich eine exe. Jetzt meldet mein AntiVir dauert eine Virus mit dem Typ W32/Infector.Gen8 Habe auch den OTL durchlaufen lassen aber wenn ich bei GMER ein scan machen will kommt immme nach ein paar sekunden, dass das programm nicht mehr funktioniert Was soll ich jettz genau noch machen? Danke für jede Antwort Hier ist der OTL.txt DateiOTL Logfile: OTL EXTRAS Logfile: Code:
ATTFilter OTL logfile created on: 27.03.2013 12:54:50 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Computer\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,84% Memory free
8,00 Gb Paging File | 6,33 Gb Available in Paging File | 79,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 75,14 Gb Total Space | 21,52 Gb Free Space | 28,64% Space Free | Partition Type: NTFS
Drive D: | 390,53 Gb Total Space | 284,51 Gb Free Space | 72,85% Space Free | Partition Type: NTFS
Drive E: | 5,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: FLUR-PC | User Name: Computer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - File not found --
PRC - [2013.03.27 12:10:27 | 000,311,679 | ---- | M] () -- c:\users\computer\appdata\local\itvboird.exe
PRC - [2013.03.27 10:20:42 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2013.03.27 10:20:28 | 000,565,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2013.03.27 10:20:25 | 000,374,496 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2013.03.27 10:20:23 | 000,345,312 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2013.03.27 10:20:23 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013.03.27 10:17:15 | 000,181,984 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\ProgramData\Avira\AntiVir Desktop\TEMP\SELFUPDATE\avrestart.exe
PRC - [2013.03.27 08:12:20 | 000,059,964 | ---- | M] (Macrovision Europe Ltd.) -- C:\Users\Computer\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
PRC - [2013.03.13 12:43:36 | 004,970,496 | ---- | M] (Bandoo Media Inc.) -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrUI.exe
PRC - [2013.03.13 12:43:34 | 004,557,312 | ---- | M] (Bandoo Media Inc.) -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe
PRC - [2013.02.08 14:55:20 | 001,644,680 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
PRC - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2011.11.27 18:49:14 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2011.11.05 11:19:37 | 000,079,360 | ---- | M] (Creative Labs) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe
PRC - [2011.11.05 11:19:08 | 000,079,360 | ---- | M] (Creative Labs) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
PRC - [2011.11.05 11:18:41 | 000,079,360 | ---- | M] (Creative Labs) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe
PRC - [2011.01.17 18:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- D:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 18:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- D:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.03.09 00:42:02 | 000,029,984 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
PRC - [2010.03.09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
PRC - [2010.03.05 20:11:30 | 000,636,192 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
PRC - [2009.07.08 15:32:50 | 001,233,195 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe
PRC - [2009.05.05 16:06:06 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
PRC - [2009.05.04 19:05:04 | 000,241,789 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
PRC - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
========== Modules (No Company Name) ==========
MOD - [2013.03.27 12:10:27 | 000,311,679 | ---- | M] () -- c:\users\computer\appdata\local\itvboird.exe
MOD - [2013.03.27 08:12:21 | 000,697,884 | ---- | M] () -- C:\Users\Computer\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001.dir.0000\~df394b.tmp
MOD - [2013.03.27 08:12:21 | 000,592,896 | ---- | M] () -- C:\Users\Computer\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001.dir.0000\~de6248.tmp
MOD - [2011.11.07 18:09:41 | 000,985,088 | ---- | M] () -- D:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2011.11.07 18:09:41 | 000,170,496 | ---- | M] () -- D:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll
MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2009.04.20 11:55:58 | 000,148,480 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.02.06 18:52:24 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
========== Services (SafeList) ==========
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.03.27 10:20:42 | 000,086,752 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2013.03.27 10:20:28 | 000,565,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2013.03.27 10:20:25 | 000,374,496 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2013.03.27 10:20:23 | 000,110,816 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013.03.13 20:17:33 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.03.13 12:43:34 | 004,557,312 | ---- | M] (Bandoo Media Inc.) [Auto | Running] -- C:\Program Files (x86)\Search Results Toolbar\Datamngr\DatamngrCoordinator.exe -- (DatamngrCoordinator)
SRV - [2013.02.27 14:25:37 | 000,115,608 | ---- | M] (Mozilla Foundation) [Auto | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.18 15:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.10.10 21:23:42 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.10.02 13:15:38 | 000,382,824 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2011.11.27 18:49:14 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2011.11.17 17:39:02 | 003,993,576 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2011.11.05 11:19:37 | 000,079,360 | ---- | M] (Creative Labs) [Auto | Running] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.11.05 11:19:08 | 000,079,360 | ---- | M] (Creative Labs) [Auto | Running] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2011.11.05 11:18:41 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Running] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe -- (Sound Blaster X-Fi MB Licensing Service)
SRV - [2010.03.09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.02.23 04:43:56 | 000,307,200 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.03.27 10:20:48 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2013.03.27 10:20:48 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2013.03.27 10:20:48 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.12.13 13:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2012.08.21 12:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.19 13:45:22 | 000,146,736 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.06.23 10:10:56 | 000,344,680 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.04 17:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie)
DRV:64bit: - [2008.01.24 19:25:14 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2004.12.31 07:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=706&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=3186641012174502&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=706&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=3186641012174502&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/406
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 62 DF 01 32 45 75 CD 01 [binary data]
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\..\SearchScopes\{9B2884E6-79C2-4B0F-9640-CD56C2BC2719}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=15E29E75-8E8C-47E5-85AA-A55841F9D9EC&apn_sauid=2D30D332-E0D9-4B49-B0A3-D5A936B797DE
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=706&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=3186641012174502&q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Computer\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\ [2013.01.07 21:07:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.08 08:52:24 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2013.01.07 21:07:59 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions
[2013.01.07 21:07:59 | 000,000,000 | ---D | M] (No name found) -- \mozilla\Firefox\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.03.21 09:49:28 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.03.08 08:52:21 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.03.08 08:52:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.03.08 08:52:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.03.08 08:52:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions
[2013.03.08 08:52:20 | 000,000,000 | ---D | M] (GMX MailCheck) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions\toolbar@gmx.net
[2013.03.08 08:52:24 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.07.14 01:45:08 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.09.25 16:11:52 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.07.14 01:45:08 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.07.14 01:45:08 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.03.21 09:49:32 | 000,002,687 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml
[2012.07.14 01:45:08 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.07.14 01:45:07 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: Search Results (Enabled)
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&gct=ds&appid=706&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=3186641012174502&q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://www.searchnu.com/406
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll
CHR - plugin: registryAccess (Enabled) = C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaabfjnbeinlpljodiajipidiompfl\7.15.8.0_0\background/registryAccess.dll
CHR - plugin: Free Studio (Enabled) = C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.0.0_0\np_dvs_plugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Java(TM) Platform SE 6 U37 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Computer\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll
CHR - plugin: Java Deployment Toolkit 6.0.370.6 (Enabled) = C:\Windows\SysWOW64\npdeployJava1.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: Ask Toolbar = C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo\7.15.15.37265_0\
CHR - Extension: Google Chrome = C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\
CHR - Extension: DVDVideoSoft Browser Extension = C:\Users\Computer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp\1.0.1.1_0\
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Data Manager) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media Inc.)
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Search-Results Toolbar) - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Data Manager) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\SEARCH~1\Datamngr\BROWSE~1.DLL (Bandoo Media Inc.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\PROGRA~2\SEARCH~1\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CTSyncService] C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\SEARCH~1\Datamngr\DATAMN~2.EXE (Bandoo Media Inc.)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [ccleaner] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKCU..\Run: [fmvheftl] C:\Users\Computer\AppData\Local\emjxwtmf.exe ()
O4 - HKCU..\Run: [GoogleChromeAutoLaunch_99AE18632314C5772DDF1A65D9BFB3A0] C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - Startup: C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Computer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = D:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Computer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Mit PDF Viewer Plus öffnen - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Computer\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Mit PDF Viewer Plus öffnen - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{958D2A0A-76E8-4B8D-B323-0585D83BD4C0}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN64C~1.DLL) - C:\ProgramData\Wincert\win64cert.dll ()
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\mgrldr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\x64\mgrldr.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~3\Wincert\WIN32C~1.DLL) - C:\ProgramData\Wincert\win32cert.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\mgrldr.dll) - C:\PROGRA~2\SEARCH~1\Datamngr\mgrldr.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.10.14 09:23:09 | 000,054,544 | R--- | M] (Electronic Arts) - E:\Autorun.exe -- [ UDF ]
O32 - AutoRun File - [2009.09.21 20:58:33 | 000,000,049 | R--- | M] () - E:\Autorun.inf -- [ UDF ]
O33 - MountPoints2\{fa8d53c7-07cf-11e1-8914-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{fa8d53c7-07cf-11e1-8914-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Autorun.exe -- [2009.10.14 09:23:09 | 000,054,544 | R--- | M] (Electronic Arts)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.03.27 12:43:28 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Computer\Desktop\OTL.exe
[2013.03.27 10:21:00 | 000,130,016 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.03.27 10:21:00 | 000,100,712 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.03.27 10:21:00 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.03.23 12:36:04 | 000,000,000 | R--D | C] -- D:\Users\Computer\Documents\Scanned Documents
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\my games
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\MeineWebSeiten
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\Fax
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\Eigene PaperPort-Dokumente
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\DVDVideoSoft
[2013.03.23 12:36:04 | 000,000,000 | ---D | C] -- D:\Users\Computer\Documents\Battlefield 3
[2013.03.23 12:34:12 | 000,000,000 | ---D | C] -- C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013.03.22 00:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2013.03.21 11:51:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Browser Manager
[2013.03.21 09:49:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Wincert
[2013.03.21 09:49:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Search Results Toolbar
[2013.03.21 09:49:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Datamngr
[2013.03.20 21:37:44 | 000,000,000 | ---D | C] -- C:\Users\Computer\Desktop\Vali's Dokumenten Ordner
[2013.03.17 08:54:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2013.03.17 08:37:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.03.14 02:33:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
[2013.03.14 02:32:30 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight
[2013.03.14 02:32:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2013.03.08 08:52:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.03.01 10:40:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.02.25 20:54:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013.02.25 20:54:19 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013.02.25 20:54:19 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013.02.25 20:54:19 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.03.27 12:53:44 | 000,377,856 | ---- | M] () -- C:\Users\Computer\Desktop\gmer_2.1.19155.exe
[2013.03.27 12:52:09 | 000,000,000 | ---- | M] () -- C:\Users\Computer\defogger_reenable
[2013.03.27 12:46:06 | 000,050,477 | ---- | M] () -- C:\Users\Computer\Desktop\Defogger.exe
[2013.03.27 12:43:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Computer\Desktop\OTL.exe
[2013.03.27 12:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.27 12:16:00 | 000,001,114 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.03.27 12:10:50 | 000,000,070 | ---- | M] () -- C:\Users\Computer\AppData\Local\wsr27zt32.dll
[2013.03.27 12:10:27 | 000,311,679 | ---- | M] () -- C:\Users\Computer\AppData\Local\itvboird.exe
[2013.03.27 12:04:03 | 000,140,288 | ---- | M] () -- C:\Users\Computer\AppData\Local\emjxwtmf.exe
[2013.03.27 12:02:46 | 000,015,425 | ---- | M] () -- D:\Users\Computer\Documents\Ostermenü 2013.odt
[2013.03.27 12:02:45 | 000,000,102 | -H-- | M] () -- D:\Users\Computer\Documents\.~lock.Ostermenü 2013.odt#
[2013.03.27 10:20:48 | 000,130,016 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2013.03.27 10:20:48 | 000,100,712 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2013.03.27 10:20:48 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2013.03.27 10:16:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.03.27 08:20:37 | 000,014,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.27 08:20:37 | 000,014,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.27 08:11:50 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.27 08:11:14 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.26 21:36:30 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.03.26 21:36:30 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.03.26 21:36:30 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.03.26 21:36:30 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.03.26 21:36:30 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.03.26 18:53:49 | 000,013,603 | ---- | M] () -- D:\Users\Computer\Documents\Osterkarte.odt
[2013.03.26 18:41:24 | 000,370,519 | ---- | M] () -- C:\Users\Computer\Desktop\speisekarte_redline_frohe-ostern.jpg
[2013.03.26 13:41:42 | 139,214,848 | ---- | M] () -- C:\Users\Computer\Desktop\gparted-live-0.15.0-1-i486.iso
[2013.03.23 12:34:34 | 000,001,051 | ---- | M] () -- C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.03.23 11:41:25 | 789,884,928 | ---- | M] () -- C:\Users\Computer\Desktop\ubuntu-12.10-desktop-i386.iso
[2013.03.22 03:23:52 | 000,294,368 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.03.22 03:03:26 | 000,025,185 | ---- | M] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.03.22 03:03:26 | 000,025,185 | ---- | M] () -- C:\Windows\SysNative\ieuinit.inf
[2013.03.21 16:03:26 | 000,034,015 | ---- | M] () -- D:\Users\Computer\Documents\Speisekarte vom Januar 2013.odt
[2013.03.20 15:23:20 | 000,015,289 | ---- | M] () -- D:\Users\Computer\Documents\Monatskarte Januar 2013.odt
[2013.03.20 14:37:19 | 000,083,315 | ---- | M] () -- C:\Users\Computer\Desktop\47177KA(2).pdf
[2013.03.20 13:52:44 | 725,921,792 | ---- | M] () -- C:\Users\Computer\Desktop\ubuntu-12.04.2-alternate-i386.iso
[2013.03.20 09:29:19 | 000,016,709 | ---- | M] () -- D:\Users\Computer\Documents\Kündigung Wohnung.odt
[2013.03.18 11:57:04 | 000,043,945 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 08.04.2013.pdf
[2013.03.18 11:56:55 | 000,011,637 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 08.04.2013.odt
[2013.03.16 11:13:18 | 001,410,338 | ---- | M] () -- C:\Users\Computer\Desktop\Terrasse Schützenhaus 2 001.jpg
[2013.03.16 11:12:28 | 001,347,512 | ---- | M] () -- C:\Users\Computer\Desktop\Terrasse Schützenhaus 001.jpg
[2013.03.15 10:54:17 | 000,015,653 | ---- | M] () -- C:\Users\Computer\Desktop\Haus.odt
[2013.03.15 00:19:37 | 000,002,183 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013.03.13 10:34:13 | 000,002,307 | ---- | M] () -- C:\Users\Computer\Desktop\Dokument oder Bild scannen - Verknüpfung.lnk
[2013.03.11 01:35:24 | 000,045,084 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.03.2013.pdf
[2013.03.11 01:35:14 | 000,012,065 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.03.2013.odt
[2013.03.08 15:04:22 | 002,977,254 | ---- | M] () -- C:\Users\Computer\Desktop\TG_Produktmappe_022013_DE.pdf
[2013.03.06 14:47:25 | 000,105,668 | ---- | M] () -- C:\Users\Computer\Desktop\kaiserschmarren-800x600.jpg
[2013.03.06 14:40:26 | 000,152,161 | ---- | M] () -- C:\Users\Computer\Desktop\CordonBleuMitPommesUndSalat8-1024x737.jpg
[2013.03.03 23:49:01 | 000,044,832 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 11.03.2013.pdf
[2013.03.03 23:48:54 | 000,011,958 | ---- | M] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 11.03.2013.odt
[2013.02.26 10:49:14 | 000,034,135 | ---- | M] () -- D:\Users\Computer\Documents\Seffner Menü Konfirmation 28.04.2013.pdf
[2013.02.26 10:49:06 | 000,013,269 | ---- | M] () -- D:\Users\Computer\Documents\Seffner Menü Konfirmation 28.04.2013.odt
[2013.02.25 20:54:32 | 000,001,568 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.03.27 12:53:43 | 000,377,856 | ---- | C] () -- C:\Users\Computer\Desktop\gmer_2.1.19155.exe
[2013.03.27 12:52:09 | 000,000,000 | ---- | C] () -- C:\Users\Computer\defogger_reenable
[2013.03.27 12:46:04 | 000,050,477 | ---- | C] () -- C:\Users\Computer\Desktop\Defogger.exe
[2013.03.27 12:10:50 | 000,000,070 | ---- | C] () -- C:\Users\Computer\AppData\Local\wsr27zt32.dll
[2013.03.27 12:10:27 | 000,311,679 | ---- | C] () -- C:\Users\Computer\AppData\Local\itvboird.exe
[2013.03.27 12:04:03 | 000,140,288 | ---- | C] () -- C:\Users\Computer\AppData\Local\emjxwtmf.exe
[2013.03.27 11:21:54 | 000,000,102 | -H-- | C] () -- D:\Users\Computer\Documents\.~lock.Ostermenü 2013.odt#
[2013.03.27 01:08:15 | 000,015,425 | ---- | C] () -- D:\Users\Computer\Documents\Ostermenü 2013.odt
[2013.03.26 18:53:44 | 000,013,603 | ---- | C] () -- D:\Users\Computer\Documents\Osterkarte.odt
[2013.03.26 18:41:23 | 000,370,519 | ---- | C] () -- C:\Users\Computer\Desktop\speisekarte_redline_frohe-ostern.jpg
[2013.03.26 13:38:37 | 139,214,848 | ---- | C] () -- C:\Users\Computer\Desktop\gparted-live-0.15.0-1-i486.iso
[2013.03.23 12:36:08 | 000,044,751 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 8.10.2012.pdf
[2013.03.23 12:36:08 | 000,044,112 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 26.11.2012.pdf
[2013.03.23 12:36:08 | 000,042,971 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 25.02.2013.pdf
[2013.03.23 12:36:08 | 000,042,363 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 28.01.2013.pdf
[2013.03.23 12:36:08 | 000,016,701 | ---- | C] () -- D:\Users\Computer\Documents\Willkommen.odt
[2013.03.23 12:36:08 | 000,016,406 | ---- | C] () -- D:\Users\Computer\Documents\ÖFFNUNGSZEITEN Weihnachten 2012.odt
[2013.03.23 12:36:08 | 000,014,784 | ---- | C] () -- D:\Users\Computer\Documents\ÖFFNUNGSZEITEN.odt
[2013.03.23 12:36:08 | 000,012,599 | ---- | C] () -- D:\Users\Computer\Documents\Unbenannt 1.odt
[2013.03.23 12:36:08 | 000,011,806 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 8.10.2012.odt
[2013.03.23 12:36:08 | 000,011,529 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 26.11.2012.odt
[2013.03.23 12:36:08 | 000,011,287 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 28.01.2013.odt
[2013.03.23 12:36:07 | 000,067,271 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom September 2012.pdf
[2013.03.23 12:36:07 | 000,046,082 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 1.10.2012.pdf
[2013.03.23 12:36:07 | 000,045,702 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 21.01.2013.pdf
[2013.03.23 12:36:07 | 000,045,452 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 22.10.2012.pdf
[2013.03.23 12:36:07 | 000,045,390 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 04.03.2013.pdf
[2013.03.23 12:36:07 | 000,045,084 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.03.2013.pdf
[2013.03.23 12:36:07 | 000,044,832 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 11.03.2013.pdf
[2013.03.23 12:36:07 | 000,044,668 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 15.10.2012.pdf
[2013.03.23 12:36:07 | 000,044,536 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 19.11.2012.pdf
[2013.03.23 12:36:07 | 000,044,471 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 07.01.2013.pdf
[2013.03.23 12:36:07 | 000,044,318 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 03.12.2012.pdf
[2013.03.23 12:36:07 | 000,044,271 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 15.01.2013.pdf
[2013.03.23 12:36:07 | 000,044,268 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 1211.2012.pdf
[2013.03.23 12:36:07 | 000,043,997 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 05.11.2012.pdf
[2013.03.23 12:36:07 | 000,043,945 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 08.04.2013.pdf
[2013.03.23 12:36:07 | 000,043,878 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 10.12.2012.pdf
[2013.03.23 12:36:07 | 000,043,855 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 12.11.2012.pdf
[2013.03.23 12:36:07 | 000,043,848 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 04.02.2013.pdf
[2013.03.23 12:36:07 | 000,042,981 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 17.12.2012.pdf
[2013.03.23 12:36:07 | 000,041,624 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.02.2013.pdf
[2013.03.23 12:36:07 | 000,026,455 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom September 2012.odt
[2013.03.23 12:36:07 | 000,020,350 | ---- | C] () -- D:\Users\Computer\Documents\Test IQ.odt
[2013.03.23 12:36:07 | 000,017,824 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom November 2011.odt
[2013.03.23 12:36:07 | 000,012,798 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 1.10.2012.odt
[2013.03.23 12:36:07 | 000,012,596 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 22.10.2012.odt
[2013.03.23 12:36:07 | 000,012,447 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 21.01.2013.odt
[2013.03.23 12:36:07 | 000,012,264 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 04.03.2013.odt
[2013.03.23 12:36:07 | 000,012,199 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 15.01.2013.odt
[2013.03.23 12:36:07 | 000,012,173 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 15.10.2012.odt
[2013.03.23 12:36:07 | 000,012,065 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.03.2013.odt
[2013.03.23 12:36:07 | 000,011,958 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 11.03.2013.odt
[2013.03.23 12:36:07 | 000,011,917 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 10.12.2012.odt
[2013.03.23 12:36:07 | 000,011,860 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 04.02.2013.odt
[2013.03.23 12:36:07 | 000,011,742 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 12.11.2012.odt
[2013.03.23 12:36:07 | 000,011,671 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 19.11.2012.odt
[2013.03.23 12:36:07 | 000,011,654 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 1211.2012.odt
[2013.03.23 12:36:07 | 000,011,637 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 08.04.2013.odt
[2013.03.23 12:36:07 | 000,011,595 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 05.11.2012.odt
[2013.03.23 12:36:07 | 000,011,577 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 17.12.2012.odt
[2013.03.23 12:36:07 | 000,011,531 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 03.12.2012.odt
[2013.03.23 12:36:07 | 000,011,500 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 07.01.2013.odt
[2013.03.23 12:36:07 | 000,011,465 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 25.02.2013.odt
[2013.03.23 12:36:07 | 000,011,256 | ---- | C] () -- D:\Users\Computer\Documents\Uhlandschule Speiseplan 18.02.2013.odt
[2013.03.23 12:36:06 | 002,453,593 | -H-- | C] () -- D:\Users\Computer\Documents\PP11Thumbs.ptn
[2013.03.23 12:36:06 | 000,362,127 | ---- | C] () -- D:\Users\Computer\Documents\Mustervertrag-tippgemeinschaften_01.01.pdf
[2013.03.23 12:36:06 | 000,362,092 | ---- | C] () -- D:\Users\Computer\Documents\Mustervertrag-tippgemeinschaften_01.01 (2).pdf
[2013.03.23 12:36:06 | 000,100,782 | ---- | C] () -- D:\Users\Computer\Documents\Schnitzel-Mittagskarte vom 30.01.2012.pdf
[2013.03.23 12:36:06 | 000,067,271 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte Schützenhaus vom September 2012.pdf
[2013.03.23 12:36:06 | 000,036,775 | ---- | C] () -- D:\Users\Computer\Documents\Rechnung2 Heinrich Schmid 10.12.2012.pdf
[2013.03.23 12:36:06 | 000,034,135 | ---- | C] () -- D:\Users\Computer\Documents\Seffner Menü Konfirmation 28.04.2013.pdf
[2013.03.23 12:36:06 | 000,034,015 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom Januar 2013.odt
[2013.03.23 12:36:06 | 000,032,224 | ---- | C] () -- D:\Users\Computer\Documents\Schnitzel-Mittagskarte vom 30.01.2012.odt
[2013.03.23 12:36:06 | 000,026,091 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte Schützenhaus vom September 2012.odt
[2013.03.23 12:36:06 | 000,023,236 | ---- | C] () -- D:\Users\Computer\Documents\quiz 3.odt
[2013.03.23 12:36:06 | 000,023,092 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte Schützenhaus Sondelingen.odt
[2013.03.23 12:36:06 | 000,022,879 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte klein für Veranstaltungen.pdf
[2013.03.23 12:36:06 | 000,022,789 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom August 2012.odt
[2013.03.23 12:36:06 | 000,019,842 | ---- | C] () -- D:\Users\Computer\Documents\Schreiben mauz.odt
[2013.03.23 12:36:06 | 000,019,617 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte klein für Veranstaltungen2.pdf
[2013.03.23 12:36:06 | 000,019,311 | ---- | C] () -- D:\Users\Computer\Documents\quiz 1.odt
[2013.03.23 12:36:06 | 000,018,896 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte Sonntag, verkaufsoffener Sonntag kleine Karte.odt
[2013.03.23 12:36:06 | 000,016,824 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte vom Dezember 2011.odt
[2013.03.23 12:36:06 | 000,016,436 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte klein für Veranstaltungen.odt
[2013.03.23 12:36:06 | 000,016,219 | ---- | C] () -- D:\Users\Computer\Documents\quiz 2.odt
[2013.03.23 12:36:06 | 000,015,969 | ---- | C] () -- D:\Users\Computer\Documents\Schokoladenquiz.odt
[2013.03.23 12:36:06 | 000,015,690 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte klein für Veranstaltungen3.odt
[2013.03.23 12:36:06 | 000,015,342 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 30.04.2012.pdf
[2013.03.23 12:36:06 | 000,015,289 | ---- | C] () -- D:\Users\Computer\Documents\Monatskarte Januar 2013.odt
[2013.03.23 12:36:06 | 000,015,258 | ---- | C] () -- D:\Users\Computer\Documents\Rechnung Waschl 18.10.12.odt
[2013.03.23 12:36:06 | 000,015,252 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 28.11.2011.odt
[2013.03.23 12:36:06 | 000,015,190 | ---- | C] () -- D:\Users\Computer\Documents\RA Weng Steegmaier.odt
[2013.03.23 12:36:06 | 000,015,161 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 30.04.2012.odt
[2013.03.23 12:36:06 | 000,015,108 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 28.11.2011.pdf
[2013.03.23 12:36:06 | 000,014,816 | ---- | C] () -- D:\Users\Computer\Documents\Rechnung Fa. Blümchen.odt
[2013.03.23 12:36:06 | 000,014,629 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte vom 20.Mai 2012.pdf
[2013.03.23 12:36:06 | 000,014,589 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte15.05.2012.pdf
[2013.03.23 12:36:06 | 000,014,409 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte vom 20.Mai 2012.odt
[2013.03.23 12:36:06 | 000,014,348 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte15.05.2012.odt
[2013.03.23 12:36:06 | 000,013,642 | ---- | C] () -- D:\Users\Computer\Documents\Rechnung2 Heinrich Schmid 10.12.2012.odt
[2013.03.23 12:36:06 | 000,013,549 | ---- | C] () -- D:\Users\Computer\Documents\Speisekarte klein für Veranstaltungen2.odt
[2013.03.23 12:36:06 | 000,013,377 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 28.02.2012.odt
[2013.03.23 12:36:06 | 000,013,372 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 27.12.11.pdf
[2013.03.23 12:36:06 | 000,013,269 | ---- | C] () -- D:\Users\Computer\Documents\Seffner Menü Konfirmation 28.04.2013.odt
[2013.03.23 12:36:06 | 000,012,617 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 28.02.2012.pdf
[2013.03.23 12:36:06 | 000,012,546 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 27.12.11.odt
[2013.03.23 12:36:06 | 000,011,542 | ---- | C] () -- D:\Users\Computer\Documents\Sky Karte Rücksendung.odt
[2013.03.23 12:36:06 | 000,011,506 | ---- | C] () -- D:\Users\Computer\Documents\Sky Reciever Rücksendung.odt
[2013.03.23 12:36:06 | 000,002,028 | -H-- | C] () -- D:\Users\Computer\Documents\PP11Thumbs.ptn2
[2013.03.23 12:36:06 | 000,000,000 | ---- | C] () -- D:\Users\Computer\Documents\Nuance Image Printer Writer Port
[2013.03.23 12:36:05 | 000,062,233 | ---- | C] () -- D:\Users\Computer\Documents\Lebenslauf 01Peter Eißler.pdf
[2013.03.23 12:36:05 | 000,048,326 | ---- | C] () -- D:\Users\Computer\Documents\Getränkekarte Sep 20012.pdf
[2013.03.23 12:36:05 | 000,028,571 | ---- | C] () -- D:\Users\Computer\Documents\Kleine Speisekarte Dezember.pdf
[2013.03.23 12:36:05 | 000,027,847 | ---- | C] () -- D:\Users\Computer\Documents\Kalkulation Schützenhaus.ods
[2013.03.23 12:36:05 | 000,017,089 | ---- | C] () -- D:\Users\Computer\Documents\Italienisches Buffet 1.odt
[2013.03.23 12:36:05 | 000,016,709 | ---- | C] () -- D:\Users\Computer\Documents\Kündigung Wohnung.odt
[2013.03.23 12:36:05 | 000,016,691 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 19.032012.odt
[2013.03.23 12:36:05 | 000,016,597 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 02.04.2012.odt
[2013.03.23 12:36:05 | 000,016,506 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 12.03.2012.odt
[2013.03.23 12:36:05 | 000,016,478 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 23.04.2012.odt
[2013.03.23 12:36:05 | 000,016,362 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 26.03.2012.odt
[2013.03.23 12:36:05 | 000,016,316 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 16.04.2012.pdf
[2013.03.23 12:36:05 | 000,016,239 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 16.04.2012.odt
[2013.03.23 12:36:05 | 000,016,176 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 23.04.2012.pdf
[2013.03.23 12:36:05 | 000,016,114 | ---- | C] () -- D:\Users\Computer\Documents\Kleine Speisekarte Dezember.odt
[2013.03.23 12:36:05 | 000,016,046 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 02.04.2012.pdf
[2013.03.23 12:36:05 | 000,015,976 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 10.04.2012.odt
[2013.03.23 12:36:05 | 000,015,854 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 14.02.2012.odt
[2013.03.23 12:36:05 | 000,015,598 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 05.03.2012.odt
[2013.03.23 12:36:05 | 000,015,221 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 19.032012.pdf
[2013.03.23 12:36:05 | 000,015,158 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 09.01.2012.odt
[2013.03.23 12:36:05 | 000,015,139 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 23.01.2012.odt
[2013.03.23 12:36:05 | 000,015,111 | ---- | C] () -- D:\Users\Computer\Documents\Kündigung Telekom Falken 30.07.2012.odt
[2013.03.23 12:36:05 | 000,015,032 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 06.05.2012.odt
[2013.03.23 12:36:05 | 000,014,885 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 16.01.2011.odt
[2013.03.23 12:36:05 | 000,014,664 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 07.02.2012.pdf
[2013.03.23 12:36:05 | 000,014,655 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 14.02.2012.pdf
[2013.03.23 12:36:05 | 000,014,631 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 16.01.2011.pdf
[2013.03.23 12:36:05 | 000,014,469 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 12.12.2011.pdf
[2013.03.23 12:36:05 | 000,014,463 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 05.12.2011.pdf
[2013.03.23 12:36:05 | 000,014,433 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 26.03.2012.pdf
[2013.03.23 12:36:05 | 000,014,430 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 21.11.2011.pdf
[2013.03.23 12:36:05 | 000,014,419 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 21.11.2011.odt
[2013.03.23 12:36:05 | 000,014,389 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 19.12.11.odt
[2013.03.23 12:36:05 | 000,014,349 | ---- | C] () -- D:\Users\Computer\Documents\Gläubigerliste April 2012.odt
[2013.03.23 12:36:05 | 000,014,336 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 10.04.2012.pdf
[2013.03.23 12:36:05 | 000,014,256 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 03.01.2012.odt
[2013.03.23 12:36:05 | 000,014,243 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 16.01.2012.pdf
[2013.03.23 12:36:05 | 000,014,191 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 09.01.2012.pdf
[2013.03.23 12:36:05 | 000,014,027 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 23.01.2012.pdf
[2013.03.23 12:36:05 | 000,013,973 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 07.02.2012.odt
[2013.03.23 12:36:05 | 000,013,912 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 05.12.2011.odt
[2013.03.23 12:36:05 | 000,013,875 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 12.03.2012.pdf
[2013.03.23 12:36:05 | 000,013,657 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 19.12.11.pdf
[2013.03.23 12:36:05 | 000,013,609 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 12.12.2011.odt
[2013.03.23 12:36:05 | 000,013,434 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 06.05.2012.pdf
[2013.03.23 12:36:05 | 000,013,251 | ---- | C] () -- D:\Users\Computer\Documents\Mittagskarte 05.03.2012.pdf
[2013.03.23 12:36:05 | 000,012,728 | ---- | C] () -- D:\Users\Computer\Documents\Kindergeldkasse 18.6.2012.odt
[2013.03.23 12:36:05 | 000,012,704 | ---- | C] () -- D:\Users\Computer\Documents\Gutschein Schützenhaus.odt
[2013.03.23 12:36:05 | 000,012,047 | ---- | C] () -- D:\Users\Computer\Documents\Kündigung Peter.odt
[2013.03.23 12:36:05 | 000,005,931 | -H-- | C] () -- D:\Users\Computer\Documents\maxdesk.ini2
[2013.03.23 12:36:04 | 000,056,490 | ---- | C] () -- D:\Users\Computer\Documents\Anschreiben Peter Eißler2.pdf
[2013.03.23 12:36:04 | 000,055,631 | ---- | C] () -- D:\Users\Computer\Documents\Anschreiben Peter Eißler2 Zielmann.pdf
[2013.03.23 12:36:04 | 000,048,326 | ---- | C] () -- D:\Users\Computer\Documents\Getränkekarte Schützenhaus Sep 20012.pdf
[2013.03.23 12:36:04 | 000,041,964 | ---- | C] () -- D:\Users\Computer\Documents\Geschichte des Hauses.pdf
[2013.03.23 12:36:04 | 000,027,124 | ---- | C] () -- D:\Users\Computer\Documents\Aktion Schützenhaus.pdf
[2013.03.23 12:36:04 | 000,025,265 | ---- | C] () -- D:\Users\Computer\Documents\Geschichte des Hauses.odt
[2013.03.23 12:36:04 | 000,019,020 | ---- | C] () -- D:\Users\Computer\Documents\Auszug aus der Speisekarte.odt
[2013.03.23 12:36:04 | 000,017,205 | ---- | C] () -- D:\Users\Computer\Documents\Anfrage Valentina Spiekeroog.odt
[2013.03.23 12:36:04 | 000,015,638 | ---- | C] () -- D:\Users\Computer\Documents\Getränkekarte Sep 20012.odt
[2013.03.23 12:36:04 | 000,015,618 | ---- | C] () -- D:\Users\Computer\Documents\Getränkekarte Schützenhaus Sep 20012.odt
[2013.03.23 12:36:04 | 000,015,554 | ---- | C] () -- D:\Users\Computer\Documents\adventskarte.odt
[2013.03.23 12:36:04 | 000,015,518 | ---- | C] () -- D:\Users\Computer\Documents\Aktion Schützenhaus.odt
[2013.03.23 12:36:04 | 000,010,870 | ---- | C] () -- D:\Users\Computer\Documents\Entschuldigung Schule.odt
[2013.03.23 12:34:34 | 000,001,051 | ---- | C] () -- C:\Users\Computer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013.03.23 11:18:36 | 789,884,928 | ---- | C] () -- C:\Users\Computer\Desktop\ubuntu-12.10-desktop-i386.iso
[2013.03.23 11:17:06 | 725,921,792 | ---- | C] () -- C:\Users\Computer\Desktop\ubuntu-12.04.2-alternate-i386.iso
[2013.03.22 03:03:26 | 000,025,185 | ---- | C] () -- C:\Windows\SysWow64\ieuinit.inf
[2013.03.22 03:03:26 | 000,025,185 | ---- | C] () -- C:\Windows\SysNative\ieuinit.inf
[2013.03.20 14:37:18 | 000,083,315 | ---- | C] () -- C:\Users\Computer\Desktop\47177KA(2).pdf
[2013.03.16 11:13:18 | 001,410,338 | ---- | C] () -- C:\Users\Computer\Desktop\Terrasse Schützenhaus 2 001.jpg
[2013.03.16 11:12:28 | 001,347,512 | ---- | C] () -- C:\Users\Computer\Desktop\Terrasse Schützenhaus 001.jpg
[2013.03.15 10:52:10 | 000,015,653 | ---- | C] () -- C:\Users\Computer\Desktop\Haus.odt
[2013.03.13 10:34:13 | 000,002,307 | ---- | C] () -- C:\Users\Computer\Desktop\Dokument oder Bild scannen - Verknüpfung.lnk
[2013.03.08 15:04:15 | 002,977,254 | ---- | C] () -- C:\Users\Computer\Desktop\TG_Produktmappe_022013_DE.pdf
[2013.03.06 14:47:24 | 000,105,668 | ---- | C] () -- C:\Users\Computer\Desktop\kaiserschmarren-800x600.jpg
[2013.03.06 14:40:25 | 000,152,161 | ---- | C] () -- C:\Users\Computer\Desktop\CordonBleuMitPommesUndSalat8-1024x737.jpg
[2013.01.07 21:08:00 | 000,000,009 | ---- | C] () -- \END
[2012.09.14 09:32:16 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2012.09.14 09:32:16 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2012.07.14 08:51:36 | 000,007,602 | ---- | C] () -- C:\Users\Computer\AppData\Local\Resmon.ResmonCfg
[2012.06.15 11:44:50 | 000,101,480 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.11.27 18:38:13 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2011.11.27 18:38:11 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.11.05 18:02:49 | 3220,627,456 | -HS- | C] () -- \hiberfil.sys
[2011.11.05 11:14:34 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2011.11.05 11:14:34 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
========== Purity Check ==========
< End of report >
--- --- --- Hie ist noch die Extras.txt Datei:OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 27.03.2013 12:54:50 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Computer\Downloads
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16521)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,84% Memory free
8,00 Gb Paging File | 6,33 Gb Available in Paging File | 79,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 75,14 Gb Total Space | 21,52 Gb Free Space | 28,64% Space Free | Partition Type: NTFS
Drive D: | 390,53 Gb Total Space | 284,51 Gb Free Space | 72,85% Space Free | Partition Type: NTFS
Drive E: | 5,48 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: FLUR-PC | User Name: Computer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{13FB629D-AB1E-4C7D-AF54-35F9F021A865}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{1A057B44-23CB-4E35-A77F-FFB8638F403C}" = lport=56478 | protocol=6 | dir=in | name=pando media booster |
"{204A610E-2713-45C8-9B2E-7EF5DEEDCB0F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{32654815-87CD-48FE-9332-59D3D8475258}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{36B987D3-EB90-49F9-8945-41F4170CCA6E}" = lport=137 | protocol=17 | dir=in | app=system |
"{3A07E48F-685E-4527-A4C0-E3414556013B}" = lport=58527 | protocol=6 | dir=in | name=pando media booster |
"{3E95FE76-B520-46E0-9AC7-A906E8B6F730}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{4B15D37E-AF1F-45EE-8D63-DD1D146A504B}" = rport=139 | protocol=6 | dir=out | app=system |
"{5071B5DE-5DB3-47E0-804E-249EC53D7CF1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{51A6CE2D-BCEC-4A4B-BA79-F801A51082E7}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{565A97E2-DD05-4CF5-B1DD-0EA1838C5F4F}" = lport=58527 | protocol=17 | dir=in | name=pando media booster |
"{56CAE154-0A20-4FBA-BEBC-C3012E3EC701}" = lport=58527 | protocol=17 | dir=in | name=pando media booster |
"{5F125634-9A9C-4034-8290-CE6D841222C8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{8F554663-AAAA-4CDF-B654-F39E69FCFAFD}" = lport=56478 | protocol=17 | dir=in | name=pando media booster |
"{90512C0A-9333-470D-A9E3-BBAE516BFC90}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9FE47F50-1266-4A7F-9F1E-74E04855EEFC}" = lport=58527 | protocol=6 | dir=in | name=pando media booster |
"{A0B6AB0C-FACE-453D-AE48-7C1B68A47D2E}" = rport=138 | protocol=17 | dir=out | app=system |
"{A213485E-1998-404E-91EB-81ACE7A9D66D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{ABD8E971-E29F-426F-9BF3-FB7E5A7B08A8}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AF7FC683-2A6C-437D-93DA-0F975F0F9F0C}" = lport=56478 | protocol=17 | dir=in | name=pando media booster |
"{B7EB541B-8580-4667-B4EB-A6D6177ED468}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B7FFDF5F-0878-414D-A2BC-5007789D0E65}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{BA5924C9-C141-4033-B473-9616D7429524}" = lport=56478 | protocol=6 | dir=in | name=pando media booster |
"{BB09A25B-873A-40ED-821C-83BD39201792}" = rport=137 | protocol=17 | dir=out | app=system |
"{D8C02A5B-0164-4C6A-A1D5-47FAAB1F57C9}" = lport=139 | protocol=6 | dir=in | app=system |
"{D986E146-0C72-4C95-B873-AC4E022E1D3A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DFCA0A25-08D1-40AB-9022-745DC0FAC912}" = lport=138 | protocol=17 | dir=in | app=system |
"{F4C7C5DB-BDFA-46F7-BE64-9598F045A32C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FC13044C-FB73-49EB-92B1-262DF17B8B4E}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FE4E1B16-98DA-4F54-855D-488D6C6DA805}" = lport=445 | protocol=6 | dir=in | app=system |
"{FF4F9E30-82CB-46EB-8477-11ADC9448C1D}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04402920-33D1-4C55-83AA-DCC2D5434F22}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{08DEA336-676D-4ACC-929A-C8EDBBAA00DC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0E8CA354-01E0-4BE5-96CA-FA5B632D1C90}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{198B2664-9879-4AD5-A2B5-EBF251E456B1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1B7EF7F7-3C56-4F84-81E4-AD1748943F14}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{1BAB30DE-C9C4-4BE3-85F5-8CF990B9555D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{25871E0F-2741-4F97-B4B9-78EDE16C6C37}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{2590FA00-BB67-427B-B547-2D3DCF33C82E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{29D8E2A7-CE3F-45A2-8E7F-3D44119825C1}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{2C229687-E825-4C33-9354-FA55B4613DCB}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{32A84360-2D3A-4E15-BE6F-81CDA45EACCF}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{33831850-6F32-48C4-99F4-8E1769E18258}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{37EFD2E7-4C2A-4D68-92EA-ED76DB3FA009}" = protocol=6 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{37FA2982-9628-4822-A25B-DC240A19A7A7}" = dir=in | app=d:\program files (x86)\itunes\itunes.exe |
"{3E8AC467-223D-4168-A248-2DC8F3F5555B}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{41A5C2E2-5355-48DB-9278-1A7EDB41906E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4D997F6A-1E3C-49DB-8990-237935523B7C}" = protocol=6 | dir=in | app=c:\users\computer\appdata\roaming\dropbox\bin\dropbox.exe |
"{5726E94F-DAFB-4366-98A1-EC82E6660972}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{60856E1E-EA30-4DF9-AF29-AE77B481B2FA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{62D27AB6-9BF5-4419-A100-8A6C5A87C3AF}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{6F902EB2-BA33-4B03-B197-4ECCF79A6193}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{70147C8A-DD35-4773-8A54-C483DE796D12}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7B1E3FEE-916E-4B02-BE5C-48401C1B7832}" = protocol=17 | dir=in | app=d:\program files (x86)\electronic arts\battlefield 3\battlefield 3\bf3.exe |
"{8C66C05A-F607-4A45-BB3F-86C9F45E2292}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{8C7B04CE-31E1-4F5F-8CEC-BF5A73BF9C46}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8D4BBFC4-6752-47C1-86E6-CFBF23B0E0D0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9452A512-CE05-4E95-A1B1-D34BFA00D888}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{94FA1872-2029-4214-9DBE-B05DEA5205A9}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{A52B5429-7F85-4367-90CB-39874C095CCE}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{AA1F962A-FCB8-4E42-B413-AB47D9D368B9}" = protocol=17 | dir=in | app=c:\users\computer\appdata\roaming\dropbox\bin\dropbox.exe |
"{AAB1F9B0-F20B-45D5-897C-8DF7E19E20B6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B2F5C2CA-9794-46B8-8338-29680BD7C84C}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{B5FC21F9-3145-4E84-9A53-23882090C3D0}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B8F18490-8D0E-4463-B03F-BE66D0C7068A}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{C3B4C931-56C6-49C5-AA07-F37BFBB72CA8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C5D8A88F-25B5-4D26-9F0D-C47FE7FE930D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C913E743-384F-4AD5-8449-66E34411EDEE}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{D0DFEB91-5A3C-49C0-9B38-81FD45D40875}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{D118D62C-C479-414C-B87C-0A527848019C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{D51766D3-A239-49D7-86BB-3080D8C07041}" = protocol=17 | dir=in | app=c:\program files (x86)\search results toolbar\datamngr\srtool~1\dtuser.exe |
"{D8149020-7012-4B38-B1FD-75E1178E27A5}" = protocol=6 | dir=in | app=d:\program files (x86)\electronic arts\battlefield 3\battlefield 3\bf3.exe |
"{E9C2F2C5-57D1-42E5-ABF2-AEC227147F74}" = protocol=6 | dir=in | app=c:\users\computer\appdata\roaming\dropbox\bin\dropbox.exe |
"{EB50537B-169B-48C6-817B-680582E44E16}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F333ACDF-23AA-4E7D-9A29-09FC9D5C14FD}" = protocol=6 | dir=out | app=system |
"{F588CA32-067A-416B-A422-73612B547E68}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FBAC646F-3AAB-4441-B3B5-02EADCE17761}" = protocol=17 | dir=in | app=c:\users\computer\appdata\roaming\dropbox\bin\dropbox.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}" = PaperPort Image Printer 64-bit
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9B2C4509-2B9F-4303-BA74-E2F9BB773F03}" = Oracle VM VirtualBox 4.1.8
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.97
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 285.62
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.0621
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"CCleaner" = CCleaner
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{137D91E1-2347-4EAC-BB0B-CC06C6B92A52}_is1" = Men of War (Remove Only)
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{28656860-4728-433C-8AD4-D1A930437BC8}" = Nuance PDF Viewer Plus
"{34B32B70-8081-11E2-89AF-B8AC6F98CCE3}" = Google Earth Plug-in
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}" = Nuance PaperPort 12
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7F6D7FD9-648D-4DD9-BB6E-3990C675ECA4}" = NVIDIA PhysX
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver For Windows 7
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.6) - Deutsch
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = Die Sims™ 3 Reiseabenteuer
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"1&1 Mail & Media GmbH 1und1Softwareaktualisierung" = GMX Softwareaktualisierung
"1&1 Mail & Media GmbH Toolbar FF" = GMX MailCheck für Mozilla Firefox
"32 Vegas Casino" = 21Nova Casino
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira Antivirus Premium
"Battlelog Web Plugins" = Battlelog Web Plugins
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"ESN Sonar-0.70.4" = ESN Sonar
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.37.1212
"Google Chrome" = Google Chrome
"ilividtoolbargaw" = Search-Results Toolbar
"Mozilla Firefox 19.0.2 (x86 de)" = Mozilla Firefox 19.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"ShotOnline" = ShotOnline
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"Dropbox" = Dropbox
"UnityWebPlayer" = Unity Web Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 9002
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 3029
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 3029
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 3028
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 3058
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 7010
Description =
Error - 27.03.2013 03:13:39 | Computer Name = Flur-PC | Source = Windows Search Service | ID = 7042
Description =
Error - 27.03.2013 07:04:34 | Computer Name = Flur-PC | Source = MsiInstaller | ID = 1002
Description =
Error - 27.03.2013 07:25:10 | Computer Name = Flur-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: GUARDGUI.EXE, Version: 13.6.1.986,
Zeitstempel: 0x5138c1d5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0003464a ID des fehlerhaften
Prozesses: 0x153c Startzeit der fehlerhaften Anwendung: 0x01ce2addb603f864 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Avira\AntiVir Desktop\GUARDGUI.EXE
Pfad
des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: fbb0a54b-96d0-11e2-af1a-002522c2a162
Error - 27.03.2013 07:25:20 | Computer Name = Flur-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: GUARDGUI.EXE, Version: 13.6.1.986,
Zeitstempel: 0x5138c1d5 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b8f Ausnahmecode: 0xc0000005 Fehleroffset: 0x0003464a ID des fehlerhaften
Prozesses: 0x1524 Startzeit der fehlerhaften Anwendung: 0x01ce2addb5fd4d59 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Avira\AntiVir Desktop\GUARDGUI.EXE
Pfad
des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll Berichtskennung: 0169d81b-96d1-11e2-af1a-002522c2a162
[ System Events ]
Error - 27.03.2013 03:15:34 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
Error - 27.03.2013 07:10:39 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Adobe Flash Player Update Service" ist als interaktiver
Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive
Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:39 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Microsoft .NET Framework NGEN v2.0.50727_X86" ist als
interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass
interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig
funktionieren.
Error - 27.03.2013 07:10:40 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "COM+-Systemanwendung" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:40 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Creative ALchemy AL6 Licensing Service" ist als interaktiver
Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive
Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:41 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Creative Audio Engine Licensing Service" ist als interaktiver
Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive
Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:42 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Google Update-Dienst (gupdate)" ist als interaktiver Dienst
gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste
nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:42 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Google Update-Dienst (gupdatem)" ist als interaktiver
Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive
Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:43 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Google Software Updater" ist als interaktiver Dienst gekennzeichnet.
Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich
sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error - 27.03.2013 07:10:43 | Computer Name = Flur-PC | Source = Service Control Manager | ID = 7030
Description = Der Dienst "Mozilla Maintenance Service" ist als interaktiver Dienst
gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste
nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
< End of report >
|
| Themen zu w32/Infector Virus! |
| antivir, antwort, bandoo, befindet, board, datei, dauert, deutsche, deutsche post, e-mail, folge, folgendes, gmer, infector, install.exe, launch, leute, melde, meldet, msiinstaller, namen, nicht mehr, nicht möglich, ntdll.dll, origin, pando media booster, plug-in, problem, programm, scan, search results toolbar, sekunden, troja, trojaner, trojaner board, vater, virtualbox, virus, w32 virus |
Baum-Darstellung