Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Plagegeister aller Art und deren Bekämpfung: Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 30.08.2010, 12:54   #1
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Hallo,

ich habe mir gestern einen Virus/Malware/whatever eingefangen. Seit dem öffnete sich alle paar Minuten ein Fenster mit "Windows Security Alert-Windows has detected an Internet attack attempt...Somebody's trying to infect your PC with spyware or harmful viruses. Run full system scan now to protect your PC from Internet attacks, hijacking attempts and spyware!" Weiterhin konnte ich kein einziges Programm mehr öffnen, da mir der "angebliche" Virenscanner bei jedem Programm mitteilte, dass dieses Programm doch schädlich für meinen Computer sei.

In den Taskmanager wurde ich auch nicht mehr gelassen und ins "Internet" kam ich auch nicht mehr, da der "Virus" mir in jedem Browser mitteilte, dass Seite xy nicht sicher wäre und ich mein System scannen lassen sollte.

Auch der Systemscan mit AntiVir im abgesicherten Modus brachte keinen Erfolg, da AntiVir nichts gefunden hat. Immerhin konnte ich im abgesicherten Modus eine Datei mit dem Namen "Mediafix70700en2.exe" finden, welche zumindest mit verantwortlich war für das öffnen des oben genannten Fensters. Nach dem löschen der Datei startete ich den Computer neu in der Hoffnung wieder "normal" arbeiten zu können und dem Virus genauer auf den Grund zu gehen - falsch gedacht. Nun konnte ich gar nichts mehr machen. Nach Systemstart kam die Meldung "explorer.exe" hat einen Fehler festgestellt und muss beendet werden. Das einzigste was ich noch sehen konnte, waren die PopUps die mir mitteilten, dass mein PC infizierst sei und ich einen Virenscanner kaufen sollte.

Heute habe ich mittels Systemwiederherstellung mein System auf einen früheren Zeitpunkt zurückgesetzt und es "läuft" wieder, allerdings denke ich, dass mein System nach wie vor verseucht ist . Nach Anleitung von diesem Thread habe ich nun Malwarebytes und OTL laufen lassen, sowie HijackThis:

Meine Frage nun, kann mir jemand helfen mein System zu "putzen"?

Bereits jetzt schon vielen lieben Dank.

Hier der Malwarebytes Bericht:
Zitat:
Datenbank Version: 4505

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30.08.2010 13:03:31
mbam-log-2010-08-30 (13-03-31).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 136397
Laufzeit: 5 Minute(n), 28 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 6

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\SlysBitch (Bifrose.Trace) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windefence (Bifrose.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\windefence (Bifrose.Trace) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\Windows\System32\WinDefence (Bifrose.Trace) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Users\David\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-3292708223-3298073484-1682841094-1000\$ROO90YV.exe (Adware.Casino) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sysrda32.exe (Heuristics.Shuriken) -> Quarantined and deleted successfully.
C:\Users\David\AppData\Roaming\logs.dat (Bifrose.Trace) -> Quarantined and deleted successfully.
C:\Program Files (x86)\HUADRV.DLL (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Program Files (x86)\MarkFunDrv.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
Hier die OTL Berichte:
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 30.08.2010 13:36:04 - Run 1
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\David\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): c:\pagefile.sys 6142 6142 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,55 Gb Total Space | 13,42 Gb Free Space | 18,00% Space Free | Partition Type: NTFS
Drive D: | 436,46 Gb Total Space | 41,34 Gb Free Space | 9,47% Space Free | Partition Type: NTFS
Drive E: | 465,63 Gb Total Space | 36,46 Gb Free Space | 7,83% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 29,30 Gb Total Space | 25,84 Gb Free Space | 88,21% Space Free | Partition Type: NTFS
Drive H: | 3,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
I: Drive not present or media not loaded
 
Computer Name: DAVID-PC
Current User Name: David
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe (Autodata Limited)
PRC - C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe (Dynamic Network Services, Inc.)
PRC - C:\Program Files (x86)\DynDNS Updater\DynTray.exe (Dynamic Network Services, Inc.)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe (FSL - Freesoftland)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe ()
PRC - C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe (Realtime Soft Ltd)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Programme\UltraMon\RTSUltraMonHookX32.dll (Realtime Soft Ltd)
MOD - C:\Programme\UltraMon\UltraMonResButtons.dll (Realtime Soft Ltd)
MOD - C:\Programme\Logitech\SetPoint\x86\GameHook.dll (Logitech, Inc.)
MOD - C:\Programme\Logitech\SetPoint\x86\lgscroll.dll (Logitech, Inc.)
MOD - C:\Windows\SysWOW64\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\srvcli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\slc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntshrui.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\linkinfo.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\msvcr80.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (MatSvc) -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (UmRdpService) -- C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) -- C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) -- C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Autodata Limited License Service) -- C:\Program Files (x86)\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe (Autodata Limited)
SRV - (DynDNS Updater) -- C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe (Dynamic Network Services, Inc.)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (nSvcIp) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (Lbd) -- C:\Windows\SysNative\DRIVERS\Lbd.sys File not found
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (FETNDIS) -- C:\Windows\SysNative\drivers\fet6x64.sys (VIA Technologies, Inc.              )
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Sentinel64) -- C:\Windows\SysNative\drivers\sentinel64.sys (SafeNet, Inc.)
DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.)
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0B BD 53 13 31 39 CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19
FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.6.6
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.1
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?sourceid=navclient&hl=de&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.08.08 12:50:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.26 14:30:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.07.27 01:04:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.06.19 01:40:29 | 000,000,000 | ---D | M]
 
[2010.06.11 20:53:02 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Extensions
[2010.01.07 19:24:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.08.30 12:57:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions
[2010.04.27 23:27:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.29 02:53:09 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.07.26 14:56:15 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010.08.02 22:02:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.02.13 00:23:33 | 000,000,000 | ---D | M] (Modify Headers) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}
[2010.08.18 07:57:57 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.02.14 03:17:20 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2010.02.12 02:58:57 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2010.08.27 22:08:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\foxyproxy@eric.h.jung
[2010.08.27 22:08:57 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\staged-xpis
[2010.08.30 12:57:40 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.01.22 19:33:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.22 19:33:56 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.22 19:33:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.22 19:33:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.22 19:33:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.09.24 18:43:43 | 000,001,327 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1       activate.adobe.com
O1 - Hosts: 127.0.0.1       practivate.adobe.com
O1 - Hosts: 127.0.0.1       ereg.adobe.com
O1 - Hosts: 127.0.0.1       activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1       wip3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1       ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1       activate-sea.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1       activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Core Temp] C:\Users\David\Desktop\CoreTemp\Core Temp.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] E:\Games\Steam\Steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\SysWOW64\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla\5.0_( File not found
O4 - Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IconRestorer.lnk = C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe (FSL - Freesoftland)
O4 - Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Touch Mouse Server.lnk = C:\Program Files (x86)\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung)
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx (Dldrv2 Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.12.21 17:53:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004.11.18 22:59:22 | 000,000,000 | R--D | M] - H:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:25:54 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:58:27 | 000,000,103 | R--- | M] () - H:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2004.11.14 16:08:54 | 000,929,792 | R--- | M] (Electronic Arts Inc.) - H:\AutoRunGUI.dll -- [ UDF ]
O33 - MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\Shell\AutoRun\command - "" = H:\setup.exe -- [2004.10.29 12:22:40 | 000,110,592 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\Shell - "" = AutoRun
O33 - MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\Shell\AutoRun\command - "" = I:\autorun.exe -- File not found
O33 - MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\Shell - "" = AutoRun
O33 - MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\Shell\AutoRun\command - "" = I:\Autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.08.30 13:30:15 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010.08.30 12:54:49 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Malwarebytes
[2010.08.30 12:54:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.08.30 12:54:39 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.08.30 12:54:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.08.30 12:54:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.30 12:54:21 | 006,153,648 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\David\Desktop\mbam-setup.exe
[2010.08.30 03:51:39 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\9AF58564C69101C30533F227825621A6
[2010.08.30 03:18:04 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Windows Server
[2010.08.29 17:09:50 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.08.28 23:06:06 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Meine empfangenen Dateien
[2010.08.25 17:54:40 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2010.08.20 23:12:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2010.08.18 07:29:46 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Games for Windows - LIVE Demos
[2010.08.13 23:16:35 | 000,000,000 | ---D | C] -- C:\Programme\BeatPack
[2010.08.13 21:28:34 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.08.13 21:28:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TweetDeck
[2010.08.13 00:10:41 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2010.08.13 00:10:40 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2010.08.13 00:10:39 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2010.08.13 00:10:29 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.08.13 00:10:29 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2010.08.13 00:10:29 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.08.13 00:10:29 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2010.08.13 00:10:29 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2010.08.13 00:10:29 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2010.08.13 00:10:25 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rtutils.dll
[2010.08.13 00:10:25 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rtutils.dll
[2010.08.13 00:10:24 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[2010.08.11 18:12:42 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\FileZilla
[2010.08.11 18:12:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client
[2010.08.09 21:41:46 | 000,000,000 | ---D | C] -- C:\ProgramData\id Software
[2010.08.09 19:31:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DynDNS Updater
[2010.08.09 19:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\DynDNS
[2010.08.08 02:00:03 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2010.08.07 17:32:11 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\NVIDIA
[2010.08.07 17:32:06 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\My Games
[2010.08.07 17:23:36 | 000,000,000 | ---D | C] -- C:\Windows\74224F8D4A1748169EDB7BB854DE532C.TMP
[2010.08.04 22:17:10 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\StarCraft II
[2010.08.02 23:15:49 | 000,000,000 | ---D | C] -- C:\Users\David\Local Settings
[2010.08.02 23:15:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mixxx
[2010.08.02 22:59:49 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Native Instruments
[2010.08.02 22:58:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\~2
[2010.08.02 22:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments
[2010.08.02 22:57:54 | 000,000,000 | -H-D | C] -- C:\ProgramData\~0
[2010.08.02 22:57:49 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Native Instruments
[2010.08.02 22:57:35 | 000,000,000 | -H-D | C] -- C:\ProgramData\~1
[2010.08.02 22:02:36 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.02 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2007.09.21 20:42:42 | 000,019,008 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\Program Files (x86)\markfun.a64
[2007.08.21 20:49:28 | 000,017,912 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Program Files (x86)\markfun.w32
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.08.30 13:36:02 | 003,670,016 | ---- | M] () -- C:\Users\David\ntuser.dat
[2010.08.30 13:30:19 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010.08.30 12:54:43 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.30 12:54:26 | 006,153,648 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\David\Desktop\mbam-setup.exe
[2010.08.30 12:53:03 | 000,363,520 | ---- | M] () -- C:\Users\David\Desktop\rkill.com
[2010.08.30 12:51:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3292708223-3298073484-1682841094-1000UA.job
[2010.08.30 12:50:59 | 000,010,288 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.30 12:50:59 | 000,010,288 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.30 12:45:52 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000002.regtrans-ms
[2010.08.30 12:45:52 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000001.regtrans-ms
[2010.08.30 12:45:52 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TM.blf
[2010.08.30 12:45:52 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.30 12:45:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.30 03:51:38 | 000,000,016 | ---- | M] () -- C:\Users\David\AppData\Roaming\hngmfc.dat
[2010.08.30 03:18:13 | 000,000,005 | ---- | M] () -- C:\zrpt.xml
[2010.08.29 21:49:23 | 000,014,766 | ---- | M] () -- C:\Users\David\Desktop\Microsoft Office Excel-Arbeitsblatt (neu).xlsx
[2010.08.29 18:03:13 | 000,000,036 | ---- | M] () -- C:\Users\David\AppData\Local\housecall.guid.cache
[2010.08.29 17:03:34 | 000,000,011 | R--- | M] () -- C:\Windows\amunres.lsl
[2010.08.29 15:31:17 | 000,000,394 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010.08.20 20:07:38 | 011,966,749 | ---- | M] () -- C:\Users\David\Desktop\08 - June (Extended).mp3
[2010.08.20 19:44:10 | 009,784,760 | ---- | M] () -- C:\Users\David\Desktop\Moonbootica_-_June.mp3
[2010.08.17 06:56:54 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.08.17 06:56:54 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.08.17 06:56:54 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.08.17 06:56:54 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.08.17 06:56:54 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.08.16 22:53:30 | 020,470,746 | ---- | M] () -- C:\Users\David\Desktop\945942_Death_By_House_Adam_Beyer___Jesper_Dahlback_Remix.mp3
[2010.08.16 22:51:00 | 018,153,378 | ---- | M] () -- C:\Users\David\Desktop\1242096_Oh_Yeah_Sander_Van_Doorn_Remix.mp3
[2010.08.16 22:51:00 | 010,851,949 | ---- | M] () -- C:\Users\David\Desktop\1320162_KNAS_Original_Mix.mp3
[2010.08.16 22:50:49 | 016,082,091 | ---- | M] () -- C:\Users\David\Desktop\945943_Death_By_House_A__Mochi_Remix.mp3
[2010.08.13 19:33:08 | 005,010,304 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.08.12 22:11:26 | 000,154,836 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.08.12 21:53:46 | 011,842,966 | ---- | M] () -- C:\Users\David\Desktop\1323465_Englishman_In_New_York_Club_Mix.mp3
[2010.08.10 08:51:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3292708223-3298073484-1682841094-1000Core.job
[2010.08.10 00:40:45 | 000,214,720 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010.08.10 00:40:45 | 000,214,720 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.08.09 21:41:47 | 000,075,064 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.08.09 21:41:46 | 002,373,712 | ---- | M] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.08.09 19:31:30 | 000,001,071 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DynDNS Updater Tray Icon.lnk
[2010.08.07 16:55:36 | 021,937,269 | ---- | M] () -- C:\Users\David\Desktop\Cires D - On Off.mp3
[2010.08.02 23:12:48 | 022,065,267 | ---- | M] () -- C:\Users\David\Desktop\Phunk Investigation - Acid Slider (Original Mix).mp3
[2010.08.02 22:05:34 | 008,448,128 | ---- | M] () -- C:\Users\David\Desktop\Schlachthofbronx - Isartaler (Ghettoschtzenremix).mp3
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.08.30 12:54:43 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.30 12:53:01 | 000,363,520 | ---- | C] () -- C:\Users\David\Desktop\rkill.com
[2010.08.30 12:45:52 | 000,524,288 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000002.regtrans-ms
[2010.08.30 12:45:52 | 000,524,288 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000001.regtrans-ms
[2010.08.30 12:45:52 | 000,065,536 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TM.blf
[2010.08.30 03:51:37 | 000,000,016 | ---- | C] () -- C:\Users\David\AppData\Roaming\hngmfc.dat
[2010.08.30 03:18:10 | 000,000,005 | ---- | C] () -- C:\zrpt.xml
[2010.08.29 18:03:13 | 000,000,036 | ---- | C] () -- C:\Users\David\AppData\Local\housecall.guid.cache
[2010.08.29 17:03:34 | 000,000,011 | R--- | C] () -- C:\Windows\amunres.lsl
[2010.08.28 13:11:19 | 000,000,394 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010.08.20 20:07:38 | 011,966,749 | ---- | C] () -- C:\Users\David\Desktop\08 - June (Extended).mp3
[2010.08.20 19:43:52 | 009,784,760 | ---- | C] () -- C:\Users\David\Desktop\Moonbootica_-_June.mp3
[2010.08.16 22:53:16 | 020,470,746 | ---- | C] () -- C:\Users\David\Desktop\945942_Death_By_House_Adam_Beyer___Jesper_Dahlback_Remix.mp3
[2010.08.16 22:50:40 | 010,851,949 | ---- | C] () -- C:\Users\David\Desktop\1320162_KNAS_Original_Mix.mp3
[2010.08.16 22:50:36 | 018,153,378 | ---- | C] () -- C:\Users\David\Desktop\1242096_Oh_Yeah_Sander_Van_Doorn_Remix.mp3
[2010.08.16 22:50:32 | 016,082,091 | ---- | C] () -- C:\Users\David\Desktop\945943_Death_By_House_A__Mochi_Remix.mp3
[2010.08.12 21:53:33 | 011,842,966 | ---- | C] () -- C:\Users\David\Desktop\1323465_Englishman_In_New_York_Club_Mix.mp3
[2010.08.09 21:41:46 | 002,373,712 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.08.09 19:31:30 | 000,001,071 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DynDNS Updater Tray Icon.lnk
[2010.08.07 16:54:51 | 021,937,269 | ---- | C] () -- C:\Users\David\Desktop\Cires D - On Off.mp3
[2010.08.02 23:12:36 | 022,065,267 | ---- | C] () -- C:\Users\David\Desktop\Phunk Investigation - Acid Slider (Original Mix).mp3
[2010.08.02 22:05:21 | 008,448,128 | ---- | C] () -- C:\Users\David\Desktop\Schlachthofbronx - Isartaler (Ghettoschtzenremix).mp3
[2010.04.02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.03.18 22:55:08 | 000,000,131 | ---- | C] () -- C:\Windows\basscad.ini
[2010.02.25 10:33:04 | 000,000,035 | ---- | C] () -- C:\Windows\Ulead32.INI
[2010.01.31 23:25:41 | 000,007,599 | ---- | C] () -- C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2009.12.22 17:21:40 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2009.12.18 00:01:37 | 000,000,000 | ---- | C] () -- C:\Windows\dbsetup.INI
[2009.12.18 00:01:35 | 000,000,122 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.12.17 09:34:50 | 000,000,071 | ---- | C] () -- C:\Windows\wiso.ini
[2009.11.09 07:54:17 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bko
[2009.11.08 23:26:50 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bk!
[2009.11.08 23:26:46 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bak
[2009.11.08 23:25:53 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.ini
[2009.11.08 23:18:38 | 000,000,062 | ---- | C] () -- C:\Windows\wininit.ini
[2009.11.04 22:53:08 | 000,524,288 | ---- | C] () -- C:\Program Files (x86)\6a61jg0a.0
[2009.11.04 22:52:12 | 000,088,441 | ---- | C] () -- C:\Program Files (x86)\bios.ini
[2009.11.04 22:51:47 | 000,000,029 | ---- | C] () -- C:\Program Files (x86)\new_ver.ini
[2009.09.24 08:29:48 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2008.02.14 15:28:56 | 000,000,029 | ---- | C] () -- C:\Program Files (x86)\version.ini
[2008.02.14 15:23:12 | 000,231,944 | ---- | C] () -- C:\Program Files (x86)\gwflash.exe
[2007.04.05 05:31:22 | 000,248,640 | ---- | C] () -- C:\Program Files (x86)\update.exe
[2007.04.04 19:35:36 | 000,207,680 | ---- | C] () -- C:\Program Files (x86)\updateutility.exe
[2007.03.30 05:36:28 | 000,000,301 | ---- | C] () -- C:\Program Files (x86)\update.ini
[2007.03.02 05:48:50 | 000,240,448 | ---- | C] () -- C:\Program Files (x86)\gwf32.exe
[2006.11.24 00:47:50 | 000,207,680 | ---- | C] () -- C:\Program Files (x86)\BIOS_Run.exe
[2006.11.03 19:09:40 | 000,000,528 | ---- | C] () -- C:\Program Files (x86)\CONFIG.INI
[2006.03.02 13:43:51 | 000,000,523 | ---- | C] () -- C:\Windows\pbl.ini
[2005.04.27 20:40:26 | 000,006,800 | ---- | C] () -- C:\Program Files (x86)\W95_HUA.vxd
[2000.05.26 11:28:00 | 000,016,183 | ---- | C] () -- C:\Windows\SysWow64\SELF32.INI
[1997.06.14 13:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
========== LOP Check ==========
 
[2010.08.30 03:51:39 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\9AF58564C69101C30533F227825621A6
[2010.04.10 15:27:53 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\AllDup
[2010.07.14 19:58:07 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Amazon
[2009.11.06 19:56:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Ashampoo
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ClonySoft
[2010.02.05 09:10:42 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Command and Conquer 4 Beta
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Lite
[2009.10.20 20:30:33 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Pro
[2010.08.02 22:02:36 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.30 03:02:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FileZilla
[2010.05.09 11:39:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FSL
[2010.02.20 20:52:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\GMX
[2010.08.29 14:06:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ICQ
[2010.02.03 17:45:12 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Leadertech
[2010.07.21 12:48:17 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\MAGIX
[2010.04.10 22:10:30 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ManyCam
[2010.08.09 23:07:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2010.02.05 07:57:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PiX-ART.com
[2009.10.19 10:23:32 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Sierra Entertainment
[2010.07.16 20:22:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.07 19:24:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Thunderbird
[2009.10.19 10:23:39 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TomTom
[2009.10.19 10:23:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TuneUp Software
[2010.08.13 21:28:34 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.08.07 23:06:51 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\uTorrent
[2009.11.08 18:32:28 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinDefence
[2010.08.29 15:31:17 | 000,000,394 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010.08.24 16:22:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2010.07.13 20:23:08 | 004,208,462 | ---- | M] ()(C:\Users\David\Desktop\Kym? Myles - Turn off the Lights.mp3) -- C:\Users\David\Desktop\Kym Myles - Turn off the Lights.mp3
[2010.07.13 20:19:33 | 004,208,462 | ---- | C] ()(C:\Users\David\Desktop\Kym? Myles - Turn off the Lights.mp3) -- C:\Users\David\Desktop\Kym Myles - Turn off the Lights.mp3
< End of report >
--- --- ---

OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 30.08.2010 13:36:04 - Run 1
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\David\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
10,00 Gb Paging File | 8,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): c:\pagefile.sys 6142 6142 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,55 Gb Total Space | 13,42 Gb Free Space | 18,00% Space Free | Partition Type: NTFS
Drive D: | 436,46 Gb Total Space | 41,34 Gb Free Space | 9,47% Space Free | Partition Type: NTFS
Drive E: | 465,63 Gb Total Space | 36,46 Gb Free Space | 7,83% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 29,30 Gb Total Space | 25,84 Gb Free Space | 88,21% Space Free | Partition Type: NTFS
Drive H: | 3,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
I: Drive not present or media not loaded
 
Computer Name: DAVID-PC
Current User Name: David
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{20A36691-B09B-4EF2-A371-64A5BD265E20}" = UltraMon
"{328CC232-CFDC-468B-A214-2E21300E4CB5}" = Apple Mobile Device Support
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{55E76113-3899-4A63-A308-71A9BD3491EE}" = MobileMe Control Panel
"{576A97E3-1A79-6215-49DE-AA358AF47420}" = ATI Catalyst Install Manager
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{8F790958-2107-48F2-88E0-B352A0C225AB}" = iTunes
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B7588D45-AFDC-4C93-9E2E-A100F3554B64}" = Microsoft Fix it Center
"{B91110FB-33B4-468B-90C2-4D5E8AE3FAE1}" = Bonjour
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F3F18612-7B5D-4C05-86C9-AB50F6F71727}" = KhalInstallWrapper
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{012048E1-BFFF-682E-8FA2-8325B2B16784}" = TweetDeck
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 18
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2BEB102E-F9CD-4881-984B-E288F66FD394}" = Quake Live Mozilla Plugin
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3F290582-3F4E-4B96-009C-E0BABAA40C42}" = Die Schlacht um Mittelerde(tm)
"{4394DC3A-5DAC-4C80-A86E-FF462D0AD653}" = Windows 7 Upgrade Advisor Beta
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{626B3D60-A661-4444-AAF5-6C75E55936E8}" = Adobe Creative Suite 5 Production Premium
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D8DDB4A-C263-40DE-BA16-AFDAD159D59A}" = Tom Clancy's Splinter Cell Conviction
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{8F5A0981-5CDC-41D0-BCA2-AD3B777FC358}" = Thrustmaster Force Feedback Driver
"{8FB1B528-E260-451E-9B55-E9152F94B80B}" = Microsoft Games for Windows - LIVE Redistributable
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{E64BA721-2310-4B55-BE5A-2925F9706192}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-7AD7-1031-7B44-A92000000001}" = Adobe Reader 9.2 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}" = @BIOS B07.0108.01
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"{F97E3841-CA9D-4964-9D64-26066241D26F}" = Microsoft Games for Windows - LIVE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Age of Empires 2.0" = Microsoft Age of Empires II
"Age of Empires II: The Conquerors Expansion 1.0" = Microsoft Age of Empires II: The Conquerors Expansion
"Ashampoo Burning Studio 2010_is1" = Ashampoo Burning Studio 2010
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BeatPack" = BeatPack (0.9)
"CCleaner" = CCleaner
"CDex" = CDex extraction audio
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DivX Setup.divx.com" = DivX-Setup
"DynDNSUpdater" = DynDNS Updater
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FileZilla Client" = FileZilla Client 3.3.3
"FL Studio 9" = FL Studio 9
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"GMX ProfiFax" = GMX ProfiFax
"GMX SMS-Manager" = GMX SMS-Manager
"IconRestorer Free_is1" = IconRestorer 1.0.6.2 SR1
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and Conquer(TM) Generäle Die Stunde Null 
"Logitech Touch Mouse Server" = Logitech Touch Mouse Server 1.0
"MAGIX Video deluxe 16 Download-Version D" = MAGIX Video deluxe 16 Download-Version 9.0.0.55 (D)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Mozilla Thunderbird (3.0.6)" = Mozilla Thunderbird (3.0.6)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"PokerStars" = PokerStars
"PunkBusterSvc" = PunkBuster Services
"RollerCoaster Tycoon Setup" = Roll
"Steam App 17520" = Synergy
"Steam App 220" = Half-Life 2
"Steam App 380" = Half-Life 2: Episode One
"SystemRequirementsLab" = System Requirements Lab
"TmNationsForever_is1" = TmNationsForever
"TuneUp Utilities" = TuneUp Utilities
"TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1" = TweetDeck
"Uninstall_is1" = Uninstall 1.0.0.1
"uTorrent" = µTorrent
"VL Sound 5.1" = VL Sound 5.1
"VLC media player" = VLC media player 1.0.1
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---


Und ein HijackThis Logfile:
HiJackthis Logfile:
Code:
ATTFilter
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:43:11, on 30.08.2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\DynDNS Updater\DynTray.exe
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Windows\SysWOW64\svchost.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
C:\Users\David\Desktop\OTL.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O4 - HKLM\..\Run: [AdobeCS5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Core Temp] "C:\Users\David\Desktop\CoreTemp\Core Temp.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Users\David\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "E:\Games\Steam\Steam.exe" -silent
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\SysWOW64\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/5.0_(Windows;_U;_Windows_NT_6.1;_de;_rv:1.9.2.3)_Gecko/20100401_Firefox/3.6.3_(_.NET_CLR_3.5.30729)" -"hxxp://playskillgames.bwin.com/t/v/client/info?action=gameClient&tournamentSessionId=38241990&pwd=QXNPOHAVYFIX"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Startup: IconRestorer.lnk = C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe
O4 - Startup: Logitech Touch Mouse Server.lnk = C:\Program Files (x86)\Logitech Touch Mouse Server\iTouch-Server-Win.exe
O4 - Global Startup: DynDNS Updater Tray Icon.lnk = C:\Program Files (x86)\DynDNS Updater\DynTray.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: UltraMon.lnk = ?
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\nvidia corporation\networkaccessmanager\bin32\nvlsp.dll
O13 - Gopher Prefix: 
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Geräteerkennung) - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - hxxp://download.gigabyte.com.tw/object/Dldrv.ocx
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Autodata Limited License Service - Autodata Limited - C:\Program Files (x86)\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
O23 - Service: Dienst "Bonjour" (Bonjour Service) - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 12916 bytes
--- --- ---


Gruß
Geändert von David90 (30.08.2010 um 13:03 Uhr)

Alt 30.08.2010, 16:42   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Moin,

mach mal bitte einen Vollscan mit Malware auf alle lokalen Festplatten. Das Tool bitte vorher nochmal updaten, die bringen sehr häufig Updates raus.
__________________

__________________
Alt 30.08.2010, 18:22   #3
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Hi,

gerade noch einmal Malware drüber laufen lassen - nichts gefunden. Bedeutet das nun das ich gar nichts mehr drauf habe?

Zitat:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4509

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

30.08.2010 19:18:45
mbam-log-2010-08-30 (19-18-45).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|G:\|)
Durchsuchte Objekte: 413462
Laufzeit: 1 Stunde(n), 15 Minute(n), 4 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
__________________
Alt 30.08.2010, 18:58   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Zitat:
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
Hat das einen besonderen Hintergrund, dass Dein Rechner Adobe nicht erreichen darf?
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 30.08.2010, 19:11   #5
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Ja, der Adobe Updater kann ganz schön nervig sein nach einiger Zeit . Und im Internet gab es eine Anleitung um diesen so zu deaktivieren.


Alt 30.08.2010, 19:17   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)


Code:
ATTFilter
:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O32 - AutoRun File - [2004.11.18 22:59:22 | 000,000,000 | R--D | M] - H:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:25:54 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:58:27 | 000,000,103 | R--- | M] () - H:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2004.11.14 16:08:54 | 000,929,792 | R--- | M] (Electronic Arts Inc.) - H:\AutoRunGUI.dll -- [ UDF ]
O33 - MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\Shell\AutoRun\command - "" = H:\setup.exe -- [2004.10.29 12:22:40 | 000,110,592 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\Shell - "" = AutoRun
O33 - MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\Shell\AutoRun\command - "" = I:\autorun.exe -- File not found
O33 - MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\Shell - "" = AutoRun
O33 - MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\Shell\AutoRun\command - "" = I:\Autorun.exe -- File not found
[2010.08.30 03:51:39 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\9AF58564C69101C30533F227825621A6
[2010.08.30 03:18:04 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Windows Server
[2010.08.07 17:23:36 | 000,000,000 | ---D | C] -- C:\Windows\74224F8D4A1748169EDB7BB854DE532C.TMP
[2010.08.02 22:58:34 | 000,000,000 | -H-D | C] -- C:\ProgramData\~2
[2010.08.02 22:57:54 | 000,000,000 | -H-D | C] -- C:\ProgramData\~0
[2010.08.02 22:57:35 | 000,000,000 | -H-D | C] -- C:\ProgramData\~1
[2010.08.30 03:51:38 | 000,000,016 | ---- | M] () -- C:\Users\David\AppData\Roaming\hngmfc.dat
[2010.08.30 03:18:13 | 000,000,005 | ---- | M] () -- C:\zrpt.xml
[2010.08.29 17:03:34 | 000,000,011 | R--- | M] () -- C:\Windows\amunres.lsl
:Commands
[purity]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.
__________________
--> Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"

Alt 30.08.2010, 20:43   #7
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Habe den Text in OTL rein kopiert, auf Fix geklickt und das Programm hat sich aufgehangen und musste beendet werden - hab ich es kaputt gemacht?

Nach ca. 1-2 Minuten hat sich eine Textdatei mit folgendem Inhalt geöffnet:

Zitat:
Files\Folders moved on Reboot...
File move failed. H:\AutoRun.exe scheduled to be moved on reboot.
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File move failed. H:\AutoRunGUI.dll scheduled to be moved on reboot.
File move failed. H:\setup.exe scheduled to be moved on reboot.

Registry entries deleted on Reboot...
LG

Alt 30.08.2010, 20:45   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Probiers bitte nochmal.
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 30.08.2010, 20:55   #9
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Nach dem 3. Versuch hats nun anscheinend? geklappt.

Zitat:
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93}\ not found.
File not found.
File move failed. H:\AutoRun.exe scheduled to be moved on reboot.
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File move failed. H:\AutoRunGUI.dll scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43152018-bc85-11de-b725-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{43152018-bc85-11de-b725-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43152018-bc85-11de-b725-806e6f6e6963}\ not found.
File move failed. H:\setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{638fb14e-d792-11de-a078-001d7dd8f92f}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{638fb14e-d792-11de-a078-001d7dd8f92f}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{638fb14e-d792-11de-a078-001d7dd8f92f}\ not found.
File I:\autorun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f74e7a5e-bda5-11de-83dc-0011f6071da5}\ not found.
File I:\Autorun.exe not found.
Folder C:\Users\David\AppData\Roaming\9AF58564C69101C30533F227825621A6\ not found.
Folder C:\Users\David\AppData\Local\Windows Server\ not found.
Folder C:\Windows\74224F8D4A1748169EDB7BB854DE532C.TMP\ not found.
Folder C:\ProgramData\~2\ not found.
Folder C:\ProgramData\~0\ not found.
Folder C:\ProgramData\~1\ not found.
File C:\Users\David\AppData\Roaming\hngmfc.dat not found.
File C:\zrpt.xml not found.
File C:\Windows\amunres.lsl not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: David
->Temp folder emptied: 3795336095 bytes
->Temporary Internet Files folder emptied: 3015009 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 84226364 bytes
->Google Chrome cache emptied: 241256875 bytes
->Flash cache emptied: 84288 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 311296 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2871457 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50434 bytes
RecycleBin emptied: 9442074756 bytes

Total Files Cleaned = 12.941,00 mb


OTL by OldTimer - Version 3.2.11.0 log created on 08302010_215102

Files\Folders moved on Reboot...
File move failed. H:\AutoRun.exe scheduled to be moved on reboot.
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File move failed. H:\AutoRunGUI.dll scheduled to be moved on reboot.
File move failed. H:\setup.exe scheduled to be moved on reboot.
File move failed. C:\Users\David\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
C:\Users\David\AppData\Local\Temp\~DFBC8D1F59AA41CA9A.TMP moved successfully.

Registry entries deleted on Reboot...

Alt 31.08.2010, 07:24   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Ok. Zur Kontrolle:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die OTL.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die Textbox.
Code:
ATTFilter
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Klick auf .
  • Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 31.08.2010, 15:20   #11
David90
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Nach dem Scan hat sich allerdings nur eine Textdatei mit folgendem Inhalt geöffnet:

Code:
ATTFilter
OTL logfile created on: 31.08.2010 16:06:27 - Run 2
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\David\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 66,00% Memory free
10,00 Gb Paging File | 9,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): c:\pagefile.sys 6142 6142 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 74,55 Gb Total Space | 17,57 Gb Free Space | 23,57% Space Free | Partition Type: NTFS
Drive D: | 436,46 Gb Total Space | 41,34 Gb Free Space | 9,47% Space Free | Partition Type: NTFS
Drive E: | 465,63 Gb Total Space | 41,60 Gb Free Space | 8,93% Space Free | Partition Type: NTFS
F: Drive not present or media not loaded
Drive G: | 29,30 Gb Total Space | 25,97 Gb Free Space | 88,65% Space Free | Partition Type: NTFS
Drive H: | 3,95 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
I: Drive not present or media not loaded
 
Computer Name: DAVID-PC
Current User Name: David
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Include 64bit Scans
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files (x86)\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe (Autodata Limited)
PRC - C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe (Dynamic Network Services, Inc.)
PRC - C:\Program Files (x86)\DynDNS Updater\DynTray.exe (Dynamic Network Services, Inc.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe (FSL - Freesoftland)
PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
PRC - C:\Programme\Logitech\SetPoint\x86\SetPoint32.exe ()
PRC - C:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe (Realtime Soft Ltd)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\David\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\SysWOW64\vbscript.dll (Microsoft Corporation)
MOD - C:\Programme\UltraMon\RTSUltraMonHookX32.dll (Realtime Soft Ltd)
MOD - C:\Programme\UltraMon\UltraMonResButtons.dll (Realtime Soft Ltd)
MOD - C:\Programme\Logitech\SetPoint\x86\GameHook.dll (Logitech, Inc.)
MOD - C:\Programme\Logitech\SetPoint\x86\lgscroll.dll (Logitech, Inc.)
MOD - C:\Windows\SysWOW64\rsaenh.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wmiutils.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbemcomn.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemdisp.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemsvc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\wbemprox.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\sxs.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\srvcli.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\slc.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\RpcRtRemote.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntshrui.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\ntdsapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\linkinfo.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\wbem\fastprox.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\EhStorShell.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\msvcr80.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found
SRV:64bit: - (MatSvc) -- C:\Program Files\Microsoft Fix it Center\Matsvc.exe (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (UmRdpService) -- C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)
SRV:64bit: - (PeerDistSvc) -- C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)
SRV:64bit: - (CscService) -- C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Apple Mobile Device) -- C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (Autodata Limited License Service) -- C:\Program Files (x86)\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe (Autodata Limited)
SRV - (DynDNS Updater) -- C:\Program Files (x86)\DynDNS Updater\DynUpSvc.exe (Dynamic Network Services, Inc.)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (nSvcIp) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Programme\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (Lbd) -- C:\Windows\SysNative\DRIVERS\Lbd.sys File not found
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()
DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (NVNET) -- C:\Windows\SysNative\drivers\nvmf6264.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)
DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)
DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)
DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)
DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)
DRV:64bit: - (LUsbFilt) -- C:\Windows\SysNative\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV:64bit: - (LMouFilt) -- C:\Windows\SysNative\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV:64bit: - (LHidFilt) -- C:\Windows\SysNative\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (FETNDIS) -- C:\Windows\SysNative\drivers\fet6x64.sys (VIA Technologies, Inc.              )
DRV:64bit: - (NVENETFD) -- C:\Windows\SysNative\drivers\nvm62x64.sys (NVIDIA Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (Sentinel64) -- C:\Windows\SysNative\drivers\sentinel64.sys (SafeNet, Inc.)
DRV:64bit: - (ManyCam) -- C:\Windows\SysNative\drivers\ManyCam_x64.sys (ManyCam LLC.)
DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (UltraMonUtility) -- C:\Program Files (x86)\Common Files\Realtime Soft\UltraMonMirrorDrv\x64\UltraMonUtility.sys (Realtime Soft Ltd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0B BD 53 13 31 39 CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: en-GB@dictionaries.addons.mozilla.org:1.19
FF - prefs.js..extensions.enabledItems: {b749fc7c-e949-447f-926c-3f4eed6accfe}:0.6.6
FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22
FF - prefs.js..extensions.enabledItems: de-DE@dictionaries.addons.mozilla.org:2.0.1
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?sourceid=navclient&hl=de&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.08.08 12:50:35 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.07.26 14:30:51 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2010.07.27 01:04:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 3.0.6\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.06.19 01:40:29 | 000,000,000 | ---D | M]
 
[2010.06.11 20:53:02 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Extensions
[2010.01.07 19:24:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2010.08.30 16:56:48 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions
[2010.04.27 23:27:36 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.29 02:53:09 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.07.26 14:56:15 | 000,000,000 | ---D | M] (ReloadEvery) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}
[2010.08.02 22:02:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.02.13 00:23:33 | 000,000,000 | ---D | M] (Modify Headers) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{b749fc7c-e949-447f-926c-3f4eed6accfe}
[2010.08.30 16:56:44 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.02.14 03:17:20 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\de-DE@dictionaries.addons.mozilla.org
[2010.02.12 02:58:57 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\en-GB@dictionaries.addons.mozilla.org
[2010.08.27 22:08:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\foxyproxy@eric.h.jung
[2010.08.30 16:56:44 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\mozilla\Firefox\Profiles\35dx8gvb.default\extensions\staged-xpis
[2010.08.30 16:56:48 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.01.22 19:33:56 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.22 19:33:56 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.22 19:33:56 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.22 19:33:56 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.22 19:33:56 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.09.24 18:43:43 | 000,001,327 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1       activate.adobe.com
O1 - Hosts: 127.0.0.1       practivate.adobe.com
O1 - Hosts: 127.0.0.1       ereg.adobe.com
O1 - Hosts: 127.0.0.1       activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1       wip3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-3.adobe.com
O1 - Hosts: 127.0.0.1       3dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1       adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1       ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1       activate-sea.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1       activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1       wwis-dubc1-vip60.adobe.com
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [Core Temp] C:\Users\David\Desktop\CoreTemp\Core Temp.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] E:\Games\Steam\Steam.exe (Valve Corporation)
O4 - HKCU..\RunOnce: [Shockwave Updater] C:\Windows\SysWOW64\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla\5.0_( File not found
O4 - Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IconRestorer.lnk = C:\Program Files (x86)\FSL\IconRestorer\IconRestorer.exe (FSL - Freesoftland)
O4 - Startup: C:\Users\David\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech Touch Mouse Server.lnk = C:\Program Files (x86)\Logitech Touch Mouse Server\iTouch-Server-Win.exe (Logitech, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files (x86)\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10:64bit: - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab (Geräteerkennung)
O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} hxxp://download.gigabyte.com.tw/object/Dldrv.ocx (Dldrv2 Control)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - Reg Error: Key error. - c:\Programme\Common Files\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2005.12.21 17:53:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004.11.18 22:59:22 | 000,000,000 | R--D | M] - H:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:25:54 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - H:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2004.11.18 22:58:27 | 000,000,103 | R--- | M] () - H:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2004.11.14 16:08:54 | 000,929,792 | R--- | M] (Electronic Arts Inc.) - H:\AutoRunGUI.dll -- [ UDF ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 90 Days ==========
 
[2010.08.31 00:17:56 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Opera
[2010.08.31 00:17:56 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\Opera
[2010.08.31 00:17:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Opera
[2010.08.31 00:16:46 | 013,319,008 | ---- | C] (Opera Software ASA) -- C:\Users\David\Desktop\Opera_1061_int_Setup.exe
[2010.08.30 21:33:08 | 000,000,000 | ---D | C] -- C:\_OTL
[2010.08.30 17:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2010.08.30 13:43:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2010.08.30 13:30:15 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010.08.30 12:54:49 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Malwarebytes
[2010.08.30 12:54:41 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.08.30 12:54:39 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.08.30 12:54:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.08.30 12:54:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.08.29 17:09:50 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.08.28 23:06:06 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Meine empfangenen Dateien
[2010.08.20 23:12:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ElsterFormular
[2010.08.18 07:29:46 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Games for Windows - LIVE Demos
[2010.08.13 23:16:35 | 000,000,000 | ---D | C] -- C:\Programme\BeatPack
[2010.08.13 21:28:34 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.08.13 21:28:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TweetDeck
[2010.08.11 18:12:42 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\FileZilla
[2010.08.11 18:12:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client
[2010.08.09 21:41:46 | 000,000,000 | ---D | C] -- C:\ProgramData\id Software
[2010.08.09 19:31:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DynDNS Updater
[2010.08.09 19:31:27 | 000,000,000 | ---D | C] -- C:\ProgramData\DynDNS
[2010.08.08 02:00:03 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2010.08.07 17:32:11 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\NVIDIA
[2010.08.07 17:32:06 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\My Games
[2010.08.04 22:17:10 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\StarCraft II
[2010.08.02 23:15:49 | 000,000,000 | ---D | C] -- C:\Users\David\Local Settings
[2010.08.02 23:15:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mixxx
[2010.08.02 22:59:49 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\Native Instruments
[2010.08.02 22:57:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Native Instruments
[2010.08.02 22:57:49 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Native Instruments
[2010.08.02 22:02:36 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.02 22:02:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft
[2010.07.22 00:57:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2010.07.21 12:47:18 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\MAGIX_MusicMakerTechnoEdition3_Download-Version
[2010.07.20 22:04:25 | 000,000,000 | ---D | C] -- C:\Programme\iTunes
[2010.07.20 22:04:25 | 000,000,000 | ---D | C] -- C:\Programme\iPod
[2010.07.16 20:22:05 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.07.16 20:22:05 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\Adobe Mini Bridge CS5
[2010.07.15 19:35:33 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2010.07.15 19:21:19 | 000,000,000 | ---D | C] -- C:\Programme\Adobe
[2010.07.10 05:38:00 | 000,065,128 | ---- | C] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2010.07.10 05:38:00 | 000,056,936 | ---- | C] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2010.06.29 00:37:12 | 000,000,000 | ---D | C] -- C:\Users\David\Desktop\VisualBoyAdvance-1.8.0-beta3
[2010.06.19 01:40:16 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\DivX
[2010.06.19 01:40:00 | 000,000,000 | ---D | C] -- C:\Programme\DivX
[2010.06.17 19:41:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2010.06.17 19:40:00 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour
[2010.06.17 19:40:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2010.06.11 20:59:36 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\IDMComp
[2010.06.10 20:22:23 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Local\AOL
[2010.06.07 21:10:43 | 000,000,000 | ---D | C] -- C:\Users\David\Desktop\Neuer Ordner
[2010.06.03 12:31:56 | 000,000,000 | ---D | C] -- C:\Users\David\Documents\ICQ
[2010.06.03 12:28:52 | 000,000,000 | ---D | C] -- C:\Users\David\AppData\Roaming\ICQ
[2010.06.03 12:28:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ICQ7.2
[2007.09.21 20:42:42 | 000,019,008 | ---- | C] (Windows (R) Server 2003 DDK provider) -- C:\Program Files (x86)\markfun.a64
[2007.08.21 20:49:28 | 000,017,912 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Program Files (x86)\markfun.w32
 
========== Files - Modified Within 90 Days ==========
 
[2010.08.31 16:06:13 | 003,670,016 | ---- | M] () -- C:\Users\David\ntuser.dat
[2010.08.31 15:51:05 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3292708223-3298073484-1682841094-1000UA.job
[2010.08.31 15:32:40 | 000,010,288 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.08.31 15:32:40 | 000,010,288 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.08.31 15:27:34 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010.08.31 15:27:19 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.08.31 00:43:15 | 001,198,166 | -H-- | M] () -- C:\Users\David\AppData\Local\IconCache.db
[2010.08.31 00:16:59 | 013,319,008 | ---- | M] (Opera Software ASA) -- C:\Users\David\Desktop\Opera_1061_int_Setup.exe
[2010.08.30 21:47:00 | 000,001,018 | ---- | M] () -- C:\Users\David\Desktop\CCleaner.lnk
[2010.08.30 17:20:04 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.08.30 17:20:04 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.08.30 17:20:04 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.08.30 17:20:04 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.08.30 17:20:03 | 001,513,638 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.08.30 14:14:49 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000002.regtrans-ms
[2010.08.30 14:14:49 | 000,524,288 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000001.regtrans-ms
[2010.08.30 14:14:49 | 000,065,536 | -HS- | M] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TM.blf
[2010.08.30 13:43:06 | 000,002,104 | ---- | M] () -- C:\Users\David\Desktop\HijackThis.lnk
[2010.08.30 13:30:19 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\David\Desktop\OTL.exe
[2010.08.30 12:54:43 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.30 12:53:03 | 000,363,520 | ---- | M] () -- C:\Users\David\Desktop\rkill.com
[2010.08.29 21:49:23 | 000,014,766 | ---- | M] () -- C:\Users\David\Desktop\Microsoft Office Excel-Arbeitsblatt (neu).xlsx
[2010.08.29 18:03:13 | 000,000,036 | ---- | M] () -- C:\Users\David\AppData\Local\housecall.guid.cache
[2010.08.29 15:31:17 | 000,000,394 | ---- | M] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010.08.20 20:07:38 | 011,966,749 | ---- | M] () -- C:\Users\David\Desktop\08 - June (Extended).mp3
[2010.08.20 19:44:10 | 009,784,760 | ---- | M] () -- C:\Users\David\Desktop\Moonbootica_-_June.mp3
[2010.08.16 22:53:30 | 020,470,746 | ---- | M] () -- C:\Users\David\Desktop\945942_Death_By_House_Adam_Beyer___Jesper_Dahlback_Remix.mp3
[2010.08.16 22:51:00 | 018,153,378 | ---- | M] () -- C:\Users\David\Desktop\1242096_Oh_Yeah_Sander_Van_Doorn_Remix.mp3
[2010.08.16 22:51:00 | 010,851,949 | ---- | M] () -- C:\Users\David\Desktop\1320162_KNAS_Original_Mix.mp3
[2010.08.16 22:50:49 | 016,082,091 | ---- | M] () -- C:\Users\David\Desktop\945943_Death_By_House_A__Mochi_Remix.mp3
[2010.08.13 19:33:08 | 005,010,304 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.08.12 22:11:26 | 000,154,836 | -H-- | M] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.08.12 21:53:46 | 011,842,966 | ---- | M] () -- C:\Users\David\Desktop\1323465_Englishman_In_New_York_Club_Mix.mp3
[2010.08.10 08:51:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3292708223-3298073484-1682841094-1000Core.job
[2010.08.10 00:40:45 | 000,214,720 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2010.08.10 00:40:45 | 000,214,720 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.08.09 21:41:47 | 000,075,064 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.08.09 21:41:46 | 002,373,712 | ---- | M] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.08.09 19:31:30 | 000,001,071 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DynDNS Updater Tray Icon.lnk
[2010.08.07 16:55:36 | 021,937,269 | ---- | M] () -- C:\Users\David\Desktop\Cires D - On Off.mp3
[2010.08.02 23:12:48 | 022,065,267 | ---- | M] () -- C:\Users\David\Desktop\Phunk Investigation - Acid Slider (Original Mix).mp3
[2010.08.02 22:05:34 | 008,448,128 | ---- | M] () -- C:\Users\David\Desktop\Schlachthofbronx - Isartaler (Ghettoschtzenremix).mp3
[2010.07.27 17:21:06 | 000,011,388 | ---- | M] () -- C:\Users\David\Desktop\Microsoft Office Word-Dokument (neu).docx
[2010.07.27 03:23:14 | 004,094,327 | ---- | M] () -- C:\Users\David\Desktop\Red Hot Chilli Peppers - Otherside.mp3
[2010.07.26 01:39:18 | 029,687,936 | ---- | M] () -- C:\Users\David\Desktop\Loveparade 2010 - 04 - Gustavo Bravetti (07-24-2010).mp3
[2010.07.20 22:01:17 | 000,000,629 | ---- | M] () -- C:\Windows\SysNative\mapisvc.inf
[2010.07.20 19:47:06 | 213,845,764 | ---- | M] () -- C:\Users\David\Desktop\THE_ADVENT_DJ_SET_10_09.mp3
[2010.07.20 01:51:35 | 000,010,304 | ---- | M] () -- C:\Users\David\Desktop\T-Mobile Kündigung.pdf
[2010.07.15 19:35:33 | 000,124,544 | ---- | M] () -- C:\Users\David\AppData\Local\GDIPFONTCACHEV1.DAT
[2010.07.12 01:06:28 | 023,789,568 | ---- | M] () -- C:\Users\David\Desktop\22275_Meet_Her_At_The_Love_Parade_Nalin___Kane_Mix.mp3
[2010.07.12 01:06:20 | 018,117,348 | ---- | M] () -- C:\Users\David\Desktop\846953_Becoming_Insane_Album_Mix.mp3
[2010.07.11 21:11:45 | 007,048,787 | ---- | M] () -- C:\Users\David\Desktop\Limp_Bizkit_-_My_Generation.mp3
[2010.07.11 21:09:00 | 004,720,881 | ---- | M] () -- C:\Users\David\Desktop\04-limp_bizkit-break_stuff_-_www.torrentazos.com.mp3
[2010.07.10 15:46:41 | 003,414,018 | ---- | M] () -- C:\Users\David\Desktop\Limp Bizkit - Rollin.mp3
[2010.07.10 05:38:00 | 000,065,128 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2010.07.10 05:38:00 | 000,056,936 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2010.07.10 05:38:00 | 000,012,264 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb
[2010.07.03 14:20:10 | 004,524,266 | ---- | M] () -- C:\Users\David\Desktop\So Above Em.mp3
[2010.06.27 23:30:45 | 022,019,813 | ---- | M] () -- C:\Users\David\Desktop\860067_Stranger__To_Stability__Len_Faki_Podium_Mix.mp3
[2010.06.04 23:22:19 | 004,692,796 | ---- | M] () -- C:\Users\David\Desktop\3958703_Soil_-_Breaking_Me_Down.mp3
 
========== Files Created - No Company Name ==========
 
[2010.08.30 21:47:00 | 000,001,018 | ---- | C] () -- C:\Users\David\Desktop\CCleaner.lnk
[2010.08.30 13:43:06 | 000,002,104 | ---- | C] () -- C:\Users\David\Desktop\HijackThis.lnk
[2010.08.30 12:54:43 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.08.30 12:53:01 | 000,363,520 | ---- | C] () -- C:\Users\David\Desktop\rkill.com
[2010.08.30 12:45:52 | 000,524,288 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000002.regtrans-ms
[2010.08.30 12:45:52 | 000,524,288 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TMContainer00000000000000000001.regtrans-ms
[2010.08.30 12:45:52 | 000,065,536 | -HS- | C] () -- C:\Users\David\ntuser.dat{896da45f-b422-11df-80ed-001d7dd8f92f}.TM.blf
[2010.08.29 18:03:13 | 000,000,036 | ---- | C] () -- C:\Users\David\AppData\Local\housecall.guid.cache
[2010.08.28 13:11:19 | 000,000,394 | ---- | C] () -- C:\Windows\tasks\Ad-Aware Update (Weekly).job
[2010.08.20 20:07:38 | 011,966,749 | ---- | C] () -- C:\Users\David\Desktop\08 - June (Extended).mp3
[2010.08.20 19:43:52 | 009,784,760 | ---- | C] () -- C:\Users\David\Desktop\Moonbootica_-_June.mp3
[2010.08.16 22:53:16 | 020,470,746 | ---- | C] () -- C:\Users\David\Desktop\945942_Death_By_House_Adam_Beyer___Jesper_Dahlback_Remix.mp3
[2010.08.16 22:50:40 | 010,851,949 | ---- | C] () -- C:\Users\David\Desktop\1320162_KNAS_Original_Mix.mp3
[2010.08.16 22:50:36 | 018,153,378 | ---- | C] () -- C:\Users\David\Desktop\1242096_Oh_Yeah_Sander_Van_Doorn_Remix.mp3
[2010.08.16 22:50:32 | 016,082,091 | ---- | C] () -- C:\Users\David\Desktop\945943_Death_By_House_A__Mochi_Remix.mp3
[2010.08.12 21:53:33 | 011,842,966 | ---- | C] () -- C:\Users\David\Desktop\1323465_Englishman_In_New_York_Club_Mix.mp3
[2010.08.09 21:41:46 | 002,373,712 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2010.08.09 19:31:30 | 000,001,071 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\DynDNS Updater Tray Icon.lnk
[2010.08.07 16:54:51 | 021,937,269 | ---- | C] () -- C:\Users\David\Desktop\Cires D - On Off.mp3
[2010.08.02 23:12:36 | 022,065,267 | ---- | C] () -- C:\Users\David\Desktop\Phunk Investigation - Acid Slider (Original Mix).mp3
[2010.08.02 22:05:21 | 008,448,128 | ---- | C] () -- C:\Users\David\Desktop\Schlachthofbronx - Isartaler (Ghettoschtzenremix).mp3
[2010.07.27 03:23:10 | 004,094,327 | ---- | C] () -- C:\Users\David\Desktop\Red Hot Chilli Peppers - Otherside.mp3
[2010.07.26 01:39:02 | 029,687,936 | ---- | C] () -- C:\Users\David\Desktop\Loveparade 2010 - 04 - Gustavo Bravetti (07-24-2010).mp3
[2010.07.20 22:01:17 | 000,000,629 | ---- | C] () -- C:\Windows\SysNative\mapisvc.inf
[2010.07.20 19:44:16 | 213,845,764 | ---- | C] () -- C:\Users\David\Desktop\THE_ADVENT_DJ_SET_10_09.mp3
[2010.07.20 01:48:35 | 000,010,304 | ---- | C] () -- C:\Users\David\Desktop\T-Mobile Kündigung.pdf
[2010.07.20 01:34:24 | 000,011,388 | ---- | C] () -- C:\Users\David\Desktop\Microsoft Office Word-Dokument (neu).docx
[2010.07.12 01:05:59 | 023,789,568 | ---- | C] () -- C:\Users\David\Desktop\22275_Meet_Her_At_The_Love_Parade_Nalin___Kane_Mix.mp3
[2010.07.12 01:05:55 | 018,117,348 | ---- | C] () -- C:\Users\David\Desktop\846953_Becoming_Insane_Album_Mix.mp3
[2010.07.11 21:11:36 | 007,048,787 | ---- | C] () -- C:\Users\David\Desktop\Limp_Bizkit_-_My_Generation.mp3
[2010.07.11 21:08:56 | 004,720,881 | ---- | C] () -- C:\Users\David\Desktop\04-limp_bizkit-break_stuff_-_www.torrentazos.com.mp3
[2010.07.10 15:46:36 | 003,414,018 | ---- | C] () -- C:\Users\David\Desktop\Limp Bizkit - Rollin.mp3
[2010.07.03 14:20:04 | 004,524,266 | ---- | C] () -- C:\Users\David\Desktop\So Above Em.mp3
[2010.06.27 23:26:57 | 022,019,813 | ---- | C] () -- C:\Users\David\Desktop\860067_Stranger__To_Stability__Len_Faki_Podium_Mix.mp3
[2010.06.04 23:22:15 | 004,692,796 | ---- | C] () -- C:\Users\David\Desktop\3958703_Soil_-_Breaking_Me_Down.mp3
[2010.04.02 17:17:34 | 000,179,091 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2010.03.18 22:55:08 | 000,000,131 | ---- | C] () -- C:\Windows\basscad.ini
[2010.02.25 10:33:04 | 000,000,035 | ---- | C] () -- C:\Windows\Ulead32.INI
[2010.01.31 23:25:41 | 000,007,599 | ---- | C] () -- C:\Users\David\AppData\Local\Resmon.ResmonCfg
[2009.12.22 17:21:40 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll
[2009.12.18 00:01:37 | 000,000,000 | ---- | C] () -- C:\Windows\dbsetup.INI
[2009.12.18 00:01:35 | 000,000,122 | ---- | C] () -- C:\Windows\ODBC.INI
[2009.12.17 09:34:50 | 000,000,071 | ---- | C] () -- C:\Windows\wiso.ini
[2009.11.09 07:54:17 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bko
[2009.11.08 23:26:50 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bk!
[2009.11.08 23:26:46 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.bak
[2009.11.08 23:25:53 | 000,009,446 | ---- | C] () -- C:\Users\David\AppData\Roaming\PStrip.ini
[2009.11.08 23:18:38 | 000,000,062 | ---- | C] () -- C:\Windows\wininit.ini
[2009.11.04 22:53:08 | 000,524,288 | ---- | C] () -- C:\Program Files (x86)\6a61jg0a.0
[2009.11.04 22:52:12 | 000,088,441 | ---- | C] () -- C:\Program Files (x86)\bios.ini
[2009.11.04 22:51:47 | 000,000,029 | ---- | C] () -- C:\Program Files (x86)\new_ver.ini
[2009.09.24 08:29:48 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2008.02.14 15:28:56 | 000,000,029 | ---- | C] () -- C:\Program Files (x86)\version.ini
[2008.02.14 15:23:12 | 000,231,944 | ---- | C] () -- C:\Program Files (x86)\gwflash.exe
[2007.04.05 05:31:22 | 000,248,640 | ---- | C] () -- C:\Program Files (x86)\update.exe
[2007.04.04 19:35:36 | 000,207,680 | ---- | C] () -- C:\Program Files (x86)\updateutility.exe
[2007.03.30 05:36:28 | 000,000,301 | ---- | C] () -- C:\Program Files (x86)\update.ini
[2007.03.02 05:48:50 | 000,240,448 | ---- | C] () -- C:\Program Files (x86)\gwf32.exe
[2006.11.24 00:47:50 | 000,207,680 | ---- | C] () -- C:\Program Files (x86)\BIOS_Run.exe
[2006.11.03 19:09:40 | 000,000,528 | ---- | C] () -- C:\Program Files (x86)\CONFIG.INI
[2006.03.02 13:43:51 | 000,000,523 | ---- | C] () -- C:\Windows\pbl.ini
[2005.04.27 20:40:26 | 000,006,800 | ---- | C] () -- C:\Program Files (x86)\W95_HUA.vxd
[2000.05.26 11:28:00 | 000,016,183 | ---- | C] () -- C:\Windows\SysWow64\SELF32.INI
[1997.06.14 13:56:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\iyvu9_32.dll
 
========== LOP Check ==========
 
[2010.04.10 15:27:53 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\AllDup
[2010.07.14 19:58:07 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Amazon
[2009.11.06 19:56:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Ashampoo
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ClonySoft
[2010.02.05 09:10:42 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Command and Conquer 4 Beta
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Lite
[2009.10.20 20:30:33 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Pro
[2010.08.02 22:02:36 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.30 03:02:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FileZilla
[2010.05.09 11:39:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FSL
[2010.02.20 20:52:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\GMX
[2010.08.29 14:06:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ICQ
[2010.02.03 17:45:12 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Leadertech
[2010.07.21 12:48:17 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\MAGIX
[2010.04.10 22:10:30 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ManyCam
[2010.08.09 23:07:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2010.08.31 00:17:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Opera
[2010.02.05 07:57:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PiX-ART.com
[2009.10.19 10:23:32 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Sierra Entertainment
[2010.07.16 20:22:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.07 19:24:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Thunderbird
[2009.10.19 10:23:39 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TomTom
[2009.10.19 10:23:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TuneUp Software
[2010.08.13 21:28:34 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.08.07 23:06:51 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\uTorrent
[2009.11.08 18:32:28 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinDefence
[2010.08.29 15:31:17 | 000,000,394 | ---- | M] () -- C:\Windows\Tasks\Ad-Aware Update (Weekly).job
[2010.08.24 16:22:48 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2010.07.15 19:25:34 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Adobe
[2010.07.16 20:22:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Adobe Mini Bridge CS5
[2009.09.04 09:11:48 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\AdobeUM
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Ahead
[2010.04.10 15:27:53 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\AllDup
[2010.07.14 19:58:07 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Amazon
[2009.10.20 19:47:03 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Apple Computer
[2009.11.06 19:56:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Ashampoo
[2010.05.07 11:48:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ATI
[2010.05.12 15:45:24 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Avira
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ClonySoft
[2010.02.05 09:10:42 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Command and Conquer 4 Beta
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Lite
[2009.10.20 20:30:33 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DAEMON Tools Pro
[2010.07.11 01:22:45 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DivX
[2010.07.13 19:11:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\dvdcss
[2010.08.02 22:02:36 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.08.30 03:02:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FileZilla
[2010.05.09 11:39:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\FSL
[2010.02.20 20:52:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\GMX
[2010.08.29 14:06:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ICQ
[2009.10.20 20:11:35 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Identities
[2010.06.11 20:59:58 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\IDMComp
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\InstallShield
[2010.02.03 17:45:12 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Leadertech
[2010.02.03 17:45:15 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Logitech
[2009.10.19 10:23:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Macromedia
[2010.07.21 12:48:17 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\MAGIX
[2010.08.30 12:54:49 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Malwarebytes
[2010.04.10 22:10:30 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\ManyCam
[2009.07.14 20:18:19 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Media Center Programs
[2010.08.09 23:07:23 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2010.06.08 01:44:03 | 000,000,000 | --SD | M] -- C:\Users\David\AppData\Roaming\Microsoft
[2009.10.19 10:23:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Mozilla
[2010.08.07 17:32:11 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\NVIDIA
[2010.08.31 00:17:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Opera
[2010.02.05 07:57:56 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\PiX-ART.com
[2009.10.19 10:23:32 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Realtime Soft
[2010.04.30 22:58:35 | 000,000,000 | RH-D | M] -- C:\Users\David\AppData\Roaming\SecuROM
[2009.10.19 10:23:32 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Sierra Entertainment
[2010.07.28 03:19:52 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Skype
[2010.07.28 00:03:43 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\skypePM
[2010.07.16 20:22:05 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.01.07 00:09:06 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Sun
[2009.10.19 10:23:35 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Talkback
[2010.01.07 19:24:00 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Thunderbird
[2009.10.19 10:23:39 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TomTom
[2009.10.19 10:23:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TuneUp Software
[2010.08.13 21:28:34 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\TweetDeckFast.FFF259DC0CE2657847BBB4AFF0E62062EFC56543.1
[2010.08.07 23:06:51 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\uTorrent
[2010.08.14 17:41:40 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\vlc
[2010.08.30 12:44:31 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\Winamp
[2009.11.08 18:32:28 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinDefence
[2009.10.19 10:23:41 | 000,000,000 | ---D | M] -- C:\Users\David\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2009.04.10 19:54:22 | 000,066,080 | ---- | M] (Martin Pesch) -- C:\Users\David\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\mp3DirectCut.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysWow64\DriverStore\FileRepository\machine.inf_amd64_neutral_9e6bb86c3b39a3e9\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysWow64\DriverStore\FileRepository\mshdc.inf_amd64_neutral_a69a58a4286f0b22\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\SysWow64\DriverStore\FileRepository\iastorv.inf_amd64_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\SysWOW64\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\SysWow64\DriverStore\FileRepository\nvraid.inf_amd64_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\SysWOW64\scecli.dll
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\SysWOW64\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
< End of report >
Eine zweite mit "extras" hat sich nicht geöffnet - auch bei mehrmaligem Versuch nicht.

LG

Alt 31.08.2010, 19:49   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Standard

Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"
64-bit, ad-aware, adblock, adware.casino, antivir, antivir guard, avgntflt.sys, avira, bifrose.trace, browser, c:\windows\system32\rundll32.exe, components, computer, converter, error, feedback, firefox, firefox.exe, flash player, google chrome, heuristics.shuriken, hijackthis, install.exe, investigation, jusched.exe, langs, location, logfile, microsoft fix it, microsoft office word, mozilla thunderbird, mp3, msvcr80.dll, nicht sicher, office 2007, oldtimer, otl.exe, plug-in, programdata, realtek, recycle.bin, saver, scan, sched.exe, searchplugins, security, security update, shell32.dll, shortcut, sierra, software, sptd.sys, spyware, spyware.onlinegames, start menu, studio, system, syswow64, taskmanager, trojaner, updates, usbaapl64, virus, vlc media player, webcheck, windows, windows security, windows security alert


« Malware/Adware/Trojaner? Verdacht Nod 32 Zugriff verweigert URL/IP | Security Suite und Antimalware doctor lassen sich nicht entfernen »


Ähnliche Themen: Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"


  1. "Windows Security Alert" und USB Geräte befallen
    Plagegeister aller Art und deren Bekämpfung - 23.05.2011 (17)
  2. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 08.01.2011 (1)
  3. Meldung Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 17.09.2010 (26)
  4. Windows Security Alert / AV Security Suite / Antivirus Software Alert / gefakter AV lähmt PC
    Plagegeister aller Art und deren Bekämpfung - 09.09.2010 (3)
  5. Ständige Meldung "Windows Security Alert"
    Plagegeister aller Art und deren Bekämpfung - 10.08.2010 (22)
  6. Windows Security Alert / AV Security Suite / Antivirus Software Alert
    Plagegeister aller Art und deren Bekämpfung - 26.07.2010 (21)
  7. Windows Security Alert / AV Security Suite / Antivirus Software Alert// Ohne Internet
    Plagegeister aller Art und deren Bekämpfung - 21.07.2010 (1)
  8. Plötzlicher Trojaner-Befall "Windows Security alert"
    Plagegeister aller Art und deren Bekämpfung - 31.05.2010 (3)
  9. Rootkit,Malware,Trojaner k.a. "Windows Security alert"?
    Plagegeister aller Art und deren Bekämpfung - 05.05.2010 (4)
  10. windows security alert + malware defence + keine exe ausführbar "ungültige win32 anw"
    Plagegeister aller Art und deren Bekämpfung - 03.01.2010 (3)
  11. "Windows Security Center Alert", selbst ein Trojaner/Wurm ?
    Plagegeister aller Art und deren Bekämpfung - 29.12.2009 (5)
  12. virtumonde, smitfraud und "windows security alert"
    Plagegeister aller Art und deren Bekämpfung - 15.09.2008 (8)
  13. Schädling bewirkt falsches "Windows Security Alert" Popup
    Plagegeister aller Art und deren Bekämpfung - 19.08.2008 (13)
  14. Hilfe! Spyware / Virus / Trojaner: "Windows Security Alert"
    Plagegeister aller Art und deren Bekämpfung - 05.06.2008 (1)
  15. "security alert: networm-i.virus@fp"
    Plagegeister aller Art und deren Bekämpfung - 20.11.2007 (7)
  16. hartnäckiger unbekannter Plagegeist... "Windows Security Alert"
    Plagegeister aller Art und deren Bekämpfung - 02.11.2007 (11)
  17. Infizierungsweg: "Windows Security Alert" - Malware?
    Plagegeister aller Art und deren Bekämpfung - 22.09.2007 (7)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" - Hallo, ich habe mir gestern einen Virus/Malware/whatever eingefangen. Seit dem öffnete sich alle paar Minuten ein Fenster mit "Windows Security Alert-Windows has detected an Internet attack attempt...Somebody's trying to infect - Malware / Virus / Trojaner - "Windows Security Alert / Security Suite"...
Archiv
Du betrachtest: Malware / Virus / Trojaner - "Windows Security Alert / Security Suite" auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131