| |
| |||||||
Log-Analyse und Auswertung: svchost.exe ProblemWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
07.11.2010, 23:52
| #1 |
| |  svchost.exe Problem Hallo, da ich vermultich alleine nicht weiter komme,möchte ich gerne die Profis um Hilfe bitten. Meine Logfile und meine Vermutung: O4 - HKLM\..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKCU\..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe Running processes: C:\Program Files (x86)\PopTray\PopTray.exe C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe C:\Program Files (x86)\Mozilla Firefox\firefox.exe D:\Downloads\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ievkbd.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe" O4 - HKLM\..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST') O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST') O4 - Startup: PopTray.lnk = C:\Program Files (x86)\PopTray\PopTray.exe O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll O13 - Gopher Prefix: O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\Windows\system32\astsrv.exe O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing) O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: Nero Update (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\SysWOW64\nlssrv32.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing) O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) bin mir nicht sicher, die exe startet immer beim Windowsstart mit . Bitte um Hilfe, ob ich sie löschen ( wenn ja dann wie) muss, oder ist das olles ok. mfG chrismio |
|
08.11.2010, 02:55
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | svchost.exe Problem Gewöhn dir bitte an, Logfiles nur vollständig zu posten! Der Kopf des HJT-Logs fehlt!
__________________Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
08.11.2010, 08:47
| #3 |
| | svchost.exe Problem Danke für die schnelle Antwort.
__________________Anbei poste ich die Logfiles vom Malwarebytes und vom OTL. Daknke für Hilfe. Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 5068 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 08.11.2010 08:24:50 mbam-log-2010-11-08 (08-24-50).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 141248 Laufzeit: 31 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 1 Infizierte Registrierungswerte: 4 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 8 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{rp8rv11u-mlop-oxwa-33l2-g83rckoln4v3} (Generic.Bot.H) -> Quarantined and deleted successfully. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcu (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hklm (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Generic.Bot.H) -> Quarantined and deleted successfully. C:\Users\Chris\AppData\Roaming\runtime.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R0IQ733.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R36XCI3.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R8LM9A8.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R9CX11H.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$RMSAP8U.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$RN7YSE9.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully. OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 08.11.2010 08:31:16 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = D:\Downloads
64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 68,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,07 Gb Total Space | 38,01 Gb Free Space | 54,26% Space Free | Partition Type: NTFS
Drive D: | 152,71 Gb Total Space | 68,77 Gb Free Space | 45,03% Space Free | Partition Type: NTFS
Drive E: | 221,81 Gb Total Space | 216,06 Gb Free Space | 97,41% Space Free | Partition Type: NTFS
Drive F: | 11,02 Gb Total Space | 5,17 Gb Free Space | 46,93% Space Free | Partition Type: NTFS
Drive Z: | 10,00 Gb Total Space | 6,48 Gb Free Space | 64,79% Space Free | Partition Type: NTFS
Computer Name: CHRIS-PC | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [ACDSee Pro 3.Manage] -- "D:\Programme\ACDSee\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [Bridge] -- D:\Programme\Adobe Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 3.Manage] -- "D:\Programme\ACDSee\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [Bridge] -- D:\Programme\Adobe Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9D00A8DA-650F-21C6-E787-78756733F15F}" = ATI Catalyst Install Manager
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AC76BA86-1033-0000-0064-0003D0000004}" = Adobe Acrobat 9 Pro Extended 64-bit Add-On
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{E5A509B4-D9B1-4FD9-B3EF-EDB216AA8651}" = ccc-utility64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"ImagenomicNoisewareProPlugin" = Imagenomic Noiseware 4.2 Professional Plug-in (build 4205)
"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v4.0.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"WinRAR archiver" = WinRAR
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0FFAC7BB-50DC-CB54-6CA7-A8B74513280B}" = CCC Help Chinese Traditional
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{1B280FAF-AE10-4E31-A41A-DB3917D651DC}" = ACDSee Pro 3
"{1C802083-6D79-78ED-BF1C-601DDF908DD1}" = Catalyst Control Center Core Implementation
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{28728178-FF15-218B-0B63-012692F42C28}" = CCC Help Danish
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{32851025-1E46-83A3-1320-471619254E39}" = Catalyst Control Center Localization All
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{40217B2F-462B-94A4-E84E-6A1C6EDBCE2F}" = CCC Help Swedish
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{5343A801-92E5-C234-9F27-AB27EC738BF6}" = CCC Help Japanese
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{5D22226D-EBC1-C95F-7746-2E3A9F4C97BA}" = CCC Help Russian
"{600C37F2-098B-A165-C1DB-6AE2B89D8D49}" = Catalyst Control Center Graphics Previews Common
"{61F8CA2C-9A80-8A1B-D3B9-347530CB387F}" = CCC Help Norwegian
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{674B407D-EAB1-B6B6-F9BF-C34CEE4CD83F}" = Catalyst Control Center Graphics Light
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{69F411C5-4851-6DA9-EA4C-160BEF8788AA}" = CCC Help French
"{6DD27E54-2598-0FEC-7CE1-BE00924C0570}" = Catalyst Control Center Graphics Previews Vista
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7C27114E-6FC8-21F5-E501-FE48F09243DF}" = CCC Help Dutch
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{80237C20-CBF3-F841-4AD5-E727AA86FBD1}" = CCC Help Italian
"{802EE127-D32A-1447-09DC-77419772BCDC}" = CCC Help Portuguese
"{836AFA32-7B8B-2C19-99D9-36EF32B42EB8}" = CCC Help Thai
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{90120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PRO_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{946942CB-D078-F33A-A3CD-27E0393507FD}" = CCC Help Turkish
"{9682B99B-BB28-AD37-CA50-C1CB5BFF0FA6}" = Catalyst Control Center Graphics Full New
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9EB46587-4354-411C-BBAC-A9BBB2131F3D}" = FocalPoint 1.0
"{A02CC93A-134F-0319-1438-B1E895B52577}" = CCC Help German
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E1ADB8-162B-7C33-60FB-0561A17BD876}" = CCC Help Spanish
"{A96EEF55-155C-552E-ABB1-6FDAEF5BD944}" = CCC Help Polish
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_940" = Adobe Acrobat 9.4.0 - CPSID_83708
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{ADB25FF0-AEC4-2CFB-130C-2C60D80C5934}" = CCC Help Greek
"{B04D5DA5-11DA-830C-85C6-0FF9185787E7}" = Skins
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{BB603E9F-ECE8-7713-B0AC-7E0614E8C058}" = Catalyst Control Center HydraVision Full
"{BE232D60-AEA5-502F-ACBF-9AC188A82C21}" = CCC Help Finnish
"{C15C4AB5-EF5D-5050-273C-4636E3FBE301}" = CCC Help Czech
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E09CD13D-7CE3-351C-1625-8DC7F21A99C0}" = ccc-core-static
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E373E0E2-20F5-90DF-B315-615EA6E52101}" = Catalyst Control Center Graphics Full Existing
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E6DA746E-1175-88BD-2B16-1DC62018E060}" = CCC Help Chinese Standard
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{F053BFD9-4357-6A82-6042-CF919667448F}" = CCC Help English
"{F17EB02C-DA0D-EDEF-2E16-501FB700A710}" = CCC Help Hungarian
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F5DDC0CD-F13A-83F0-5103-563A17EA306F}" = CCC Help Korean
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aignesamdeadlink_is1" = AM-DeadLink 4.3
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Bokeh" = Alien Skin Bokeh
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"ffdshow_is1" = ffdshow [rev 3268] [2010-02-14]
"HDR Efex Pro" = HDR Efex Pro
"HijackThis" = HijackThis 2.0.2
"HyperSnap 6" = HyperSnap 6
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"IsoBuster_is1" = IsoBuster 2.6
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"Perfectly Clear Plugin" = Perfectly Clear Plugin 1.0.3
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.01.2
"PhotomatixPro3Betax32_is1" = Photomatix Pro version 3.2.5
"PopTray" = PopTray 3.20
"PRO" = Microsoft Office Professional 2007
"Security Task Manager" = Security Task Manager 1.7h
"Sharpener Pro 3.0" = Sharpener Pro 3.0
"Totalcmd" = Total Commander (Remove or Repair)
"TuneUp Utilities" = TuneUp Utilities
"Viveza 2" = Viveza 2
"Winamp" = Winamp
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
OTL Logfile: Code:
ATTFilter OTL logfile created on: 08.11.2010 08:31:16 - Run 1 OTL by OldTimer - Version 3.2.17.3 Folder = D:\Downloads 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 68,00% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 70,07 Gb Total Space | 38,01 Gb Free Space | 54,26% Space Free | Partition Type: NTFS Drive D: | 152,71 Gb Total Space | 68,77 Gb Free Space | 45,03% Space Free | Partition Type: NTFS Drive E: | 221,81 Gb Total Space | 216,06 Gb Free Space | 97,41% Space Free | Partition Type: NTFS Drive F: | 11,02 Gb Total Space | 5,17 Gb Free Space | 46,93% Space Free | Partition Type: NTFS Drive Z: | 10,00 Gb Total Space | 6,48 Gb Free Space | 64,79% Space Free | Partition Type: NTFS Computer Name: CHRIS-PC | User Name: Chris | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - D:\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation) PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation) PRC - C:\Windows\SysWOW64\ASTSRV.EXE (Nalpeiron Ltd.) PRC - C:\Program Files (x86)\PopTray\PopTray.exe (Renier Crause) ========== Modules (SafeList) ========== MOD - D:\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV:64bit: - (astcc) -- C:\Windows\SysNative\astsrv.exe File not found SRV:64bit: - (Ati External Event Utility) -- C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.) SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software) SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (AVP) -- C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO) SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.) SRV - (DLSDB) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.) SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software) SRV - (DLPWD) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (astcc) -- C:\Windows\SysWOW64\ASTSRV.EXE (Nalpeiron Ltd.) ========== Driver Services (SafeList) ========== DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab) DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO) DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO) DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO) DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.) DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof () DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV:64bit: - (e1express) Intel(R) -- C:\Windows\SysNative\drivers\e1e6232e.sys (Intel Corporation) DRV:64bit: - (LVUSBS64) -- C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.) DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.) DRV:64bit: - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\SysNative\drivers\LV302V64.SYS (Logitech Inc.) DRV:64bit: - (lvpepf64) -- C:\Windows\SysNative\drivers\lv302a64.sys (Logitech Inc.) DRV - (Null) -- C:\Windows\SysWow64\NULL () DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FC 25 B4 45 69 77 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "wetter.com" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.web.de" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1 FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.10 FF - prefs.js..extensions.enabledItems: snaplinks@snaplinks.mozdev.org:1.0.8 FF - prefs.js..extensions.enabledItems: {06652CB6-16D0-4e7a-BF2D-E0037A87E57A}:0.2.5 FF - prefs.js..extensions.enabledItems: {e1c8879e-9db4-4adf-92d2-d4856bd434ef}:1.1.9.2 FF - prefs.js..extensions.enabledItems: {ec268e28-22c6-4a6c-ac22-635cabee283c}:1.0.1 FF - prefs.js..extensions.enabledItems: pl@dictionaries.addons.mozilla.org:1.0.20100911 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8 FF - prefs.js..extensions.enabledItems: {81514210-E22A-4e69-93D5-E1EFD45B4620}:0.3.10.01.23 FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.30 12:16:33 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.11.08 00:12:09 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\THBExt [2010.10.29 14:49:24 | 000,000,000 | ---D | M] [2010.10.29 14:02:44 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions [2010.11.07 21:44:26 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions [2010.10.30 11:37:22 | 000,000,000 | ---D | M] (Locate in Bookmark Folders) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{06652CB6-16D0-4e7a-BF2D-E0037A87E57A} [2010.10.29 16:30:19 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} [2010.11.05 16:56:51 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a} [2010.10.29 16:28:20 | 000,000,000 | ---D | M] (Past Modern) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{81514210-E22A-4e69-93D5-E1EFD45B4620} [2010.11.03 12:43:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2010.10.31 08:01:20 | 000,000,000 | ---D | M] (text/plain) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{e1c8879e-9db4-4adf-92d2-d4856bd434ef} [2010.10.31 08:04:29 | 000,000,000 | ---D | M] (Plain Text Links) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{ec268e28-22c6-4a6c-ac22-635cabee283c} [2010.11.01 21:13:31 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\pl@dictionaries.addons.mozilla.org [2010.10.29 16:37:38 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\snaplinks@snaplinks.mozdev.org [2010.10.30 12:49:05 | 000,002,255 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\jseekovh.default\searchplugins\askcom.xml [2010.11.02 19:55:35 | 000,003,470 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\jseekovh.default\searchplugins\wettercom.xml [2010.11.07 21:44:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions [2010.11.05 14:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.11.05 14:15:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2010.06.29 05:01:22 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll [2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.11.06 21:54:07 | 000,001,080 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\ievkbd.dll (Kaspersky Lab ZAO) O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ievkbd.dll (Kaspersky Lab ZAO) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO) O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO) O4 - HKLM..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKCU..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft) O4 - Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk = C:\Program Files (x86)\PopTray\PopTray.exe (Renier Crause) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 03 0F FF 03 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft) O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm () O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated) O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO) O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO) O13 - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\x64\kloehk.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\x64\kloehk.dll (Kaspersky Lab ZAO) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\x64\sbhook64.dll acaptuser64.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\x64\sbhook64.dll acaptuser64.dll File not found O20 - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab ZAO) O20 - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll File not found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 0 O34 - HKLM BootExecute: (autocheck autochk /p \??\M:) - File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.11.08 00:25:59 | 000,024,416 | R--- | C] (Adobe Systems Inc.) -- C:\Windows\SysNative\AdobePDFUI.dll [2010.11.08 00:23:59 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Malwarebytes [2010.11.08 00:23:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys [2010.11.08 00:23:32 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2010.11.08 00:23:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2010.11.08 00:23:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2010.11.08 00:19:22 | 000,112,056 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\acaptuser32.dll [2010.11.07 23:03:44 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2010.11.07 23:03:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Security Task Manager [2010.11.07 22:10:18 | 000,052,568 | ---- | C] (Adobe Systems Inc) -- C:\Windows\SysNative\AdobePDF.dll [2010.11.07 21:27:43 | 000,000,000 | ---D | C] -- C:\Programme\KLCP64 [2010.11.07 21:21:51 | 000,839,680 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\Windows\SysWow64\lameACM.acm [2010.11.07 21:21:50 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll [2010.11.07 21:21:50 | 000,118,784 | ---- | C] (fccHandler) -- C:\Windows\SysWow64\ac3acm.acm [2010.11.07 21:21:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\K-Lite Codec Pack [2010.11.07 12:10:11 | 000,000,000 | ---D | C] -- C:\Windows\Sun [2010.11.07 10:46:43 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Google [2010.11.07 10:44:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google [2010.11.06 23:42:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works [2010.11.06 23:42:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio [2010.11.06 23:42:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER [2010.11.06 23:42:23 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2010.11.06 23:40:48 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office [2010.11.06 23:40:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2010.11.06 23:38:28 | 000,000,000 | RH-D | C] -- C:\MSOCache [2010.11.05 16:06:16 | 000,000,000 | ---D | C] -- C:\Users\Chris\SamyGoTemp [2010.11.05 14:16:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2010.11.05 14:16:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java [2010.11.05 14:15:54 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll [2010.11.05 14:15:54 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.11.05 14:15:54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.11.05 14:15:54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.11.05 14:15:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java [2010.11.05 10:53:58 | 000,192,832 | ---- | C] (Dell Inc.) -- C:\Windows\SysNative\dlsrm.dll [2010.11.05 10:53:15 | 000,000,000 | ---D | C] -- C:\Programme\Dell Printers [2010.11.03 20:15:53 | 000,000,000 | ---D | C] -- C:\Windows\Minidump [2010.11.03 19:23:37 | 000,180,736 | ---- | C] (Dell Inc.) -- C:\Windows\SysNative\dlhsmzil.dll [2010.11.03 12:15:31 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Nik Software [2010.11.01 21:01:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audiograbber [2010.10.31 09:07:34 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\aignes [2010.10.31 09:07:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AM-DeadLink [2010.10.30 17:06:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0 [2010.10.30 12:19:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\totalcmd [2010.10.30 12:19:44 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\GHISLER [2010.10.30 12:16:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com [2010.10.30 12:16:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Smart Projects [2010.10.30 10:52:32 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\onOne Software [2010.10.30 10:52:30 | 000,000,000 | ---D | C] -- C:\ProgramData\onOne Software [2010.10.30 10:52:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\onOne Software [2010.10.30 10:45:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\Documents\Aufnahmen [2010.10.30 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\phonostar GmbH [2010.10.30 10:45:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\phonostar-Player [2010.10.30 10:40:41 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Athentech [2010.10.30 10:38:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Athentech [2010.10.30 10:33:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotomatixPro3 [2010.10.30 10:24:07 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Alien Skin [2010.10.30 10:11:35 | 000,057,344 | ---- | C] (Nalpeiron Ltd.) -- C:\Windows\SysWow64\ASTSRV.EXE [2010.10.30 10:11:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Alien Skin [2010.10.30 09:04:51 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\skypePM [2010.10.30 09:02:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2010.10.30 09:02:29 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype [2010.10.30 09:02:29 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Skype [2010.10.30 09:02:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2010.10.30 08:48:10 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Nero [2010.10.30 08:42:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero [2010.10.30 08:38:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero [2010.10.30 08:37:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero [2010.10.30 08:32:14 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll [2010.10.30 08:31:53 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll [2010.10.30 08:31:33 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll [2010.10.30 08:31:12 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll [2010.10.30 08:30:52 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll [2010.10.29 23:27:53 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2010.10.29 23:27:53 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Adobe Mini Bridge CS5 [2010.10.29 22:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Nik Software [2010.10.29 22:41:35 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Imagenomic [2010.10.29 22:05:06 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Nik Software [2010.10.29 21:54:58 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe [2010.10.29 21:25:37 | 000,033,608 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe [2010.10.29 21:25:31 | 000,036,168 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\uxtuneup.dll [2010.10.29 21:25:31 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\uxtuneup.dll [2010.10.29 21:25:31 | 000,025,928 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll [2010.10.29 21:25:30 | 000,021,320 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll [2010.10.29 21:25:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\TuneUp Software [2010.10.29 21:24:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2010 [2010.10.29 21:23:54 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2010.10.29 21:23:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC} [2010.10.29 21:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet [2010.10.29 20:58:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared [2010.10.29 20:42:13 | 000,000,000 | ---D | C] -- C:\Windows\MSSecurityNS [2010.10.29 20:42:13 | 000,000,000 | ---D | C] -- C:\Windows\MSSecurityNi [2010.10.29 20:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\winrar [2010.10.29 20:30:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\ACD Systems [2010.10.29 20:30:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\ACD Systems [2010.10.29 20:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\ACD Systems [2010.10.29 20:29:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ACD Systems [2010.10.29 20:20:01 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Downloaded Installations [2010.10.29 20:04:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ffdshow [2010.10.29 20:02:16 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Media Player Classic [2010.10.29 19:56:52 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll [2010.10.29 19:56:51 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll [2010.10.29 19:56:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect [2010.10.29 19:55:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine [2010.10.29 19:55:54 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Winamp [2010.10.29 19:55:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp [2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\ATI [2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\ATI [2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2010.10.29 19:47:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies [2010.10.29 18:41:35 | 000,000,000 | ---D | C] -- C:\Programme\ATI Technologies [2010.10.29 18:41:32 | 000,000,000 | ---D | C] -- C:\Programme\ATI [2010.10.29 18:38:11 | 000,000,000 | -H-D | C] -- C:\ATI [2010.10.29 17:44:53 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe [2010.10.29 16:54:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player [2010.10.29 16:52:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR [2010.10.29 16:52:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe [2010.10.29 16:47:27 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Macromedia [2010.10.29 16:47:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe [2010.10.29 16:47:10 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Adobe [2010.10.29 16:47:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe [2010.10.29 16:46:42 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Adobe [2010.10.29 16:34:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2010.10.29 15:56:47 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\T-Online [2010.10.29 15:42:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PopTray [2010.10.29 15:41:27 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2010.10.29 15:41:09 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2010.10.29 15:41:09 | 000,000,000 | ---D | C] -- C:\ProgramData\T-Online [2010.10.29 15:40:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2010.10.29 15:29:53 | 001,942,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dfshim.dll [2010.10.29 15:29:53 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll [2010.10.29 15:29:53 | 000,320,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHost.exe [2010.10.29 15:29:53 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe [2010.10.29 15:29:53 | 000,109,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHostProxy.dll [2010.10.29 15:29:53 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll [2010.10.29 15:29:53 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll [2010.10.29 15:29:53 | 000,048,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netfxperf.dll [2010.10.29 15:28:54 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2010.10.29 15:19:55 | 000,702,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2010.10.29 15:19:54 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll [2010.10.29 15:19:53 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll [2010.10.29 15:19:53 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll [2010.10.29 15:19:53 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2010.10.29 15:19:53 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll [2010.10.29 15:19:53 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll [2010.10.29 15:19:52 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec [2010.10.29 15:19:52 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec [2010.10.29 15:19:52 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2010.10.29 15:19:52 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2010.10.29 15:19:52 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2010.10.29 15:19:52 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe [2010.10.29 15:19:52 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe [2010.10.29 15:19:50 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msasn1.dll [2010.10.29 15:19:44 | 001,446,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll [2010.10.29 15:19:20 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll [2010.10.29 15:19:20 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll [2010.10.29 15:19:20 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll [2010.10.29 15:19:20 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll [2010.10.29 15:19:20 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll [2010.10.29 15:19:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll [2010.10.29 15:19:11 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys [2010.10.29 15:19:08 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll [2010.10.29 15:19:08 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll [2010.10.29 15:19:08 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll [2010.10.29 15:19:08 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax [2010.10.29 15:19:08 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax [2010.10.29 15:19:08 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax [2010.10.29 15:19:07 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll [2010.10.29 15:19:07 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll [2010.10.29 15:19:07 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax [2010.10.29 15:18:52 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe [2010.10.29 15:18:51 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe [2010.10.29 15:18:51 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe [2010.10.29 15:18:42 | 001,975,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CertEnroll.dll [2010.10.29 15:18:42 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CertEnroll.dll [2010.10.29 15:18:36 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll [2010.10.29 15:18:35 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll [2010.10.29 15:18:29 | 014,627,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll [2010.10.29 15:18:27 | 011,406,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll [2010.10.29 15:18:25 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL [2010.10.29 15:18:24 | 012,625,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL [2010.10.29 15:18:21 | 000,422,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll [2010.10.29 15:18:21 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc.dll [2010.10.29 15:18:21 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_isv.dll [2010.10.29 15:18:20 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll [2010.10.29 15:18:20 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_isv.exe [2010.10.29 15:18:20 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate.exe [2010.10.29 15:18:20 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_isv.exe [2010.10.29 15:18:20 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate.exe [2010.10.29 15:18:20 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp.exe [2010.10.29 15:18:20 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp_isv.exe [2010.10.29 15:18:20 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp.exe [2010.10.29 15:18:20 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp_isv.exe [2010.10.29 15:18:20 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll [2010.10.29 15:18:20 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll [2010.10.29 15:18:20 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp_isv.dll [2010.10.29 15:18:20 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp.dll [2010.10.29 15:18:16 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe [2010.10.29 15:18:16 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe [2010.10.29 15:18:16 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winlogon.exe [2010.10.29 15:18:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET [2010.10.29 15:18:14 | 002,085,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll [2010.10.29 15:18:09 | 001,736,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll [2010.10.29 15:18:08 | 001,024,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll [2010.10.29 15:18:08 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll [2010.10.29 15:18:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll [2010.10.29 15:18:06 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll [2010.10.29 15:18:04 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll [2010.10.29 15:18:03 | 001,572,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll [2010.10.29 15:18:03 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll [2010.10.29 15:18:03 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\avifil32.dll [2010.10.29 15:18:03 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mciavi32.dll [2010.10.29 15:17:57 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll [2010.10.29 15:17:56 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll [2010.10.29 15:17:55 | 000,148,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll [2010.10.29 15:17:55 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll [2010.10.29 15:17:54 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2010.10.29 15:17:51 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2010.10.29 15:17:51 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2010.10.29 15:17:46 | 000,483,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\StructuredQuery.dll [2010.10.29 15:17:44 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll [2010.10.29 15:17:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe [2010.10.29 15:17:44 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll [2010.10.29 15:17:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe [2010.10.29 15:17:44 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll [2010.10.29 15:17:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe [2010.10.29 15:17:43 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rtutils.dll [2010.10.29 15:17:43 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rtutils.dll [2010.10.29 15:14:56 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Microsoft Help [2010.10.29 15:14:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help [2010.10.29 14:49:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Meine Programme [2010.10.29 14:49:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2010.10.29 14:49:08 | 000,556,120 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys [2010.10.29 14:47:47 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2010.10.29 14:47:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files [2010.10.29 14:44:36 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010.10.29 14:38:06 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\WinRAR [2010.10.29 14:37:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Formats [2010.10.29 14:21:05 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2010.10.29 14:02:40 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Mozilla [2010.10.29 14:02:40 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Mozilla [2010.10.29 14:02:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2010.10.29 14:01:50 | 000,000,000 | ---D | C] -- C:\Programme\Meine Programme [2010.10.29 13:32:28 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\logishrd [2010.10.29 13:32:05 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cabview.dll [2010.10.29 13:32:05 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cabview.dll [2010.10.29 13:32:04 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll [2010.10.29 13:32:04 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wintrust.dll [2010.10.29 13:30:30 | 000,000,000 | R--D | C] -- C:\Users\Chris\Searches [2010.10.29 13:30:22 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Identities [2010.10.29 13:30:20 | 000,000,000 | R--D | C] -- C:\Users\Chris\Contacts [2010.10.29 13:30:18 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\VirtualStore [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Vorlagen [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Verlauf [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Temporary Internet Files [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Startmenü [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\SendTo [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Recent [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Netzwerkumgebung [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Lokale Einstellungen [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Videos [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Musik [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Eigene Dateien [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Bilder [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Druckumgebung [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Cookies [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Anwendungsdaten [2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Anwendungsdaten [2010.10.29 13:30:05 | 000,000,000 | --SD | C] -- C:\Users\Chris\AppData\Roaming\Microsoft [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Videos [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Saved Games [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Pictures [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Music [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Links [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Favorites [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Downloads [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Documents [2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Desktop [2010.10.29 13:30:05 | 000,000,000 | -H-D | C] -- C:\Users\Chris\AppData [2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Temp [2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Microsoft [2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Media Center Programs [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Recovery [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Programme [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2010.10.29 13:29:44 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2010.10.29 13:24:43 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2010.10.29 13:22:01 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2010.10.29 13:21:45 | 000,000,000 | -HSD | C] -- C:\System Volume Information ========== Files - Modified Within 30 Days ========== [2010.11.08 08:34:29 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2010.11.08 08:34:29 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2010.11.08 08:34:02 | 001,507,106 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2010.11.08 08:34:02 | 000,657,438 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2010.11.08 08:34:02 | 000,618,714 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2010.11.08 08:34:02 | 000,130,810 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2010.11.08 08:34:02 | 000,107,034 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2010.11.08 08:30:06 | 000,024,697 | -H-- | M] () -- C:\Users\Chris\AppData\Roaming\Chrislog.dat [2010.11.08 08:27:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010.11.08 08:26:55 | 3169,255,424 | -HS- | M] () -- C:\hiberfil.sys [2010.11.08 00:23:39 | 000,001,016 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.11.07 11:54:57 | 004,909,256 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2010.11.07 10:46:44 | 000,002,219 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk [2010.11.07 10:42:51 | 000,063,141 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Chris3SQLite3.dll [2010.11.07 10:42:15 | 000,000,000 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\chrtmp [2010.11.07 10:41:40 | 000,000,034 | ---- | M] () -- C:\Windows\cdplayer.ini [2010.11.06 07:57:13 | 000,010,225 | ---- | M] () -- C:\Users\Chris\Documents\Viel Schönes soll euch die Zukunft bringen.docx [2010.11.05 16:15:40 | 000,000,639 | ---- | M] () -- C:\Users\Chris\Desktop\SamyGO.lnk [2010.11.05 14:15:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll [2010.11.05 14:15:40 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe [2010.11.05 14:15:40 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe [2010.11.05 14:15:40 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe [2010.11.05 10:53:59 | 000,001,249 | ---- | M] () -- C:\Users\Public\Desktop\Bestellen von Druckerverbrauchsmaterial.lnk [2010.11.01 21:01:55 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Audiograbber.lnk [2010.10.31 09:07:18 | 000,000,965 | ---- | M] () -- C:\Users\Chris\Desktop\AM-DeadLink.lnk [2010.10.30 12:19:44 | 000,001,040 | ---- | M] () -- C:\Users\Chris\Desktop\Total Commander.lnk [2010.10.30 10:45:17 | 000,000,995 | ---- | M] () -- C:\Users\Chris\Desktop\phonostar-Player.lnk [2010.10.30 10:33:40 | 000,001,987 | ---- | M] () -- C:\Users\Chris\Desktop\Photomatix Pro 3.lnk [2010.10.30 09:46:58 | 000,001,040 | ---- | M] () -- C:\Users\Chris\Desktop\Hyper Snap.lnk [2010.10.30 09:30:41 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2010.10.30 09:05:00 | 000,000,048 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.10.30 08:51:04 | 000,002,961 | ---- | M] () -- C:\Users\Chris\Desktop\Nero.lnk [2010.10.29 23:04:31 | 000,003,072 | ---- | M] () -- C:\Windows\SysWow64\Viveza2FC32.dll [2010.10.29 21:25:22 | 000,002,214 | ---- | M] () -- C:\Users\Public\Desktop\1-Klick.lnk [2010.10.29 21:25:22 | 000,002,172 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk [2010.10.29 15:56:01 | 001,499,556 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.10.29 15:42:59 | 000,001,027 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk [2010.10.29 15:41:36 | 000,001,722 | ---- | M] () -- C:\Windows\SysWow64\NULL [2010.10.29 14:57:05 | 000,000,355 | ---- | M] () -- C:\Users\Chris\Desktop\Computer.lnk [2010.10.29 14:56:02 | 000,556,120 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys [2010.10.29 14:49:47 | 000,149,773 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat [2010.10.29 14:49:47 | 000,106,765 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat [2010.10.29 14:02:41 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat [2010.10.29 14:02:38 | 000,001,939 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.10.29 13:26:00 | 000,057,050 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2010.10.29 13:26:00 | 000,057,050 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2010.10.29 13:24:42 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin [2010.10.29 13:24:02 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.10.18 19:00:00 | 000,136,704 | ---- | M] () -- C:\Windows\SysNative\ff_vfw.dll [2010.10.13 16:16:02 | 000,004,096 | ---- | M] () -- C:\Windows\SysWow64\HDREfexProFC64.dll [2010.10.13 16:16:02 | 000,004,096 | ---- | M] () -- C:\Windows\SysNative\HDREfexProFC64.dll [2010.10.12 13:28:46 | 000,002,560 | ---- | M] () -- C:\Windows\SysWow64\HDREfexProFC32.dll [2010.10.12 13:28:46 | 000,002,560 | ---- | M] () -- C:\Windows\SysNative\HDREfexProFC32.dll ========== Files Created - No Company Name ========== [2010.11.08 00:23:39 | 000,001,016 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2010.11.07 21:27:46 | 000,191,488 | ---- | C] () -- C:\Windows\SysNative\unrar.dll [2010.11.07 21:27:45 | 000,136,704 | ---- | C] () -- C:\Windows\SysNative\ff_vfw.dll [2010.11.07 21:21:53 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2010.11.07 21:21:52 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2010.11.07 21:21:51 | 000,000,414 | ---- | C] () -- C:\Windows\SysWow64\lame_acm.xml [2010.11.07 21:21:50 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2010.11.07 21:21:50 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2010.11.07 10:46:44 | 000,002,219 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk [2010.11.07 10:42:51 | 000,063,141 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\Chris3SQLite3.dll [2010.11.07 10:42:15 | 000,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\chrtmp [2010.11.06 07:57:12 | 000,010,225 | ---- | C] () -- C:\Users\Chris\Documents\Viel Schönes soll euch die Zukunft bringen.docx [2010.11.05 16:15:40 | 000,000,639 | ---- | C] () -- C:\Users\Chris\Desktop\SamyGO.lnk [2010.11.05 10:53:59 | 000,001,249 | ---- | C] () -- C:\Users\Public\Desktop\Bestellen von Druckerverbrauchsmaterial.lnk [2010.11.03 12:35:34 | 000,004,096 | ---- | C] () -- C:\Windows\SysNative\HDREfexProFC64.dll [2010.11.03 12:35:16 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\HDREfexProFC32.dll [2010.11.03 12:18:33 | 000,002,560 | ---- | C] () -- C:\Windows\SysNative\HDREfexProFC32.dll [2010.11.03 12:18:12 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\HDREfexProFC64.dll [2010.11.01 21:04:40 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini [2010.11.01 21:01:55 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Audiograbber.lnk [2010.10.31 09:07:18 | 000,000,965 | ---- | C] () -- C:\Users\Chris\Desktop\AM-DeadLink.lnk [2010.10.30 12:19:44 | 000,001,040 | ---- | C] () -- C:\Users\Chris\Desktop\Total Commander.lnk [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\UC.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\RAR.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\PKZIP.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\PKUNZIP.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\NOCLOSE.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\LHA.PIF [2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\ARJ.PIF [2010.10.30 10:45:17 | 000,000,995 | ---- | C] () -- C:\Users\Chris\Desktop\phonostar-Player.lnk [2010.10.30 10:33:40 | 000,001,987 | ---- | C] () -- C:\Users\Chris\Desktop\Photomatix Pro 3.lnk [2010.10.30 09:46:58 | 000,001,040 | ---- | C] () -- C:\Users\Chris\Desktop\Hyper Snap.lnk [2010.10.30 09:05:00 | 000,000,048 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat [2010.10.30 09:02:30 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2010.10.30 08:51:04 | 000,002,961 | ---- | C] () -- C:\Users\Chris\Desktop\Nero.lnk [2010.10.29 21:25:22 | 000,002,214 | ---- | C] () -- C:\Users\Public\Desktop\1-Klick.lnk [2010.10.29 21:25:22 | 000,002,172 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk [2010.10.29 20:04:04 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2010.10.29 18:01:44 | 000,000,003 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\text.txt [2010.10.29 15:56:01 | 001,499,556 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2010.10.29 15:42:59 | 000,001,027 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk [2010.10.29 15:41:36 | 000,001,722 | ---- | C] () -- C:\Windows\SysWow64\NULL [2010.10.29 14:57:05 | 000,000,355 | ---- | C] () -- C:\Users\Chris\Desktop\Computer.lnk [2010.10.29 14:49:47 | 000,149,773 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat [2010.10.29 14:49:47 | 000,106,765 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat [2010.10.29 14:37:55 | 000,166,400 | ---- | C] () -- C:\Program Files (x86)\RarExt.dll [2010.10.29 14:02:41 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.10.29 14:02:38 | 000,001,939 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2010.10.29 13:24:42 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010.10.29 13:24:02 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2010.10.29 13:21:45 | 3169,255,424 | -HS- | C] () -- C:\hiberfil.sys [2009.12.18 10:58:28 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\Viveza2FC32.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2006.06.21 03:54:26 | 000,024,697 | -H-- | C] () -- C:\Users\Chris\AppData\Roaming\Chrislog.dat < End of report > mfg chrismio |
|
08.11.2010, 09:31
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | svchost.exe ProblemZitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu svchost.exe Problem |
| .exe problem, adobe, bho, explorer, firefox, hijack, internet, internet explorer, kaspersky, logfile, lsass.exe, löschen, microsoft, monitor, mozilla, nicht sicher, pdf, plug-in, problem, programme, security, software, svchost.exe, syswow64, tastatur, windows, windows media player, wmp |
Hybrid-Darstellung
