| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Buzus.cjzhWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.01.2011, 15:25
| #1 |
| |  TR/Buzus.cjzh Hallo, ich habe ein Problem: Und zwar kann ich seit vorgestern kein Webbroser außer Internetexplorer mehr öffnen. Auch mehrfaches deinstallieren und aufspielen von Mozilla Firefox hat nichts gebracht. Darauf hin habe ich AntiVir drüberlaufen lassen, das brachte folgendes Ergbniss: Die Datei 'C:\Users\***\Downloads\qosdemo-ch.zip' enthielt einen Virus oder unerwünschtes Programm 'TR/Buzus.cjzh' [trojan]. Durchgeführte Aktion(en): Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e472c59.qua' verschoben! Aus der Quarantäne habe ich den Trojaner dann gelöscht. Meine Browser funktioniern immer noch nicht. Ist der Trojaner noch auf dem Rechner? Ich habe Windows Vista. ICh habe mir vorhin HijackThis heruntergeladen, weiß jedohc nicht ob mit das Programm etwas bringt.... Bitte helft mir!! Danke im Vorraus! |
|
01.01.2011, 19:15
| #2 |
| | TR/Buzus.cjzh kann mir keiner helfen?
__________________Bitte ich benötige dringend hilfe!!! |
|
02.01.2011, 11:48
| #3 |
| /// Malware-holic   | TR/Buzus.cjzh wenn du dir selbst antwortest dauerts noch länger.
__________________und schau dich mal um, wie viele hilfesuchenden es gibt, und wie viele helfer. da kanns schon mal 1 2 tage dauern bis man ne antwort bekommt. Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten.
__________________ |
|
02.01.2011, 13:04
| #4 |
| | TR/Buzus.cjzh so... zuerst die Otl.Txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 02.01.2011 12:06:13 - Run 1 OTL by OldTimer - Version 3.2.20.0 Folder = C:\Users\Gross\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 40,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 70,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 275,41 Gb Total Space | 154,50 Gb Free Space | 56,10% Space Free | Partition Type: NTFS Drive D: | 22,66 Gb Total Space | 12,53 Gb Free Space | 55,28% Space Free | Partition Type: FAT32 Drive G: | 931,51 Gb Total Space | 781,82 Gb Free Space | 83,93% Space Free | Partition Type: NTFS Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.01.02 12:04:33 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Downloads\OTL.exe PRC - [2010.12.26 17:38:44 | 000,069,000 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Programme\EASEUS\Todo Backup 2.0\bin\EuWatch.exe PRC - [2010.12.26 17:38:44 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Programme\EASEUS\Todo Backup 2.0\bin\Agent.exe PRC - [2010.12.26 17:38:40 | 001,746,824 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Programme\EASEUS\Todo Backup 2.0\bin\TBConsoleUI.exe PRC - [2010.12.26 17:38:40 | 000,516,488 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Programme\EASEUS\Todo Backup 2.0\bin\Loader.exe PRC - [2010.12.26 17:38:38 | 000,076,168 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Programme\EASEUS\Todo Backup 2.0\bin\TbService.exe PRC - [2010.12.22 13:14:14 | 000,267,944 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2010.12.03 10:05:32 | 001,389,400 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe PRC - [2010.12.03 10:05:32 | 000,930,032 | ---- | M] (Lavasoft) -- C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe PRC - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) -- C:\Programme\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe PRC - [2010.10.06 12:39:27 | 002,002,728 | ---- | M] (TeamViewer GmbH) -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe PRC - [2010.08.02 16:09:38 | 000,135,336 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2010.08.02 16:09:32 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2010.01.14 16:08:16 | 000,378,128 | ---- | M] (PC Tools) -- C:\Programme\ThreatFire\TFTray.exe PRC - [2010.01.14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) -- C:\Programme\ThreatFire\TFService.exe PRC - [2009.11.10 10:23:33 | 000,323,392 | ---- | M] (BitTorrent, Inc.) -- C:\Users\Gross\Program Files\DNA\btdna.exe PRC - [2009.08.18 11:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2009.08.18 11:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2009.04.11 07:27:44 | 000,636,080 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe PRC - [2009.04.11 07:27:39 | 000,299,520 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\ieuser.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.10.25 10:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe PRC - [2008.02.28 17:07:58 | 001,828,136 | ---- | M] (Nero AG) -- C:\Programme\Common Files\Nero\Lib\NMIndexStoreSvr.exe PRC - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2008.01.21 03:25:33 | 000,202,240 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnscfg.exe PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe PRC - [2008.01.21 03:23:32 | 000,319,544 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe PRC - [2007.11.02 11:31:24 | 000,069,632 | ---- | M] () -- C:\Programme\Softex\OmniPass\opvapp.exe PRC - [2007.11.02 11:31:08 | 000,040,960 | ---- | M] (Softex Inc.) -- C:\Programme\Softex\OmniPass\OmniServ.exe PRC - [2007.10.03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe PRC - [2007.10.03 14:44:58 | 000,178,712 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe PRC - [2007.09.11 14:37:58 | 000,118,784 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\WisLMSvc.exe PRC - [2007.09.07 08:26:54 | 000,086,016 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\WButton.exe PRC - [2007.09.06 10:23:36 | 000,188,416 | ---- | M] (Wistron) -- C:\Programme\Launch Manager\HotkeyApp.exe PRC - [2007.09.01 13:03:50 | 000,032,768 | ---- | M] () -- C:\Programme\Launch Manager\LaunchAp.exe PRC - [2007.08.31 11:04:26 | 000,102,400 | ---- | M] (Synaptics, Inc.) -- C:\Programme\Synaptics\SynTP\SynTPStart.exe PRC - [2006.12.26 10:23:34 | 000,180,224 | ---- | M] (Wistron Corp.) -- C:\Programme\Launch Manager\OSD.exe ========== Modules (SafeList) ========== MOD - [2011.01.02 12:04:33 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\Gross\Downloads\OTL.exe MOD - [2010.08.31 16:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll MOD - [2010.01.14 16:08:22 | 000,460,048 | ---- | M] (PC Tools) -- C:\Programme\ThreatFire\TFWAH.dll ========== Win32 Services (SafeList) ========== SRV - [2010.12.26 17:38:44 | 000,055,688 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Auto | Running] -- C:\Programme\EASEUS\Todo Backup 2.0\bin\Agent.exe -- (EASEUS Agent) SRV - [2010.12.22 13:14:14 | 000,267,944 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2010.12.09 09:31:41 | 003,020,888 | ---- | M] () [Auto | Running] -- c:\Programme\Common Files\Akamai\netsession_win_aeec0f0.dll -- (Akamai) SRV - [2010.12.03 10:05:32 | 001,389,400 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2010.10.16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device) SRV - [2010.10.06 12:39:27 | 002,002,728 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5) SRV - [2010.08.02 16:09:38 | 000,135,336 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.06.24 09:34:47 | 000,030,192 | ---- | M] (Google) [On_Demand | Stopped] -- C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe -- (GoogleDesktopManager-051210-111108) SRV - [2010.03.18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.01.14 16:08:12 | 000,070,928 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\ThreatFire\TFService.exe -- (ThreatFire) SRV - [2009.12.16 18:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.11.02 11:31:08 | 000,040,960 | ---- | M] (Softex Inc.) [Auto | Running] -- C:\Programme\Softex\OmniPass\OmniServ.exe -- (omniserv) SRV - [2007.10.25 14:27:54 | 000,266,240 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe -- (WLSetupSvc) SRV - [2007.10.03 14:45:02 | 000,358,936 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2007.09.11 14:37:58 | 000,118,784 | ---- | M] (Wistron Corp.) [On_Demand | Running] -- C:\Program Files\Launch Manager\WisLMSvc.exe -- (WisLMSvc) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2010.12.26 17:38:34 | 000,021,896 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\eufs.sys -- (EUFS) DRV - [2010.12.26 17:38:30 | 000,015,240 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\eudskacs.sys -- (EUDSKACS) DRV - [2010.12.26 17:38:26 | 000,031,112 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\eubakup.sys -- (EUBAKUP) DRV - [2010.12.26 17:38:24 | 000,188,296 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EuDisk.sys -- (EuDisk) DRV - [2010.12.22 13:14:16 | 000,135,096 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2010.12.03 10:05:34 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\Lbd.sys -- (Lbd) DRV - [2010.12.03 10:05:33 | 000,015,264 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer) DRV - [2010.09.30 22:25:16 | 000,030,376 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\System32\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.02.06 18:03:41 | 000,279,712 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2010.02.06 18:03:41 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2010.01.14 16:08:30 | 000,059,664 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\TfSysMon.sys -- (TfSysMon) DRV - [2010.01.14 16:08:28 | 000,051,984 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\TfFsMon.sys -- (TfFsMon) DRV - [2010.01.14 16:08:28 | 000,033,552 | ---- | M] (PC Tools) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\TfNetMon.sys -- (TfNetMon) DRV - [2009.01.19 19:31:56 | 000,277,544 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11) DRV - [2008.07.11 04:08:00 | 007,539,744 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008.07.10 10:12:56 | 001,753,984 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008.03.13 02:36:42 | 002,555,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2008.01.21 03:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008.01.21 03:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008.01.21 03:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008.01.21 03:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008.01.21 03:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008.01.21 03:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008.01.21 03:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008.01.21 03:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008.01.21 03:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008.01.21 03:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008.01.21 03:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008.01.21 03:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008.01.21 03:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008.01.21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008.01.21 03:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008.01.21 03:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008.01.21 03:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008.01.21 03:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008.01.21 03:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008.01.21 03:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008.01.21 03:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008.01.21 03:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008.01.21 03:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2008.01.03 19:35:16 | 000,059,392 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTSTOR.sys -- (RTSTOR) DRV - [2007.11.09 09:14:01 | 000,005,120 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\SSPORT.SYS -- (SSPORT) DRV - [2007.11.09 09:14:00 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\DGIVECP.SYS -- (DgiVecp) DRV - [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2007.08.31 11:42:06 | 000,192,688 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2007.08.30 19:24:24 | 000,805,416 | ---- | M] (Bison Electronics. Inc. ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BisonC07.sys -- (Cam5607) DRV - [2007.08.28 14:47:36 | 000,146,560 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor) DRV - [2007.06.25 12:37:24 | 000,084,480 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.06.01 09:29:04 | 000,210,736 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\Si3531.sys -- (Si3531) DRV - [2007.05.25 08:41:00 | 000,017,328 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\SiWinAcc.sys -- (SiFilter) DRV - [2007.05.25 08:40:58 | 000,012,464 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\SiRemFil.sys -- (SiRemFil) DRV - [2006.11.02 10:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006.11.02 10:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006.11.02 10:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006.11.02 10:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006.11.02 10:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006.11.02 10:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006.11.02 10:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006.11.02 10:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006.11.02 10:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006.11.02 10:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006.11.02 10:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006.11.02 09:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006.11.02 09:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006.11.02 09:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006.11.02 09:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006.11.02 09:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006.11.02 09:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006.11.02 08:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2005.01.04 19:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\npptNT2.sys -- (NPPTNT2) DRV - [2003.04.28 10:27:06 | 000,009,867 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\HOTKEY.sys -- (Hotkey) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/ IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com/ IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/ IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found. O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (kikin Plugin) - {E601996F-E400-41CA-804B-CD6373A7EEE2} - C:\Programme\kikin\ie_kikin.dll (kikin) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - No CLSID value found. O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [EaseUs Watch] C:\Program Files\EASEUS\Todo Backup 2.0\bin\EuWatch.exe (CHENGDU YIWO Tech Development Co., Ltd) O4 - HKLM..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe (Wistron) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe () O4 - HKLM..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe (Wistron Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [SynTPStart] C:\Programme\Synaptics\SynTP\SynTPStart.exe (Synaptics, Inc.) O4 - HKLM..\Run: [ThreatFire] C:\Programme\ThreatFire\TFTray.exe (PC Tools) O4 - HKLM..\Run: [Wbutton] C:\Program Files\Launch Manager\Wbutton.exe (Wistron) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001..\Run: [BitTorrent DNA] C:\Users\Gross\Program Files\DNA\btdna.exe (BitTorrent, Inc.) O4 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O7 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : My kikin - {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - C:\Programme\kikin\ie_kikin.dll (kikin) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O15 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..Trusted Domains: localhost ([]http in Local intranet) O15 - HKU\S-1-5-21-3059421624-3991891353-2127967058-1001\..Trusted Ranges: GD ([http] in Local intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 83.169.185.33 192.168.0.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp O24 - Desktop BackupWallPaper: C:\Users\Gross\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2010.07.10 05:32:52 | 000,000,000 | RH-D | M] - G:\autorun -- [ NTFS ] O32 - Unable to obtain root file information for disk G:\ O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) MsConfig - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Programme\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.) MsConfig - StartUpReg: BitTorrent DNA - hkey= - key= - c:\users\Gross\Program Files\DNA\btdna.exe (BitTorrent, Inc.) MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google) MsConfig - StartUpReg: Google Update - hkey= - key= - C:\Users\Gross\AppData\Local\Google\Update\GoogleUpdate.exe (Google Inc.) MsConfig - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) MsConfig - StartUpReg: LanguageShortcut - hkey= - key= - C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe () MsConfig - StartUpReg: Nikon Transfer Monitor - hkey= - key= - C:\Programme\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation) MsConfig - StartUpReg: OmniPass - hkey= - key= - C:\Programme\Softex\OmniPass\scureapp.exe () MsConfig - StartUpReg: PATHPILOT - hkey= - key= - C:\Program Files\Aktiv MP3 Recorder\Aktiv MP3 Recorder.lnk () MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) MsConfig - StartUpReg: Samsung PanelMgr - hkey= - key= - C:\Windows\Samsung\PanelMgr\SSMMgr.exe () MsConfig - StartUpReg: Sidebar - hkey= - key= - C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) MsConfig - StartUpReg: UCam_Menu - hkey= - key= - C:\Program Files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft) SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vsmon - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfPf - Driver SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 11.0 ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.VP60 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: vidc.VP61 - C:\Windows\System32\vp6vfw.dll (On2.com) Drivers32: vidc.XVID - C:\Windows\System32\xvidvfw.dll () CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.01.01 20:26:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImgBurn [2011.01.01 20:26:57 | 000,000,000 | ---D | C] -- C:\Programme\ImgBurn [2010.12.31 12:31:50 | 000,031,112 | ---- | C] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eubakup.sys [2010.12.31 12:31:50 | 000,021,896 | ---- | C] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eufs.sys [2010.12.31 12:31:50 | 000,015,240 | ---- | C] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eudskacs.sys [2010.12.31 12:31:47 | 000,188,296 | ---- | C] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\EuDisk.sys [2010.12.31 12:31:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EASEUS Todo Backup Home 2.0 [2010.12.31 12:31:29 | 000,018,824 | ---- | C] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\fbnative.exe [2010.12.31 12:31:07 | 000,000,000 | ---D | C] -- C:\Programme\EASEUS [2010.12.30 16:36:41 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Roaming\GlarySoft [2010.12.30 16:35:59 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\tzres.dll [2010.12.30 16:34:57 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2010.12.30 16:34:52 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2010.12.30 16:34:44 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2010.12.30 16:34:42 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2010.12.30 16:34:42 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2010.12.30 16:34:40 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2010.12.30 16:33:23 | 002,038,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2010.12.30 16:33:05 | 000,081,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe [2010.12.30 16:28:44 | 000,352,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskschd.dll [2010.12.30 16:28:42 | 000,345,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wmicmiplugin.dll [2010.12.30 16:28:41 | 000,270,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\taskcomp.dll [2010.12.30 16:27:02 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2010.12.30 16:27:01 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2010.12.30 16:27:00 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\fontsub.dll [2010.12.30 15:37:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ThreatFire [2010.12.30 15:37:53 | 000,059,664 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\TfSysMon.sys [2010.12.30 15:37:52 | 000,051,984 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\TfFsMon.sys [2010.12.30 15:37:52 | 000,033,552 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\TfNetMon.sys [2010.12.30 15:37:44 | 000,000,000 | ---D | C] -- C:\Programme\ThreatFire [2010.12.30 15:37:44 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools [2010.12.30 15:36:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities [2010.12.30 15:36:22 | 000,000,000 | ---D | C] -- C:\Programme\Glary Utilities [2010.12.30 15:20:59 | 000,064,288 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys [2010.12.30 15:20:56 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2010.12.30 15:19:11 | 000,000,000 | ---D | C] -- C:\Users\Gross\AppData\Local\Sunbelt Software [2010.12.30 15:18:44 | 000,000,000 | -H-D | C] -- C:\ProgramData\{2162CCC0-3A5F-4887-B51F-CE5F195B3620} [2010.12.30 15:18:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft [2010.12.30 15:18:06 | 000,000,000 | ---D | C] -- C:\Programme\Lavasoft [2010.12.30 15:18:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2010.12.29 10:31:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2010.12.29 10:31:09 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2010.12.29 10:31:06 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2010.12.29 10:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2010.12.29 10:23:00 | 000,000,000 | ---D | C] -- C:\Programme\QuickTime [2010.12.18 13:45:51 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype [2010.12.18 13:45:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2010.10.05 18:44:50 | 1715,373,010 | ---- | C] (gPotato.eu ) -- C:\Programme\Rappelz_DE_Resurrection.exe [2008.07.25 08:00:57 | 000,176,128 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll [2007.08.13 16:46:00 | 000,102,912 | ---- | C] (Albert L Faber) -- C:\Users\Gross\AppData\Local\CDRip.dll [2007.01.18 20:09:54 | 000,623,616 | ---- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Gross\AppData\Local\No23 Recorder.exe [2006.12.11 18:13:14 | 000,013,872 | ---- | C] (Un4seen Developments) -- C:\Users\Gross\AppData\Local\basscd.dll [2006.12.11 18:13:12 | 000,097,336 | ---- | C] (Un4seen Developments) -- C:\Users\Gross\AppData\Local\bass.dll ========== Files - Modified Within 30 Days ========== [2011.01.02 12:14:59 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{14462773-62BF-4C9E-80EF-1000612E1AF8}.job [2011.01.02 12:12:14 | 000,056,495 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011.01.02 11:50:32 | 000,000,032 | ---- | M] () -- C:\Windows\System32\EUOD.DAT [2011.01.02 11:30:46 | 000,001,052 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2011.01.02 11:27:44 | 000,000,314 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job [2011.01.02 11:27:33 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.01.02 11:27:33 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.01.02 11:27:28 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore1cb753743df350a.job [2011.01.02 11:27:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.01.02 11:26:24 | 3219,578,880 | -HS- | M] () -- C:\hiberfil.sys [2011.01.01 20:26:59 | 000,001,654 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2011.01.01 18:37:41 | 000,056,495 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011.01.01 18:35:30 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{924F89D7-29FA-4FFE-9593-D4625C820CB1}.job [2011.01.01 15:14:08 | 000,002,735 | ---- | M] () -- C:\Users\Gross\Desktop\Microsoft Office Outlook 2007.lnk [2010.12.31 14:05:35 | 000,002,631 | ---- | M] () -- C:\Users\Gross\Desktop\Microsoft Office Word 2007.lnk [2010.12.31 14:05:00 | 000,172,544 | ---- | M] () -- C:\Users\Gross\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010.12.31 12:48:35 | 000,626,790 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2010.12.31 12:48:35 | 000,594,224 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010.12.31 12:48:35 | 000,126,388 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2010.12.31 12:48:35 | 000,104,038 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010.12.31 12:32:49 | 000,194,748 | -HS- | M] () -- C:\EASEUSLD.LDR [2010.12.31 12:31:48 | 000,001,944 | ---- | M] () -- C:\Users\Public\Desktop\EASEUS Todo Backup Home 2.0.lnk [2010.12.30 21:23:38 | 000,419,432 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010.12.30 15:37:59 | 000,000,747 | ---- | M] () -- C:\Users\Public\Desktop\ThreatFire.lnk [2010.12.30 15:36:38 | 000,000,801 | ---- | M] () -- C:\Users\Gross\Desktop\Glary Utilities.lnk [2010.12.30 15:20:56 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2010.12.30 15:18:41 | 000,001,019 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2010.12.30 14:29:00 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3059421624-3991891353-2127967058-1001UA.job [2010.12.30 13:28:00 | 000,001,066 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3059421624-3991891353-2127967058-1001Core.job [2010.12.29 12:32:15 | 000,000,104 | ---- | M] () -- C:\Users\Gross\Desktop\Papierkorb - Verknüpfung.lnk [2010.12.29 10:31:57 | 000,001,668 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk [2010.12.26 17:38:44 | 000,018,824 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\fbnative.exe [2010.12.26 17:38:34 | 000,021,896 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eufs.sys [2010.12.26 17:38:30 | 000,015,240 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eudskacs.sys [2010.12.26 17:38:26 | 000,031,112 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\eubakup.sys [2010.12.26 17:38:24 | 000,188,296 | ---- | M] (CHENGDU YIWO Tech Development Co., Ltd) -- C:\Windows\System32\drivers\EuDisk.sys [2010.12.22 13:14:16 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2010.12.22 13:14:16 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2010.12.20 06:50:28 | 000,001,111 | ---- | M] () -- C:\Users\Gross\Desktop\San Andreas Multiplayer.lnk [2010.12.17 07:24:11 | 000,000,424 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EFB22905-29C6-4783-9128-9FB6050C5887}.job [2010.12.06 20:52:14 | 000,002,673 | ---- | M] () -- C:\Users\Gross\Desktop\Microsoft Office PowerPoint 2007.lnk ========== Files Created - No Company Name ========== [2011.01.01 20:26:59 | 000,001,654 | ---- | C] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2010.12.31 12:44:50 | 000,000,032 | ---- | C] () -- C:\Windows\System32\EUOD.DAT [2010.12.31 12:32:49 | 000,194,748 | -HS- | C] () -- C:\EASEUSLD.LDR [2010.12.31 12:31:48 | 000,001,944 | ---- | C] () -- C:\Users\Public\Desktop\EASEUS Todo Backup Home 2.0.lnk [2010.12.30 20:25:41 | 000,015,880 | ---- | C] () -- C:\Windows\System32\lsdelete.exe [2010.12.30 15:37:59 | 000,000,747 | ---- | C] () -- C:\Users\Public\Desktop\ThreatFire.lnk [2010.12.30 15:36:41 | 000,000,314 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize.job [2010.12.30 15:36:38 | 000,000,801 | ---- | C] () -- C:\Users\Gross\Desktop\Glary Utilities.lnk [2010.12.30 15:18:41 | 000,001,019 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2010.12.30 13:24:04 | 000,001,118 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3059421624-3991891353-2127967058-1001UA.job [2010.12.30 13:23:51 | 000,001,066 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3059421624-3991891353-2127967058-1001Core.job [2010.12.29 12:32:15 | 000,000,104 | ---- | C] () -- C:\Users\Gross\Desktop\Papierkorb - Verknüpfung.lnk [2010.12.29 10:31:57 | 000,001,668 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk [2010.12.20 06:50:28 | 000,001,111 | ---- | C] () -- C:\Users\Gross\Desktop\San Andreas Multiplayer.lnk [2010.12.18 15:00:46 | 000,000,424 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{14462773-62BF-4C9E-80EF-1000612E1AF8}.job [2010.12.16 23:11:14 | 000,000,424 | -H-- | C] () -- C:\Windows\tasks\User_Feed_Synchronization-{EFB22905-29C6-4783-9128-9FB6050C5887}.job [2010.11.07 14:29:52 | 000,000,540 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\AutoGK.ini [2010.10.14 01:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat [2010.08.19 17:24:18 | 000,000,044 | -HS- | C] () -- C:\ProgramData\.zreglib [2010.08.13 12:45:10 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2010.02.06 18:03:41 | 000,279,712 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2010.02.06 18:03:41 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2010.01.17 19:40:32 | 000,000,680 | ---- | C] () -- C:\Users\Gross\AppData\Local\d3d9caps.dat [2010.01.14 17:52:28 | 000,002,554 | ---- | C] () -- C:\Windows\WAVEMIX.INI [2010.01.02 13:42:00 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Application Support [2010.01.02 13:42:00 | 000,000,268 | RH-- | C] () -- C:\Users\Gross\AppData\Roaming\Analog Sync [2010.01.02 13:42:00 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT [2010.01.02 13:42:00 | 000,000,012 | RH-- | C] () -- C:\ProgramData\BSD [2010.01.02 13:36:04 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Applause and Laugher [2010.01.02 13:36:04 | 000,000,268 | RH-- | C] () -- C:\Users\Gross\AppData\Roaming\Analog Pad [2010.01.02 13:36:04 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT [2010.01.02 13:36:04 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Audio Units [2009.10.03 09:49:59 | 000,000,162 | ---- | C] () -- C:\Windows\ae_mini.INI [2009.08.25 17:54:50 | 000,022,723 | ---- | C] () -- C:\Windows\System32\ssp1ml3.dll [2009.08.10 14:52:44 | 000,197,120 | ---- | C] () -- C:\Windows\patchw32.dll [2009.08.07 22:13:33 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.06.10 15:17:42 | 000,000,104 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\Default.PLS [2009.05.29 14:58:39 | 000,172,544 | ---- | C] () -- C:\Users\Gross\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.05.28 19:45:21 | 000,000,466 | ---- | C] () -- C:\Users\Gross\AppData\Roaming\wklnhst.dat [2009.05.26 17:36:57 | 000,001,469 | ---- | C] () -- C:\Users\Gross\AppData\Local\RecConfig.xml [2009.05.26 17:22:58 | 000,056,495 | ---- | C] () -- C:\ProgramData\nvModes.001 [2009.05.26 17:20:25 | 000,056,495 | ---- | C] () -- C:\ProgramData\nvModes.dat [2009.01.25 22:10:48 | 000,179,200 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009.01.09 00:01:22 | 000,629,760 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2008.07.25 08:00:57 | 001,753,984 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2008.07.25 08:00:57 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008.07.25 08:00:57 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini [2008.07.17 13:50:28 | 000,000,381 | ---- | C] () -- C:\Windows\WISO.INI [2008.07.17 10:54:02 | 000,009,867 | ---- | C] () -- C:\Windows\System32\drivers\HOTKEY.sys [2008.07.17 08:35:24 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2008.07.17 07:04:27 | 000,015,190 | ---- | C] () -- C:\Windows\M3000Twn.ini [2008.07.14 10:32:16 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2007.08.13 16:46:00 | 000,155,136 | ---- | C] () -- C:\Users\Gross\AppData\Local\lame_enc.dll [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.10.26 00:06:48 | 000,064,000 | ---- | C] () -- C:\Users\Gross\AppData\Local\vorbisenc.dll [2006.10.26 00:06:48 | 000,019,456 | ---- | C] () -- C:\Users\Gross\AppData\Local\vorbisfile.dll [2006.10.26 00:06:46 | 000,143,872 | ---- | C] () -- C:\Users\Gross\AppData\Local\vorbis.dll [2006.10.26 00:06:36 | 000,015,872 | ---- | C] () -- C:\Users\Gross\AppData\Local\ogg.dll [2005.08.23 21:34:06 | 000,029,184 | ---- | C] () -- C:\Users\Gross\AppData\Local\no23xwrapper.dll [2004.07.29 00:19:46 | 000,175,104 | ---- | C] () -- C:\Windows\System32\lame_enc.dll [2002.10.15 23:54:04 | 000,153,088 | ---- | C] () -- C:\Windows\System32\unrar.dll ========== LOP Check ========== [2009.06.28 20:17:28 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\.purple [2009.08.10 14:59:27 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Atari [2009.08.01 13:48:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Audio Recorder for Free [2010.02.28 15:14:52 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Buhl Data Service GmbH [2010.11.30 18:08:44 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\CheckPoint [2009.12.16 17:58:07 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\COMPUTERBILD-Abzockschutz [2011.01.02 12:10:20 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\DNA [2010.10.24 13:01:09 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers [2010.01.22 20:32:55 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\FOG Downloader [2009.05.26 18:23:38 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Free Sound Recorder [2010.10.29 21:27:52 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\GetRightToGo [2010.12.30 16:36:41 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\GlarySoft [2010.03.07 12:23:57 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\gtk-2.0 [2010.11.07 14:03:37 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\HandBrake [2010.12.30 21:19:47 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\ICQ [2010.12.30 11:48:30 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\kikin [2009.06.20 13:48:16 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Leadertech [2010.01.02 13:46:39 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Nikon [2009.12.02 14:34:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\ProtectDisc [2010.11.01 15:35:31 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\TeamViewer [2009.05.28 19:45:26 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Template [2010.11.10 19:14:27 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Zoner [2010.01.22 14:30:28 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Zylom [2011.01.02 11:27:44 | 000,000,314 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job [2011.01.02 01:41:08 | 000,032,562 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2011.01.02 12:14:59 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{14462773-62BF-4C9E-80EF-1000612E1AF8}.job [2011.01.01 18:35:30 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{924F89D7-29FA-4FFE-9593-D4625C820CB1}.job [2010.07.29 19:55:16 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{9CC52338-C1BB-4005-B5B2-49D14251D642}.job [2010.11.20 20:01:15 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BC33F0D6-CA52-473E-8D19-8AF29D64004B}.job [2010.12.17 07:24:11 | 000,000,424 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{EFB22905-29C6-4783-9128-9FB6050C5887}.job [2010.11.09 11:36:13 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{FA0BA1A9-A572-461A-B138-768F66BCD6C3}.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.06.28 20:17:28 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\.purple [2010.01.23 09:15:41 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Adobe [2010.04.30 15:21:29 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Apple Computer [2009.08.10 14:59:27 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Atari [2009.08.01 13:48:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Audio Recorder for Free [2010.11.30 22:18:37 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Avira [2010.02.28 15:14:52 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Buhl Data Service GmbH [2010.11.30 18:08:44 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\CheckPoint [2009.12.16 17:58:07 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\COMPUTERBILD-Abzockschutz [2009.06.25 19:23:55 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\CyberLink [2011.01.02 12:10:20 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\DNA [2010.10.24 13:01:09 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\DVDVideoSoftIEHelpers [2010.01.22 20:32:55 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\FOG Downloader [2009.05.26 18:23:38 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Free Sound Recorder [2010.10.29 21:27:52 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\GetRightToGo [2010.12.30 16:36:41 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\GlarySoft [2009.05.25 17:48:09 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Google [2010.03.07 12:23:57 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\gtk-2.0 [2010.11.07 14:03:37 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\HandBrake [2010.12.30 21:19:47 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\ICQ [2010.01.22 14:30:28 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Identities [2010.12.30 11:48:30 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\kikin [2009.06.20 13:48:16 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Leadertech [2009.05.25 17:43:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Macromedia [2006.11.02 13:37:34 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Media Center Programs [2010.11.29 20:00:51 | 000,000,000 | --SD | M] -- C:\Users\Gross\AppData\Roaming\Microsoft [2011.01.01 18:48:10 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Mozilla [2009.05.31 11:31:47 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Nero [2010.01.02 13:46:39 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Nikon [2009.12.02 14:34:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\ProtectDisc [2009.06.20 13:49:30 | 000,000,000 | RH-D | M] -- C:\Users\Gross\AppData\Roaming\SecuROM [2010.12.29 13:28:35 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Skype [2010.12.29 13:23:07 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\skypePM [2010.12.30 18:02:07 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\teamspeak2 [2010.11.01 15:35:31 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\TeamViewer [2009.05.28 19:45:26 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Template [2010.09.07 12:15:05 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\WinRAR [2010.11.10 19:14:27 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Zoner [2010.01.22 14:30:28 | 000,000,000 | ---D | M] -- C:\Users\Gross\AppData\Roaming\Zylom < %APPDATA%\*.exe /s > [2010.12.01 20:20:36 | 000,752,688 | ---- | M] () -- C:\Users\Gross\AppData\Roaming\kikin\kikin_updater_2.4.15.exe [2010.12.30 11:48:33 | 001,166,568 | ---- | M] () -- C:\Users\Gross\AppData\Roaming\kikin\kikin_updater_2.9.1.exe [2010.06.12 23:16:10 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Gross\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2009.10.03 11:00:47 | 000,003,262 | R--- | M] () -- C:\Users\Gross\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\controlPanelIcon.exe [2009.10.03 11:00:47 | 000,010,134 | R--- | M] () -- C:\Users\Gross\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\SystemFolder_msiexec.exe [2010.01.02 13:38:21 | 000,335,872 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Gross\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe [2010.01.02 13:44:05 | 000,057,344 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Gross\AppData\Roaming\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe [2010.01.02 13:38:52 | 000,049,152 | R--- | M] (InstallShield Software Corp.) -- C:\Users\Gross\AppData\Roaming\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys [2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys [2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys < MD5 for: ATAPI.SYS > [2008.07.10 15:33:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_4c9c5a00\atapi.sys [2008.07.10 15:33:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=0D83C87A801A3DFCD1BF73893FE7518C -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18034_none_dd1bb97e219e87cb\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys [2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys [2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys [2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys [2008.07.10 15:33:06 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=96DC4E1A9F90CCD489950A8935425C59 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.22134_none_dda556493abc2795\atapi.sys < MD5 for: CNGAUDIT.DLL > [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll [2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll < MD5 for: EVENTLOG.DLL > [2007.01.12 21:30:08 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Programme\HomeCinema\PowerDirector\EventLog.dll < MD5 for: EXPLORER.EXE > [2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: IASTOR.SYS > [2007.09.29 22:03:32 | 000,384,024 | ---- | M] (Intel Corporation) MD5=16A4671255CFB842225F0FDB6DBDB414 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\drivers\iaStor.sys [2007.09.29 22:03:12 | 000,308,248 | ---- | M] (Intel Corporation) MD5=E5A0034847537EAEE3C00349D5C34C5F -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_7baf6192\iaStor.sys < MD5 for: IASTORV.SYS > [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys [2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys [2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll [2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll [2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll < MD5 for: NVSTOR.SYS > [2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys [2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys < MD5 for: SCECLI.DLL > [2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll [2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll < MD5 for: USER32.DLL > [2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll [2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll < MD5 for: USERINIT.EXE > [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < MD5 for: WS2IFSL.SYS > [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys [2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV [2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV [2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV [2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV [2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2009.04.11 07:27:47 | 000,241,128 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\rsaenh.dll [2009.04.11 07:28:23 | 000,228,352 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\SLC.dll < End of report > |
|
02.01.2011, 13:05
| #5 |
| | TR/Buzus.cjzh und nun der Extras.Txt OTL Extras logfile created on: 02.01.2011 12:06:13 - Run 1 OTL by OldTimer - Version 3.2.20.0 Folder = C:\Users\Gross\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 40,00% Memory free 6,00 Gb Paging File | 4,00 Gb Available in Paging File | 70,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 275,41 Gb Total Space | 154,50 Gb Free Space | 56,10% Space Free | Partition Type: NTFS Drive D: | 22,66 Gb Total Space | 12,53 Gb Free Space | 55,28% Space Free | Partition Type: FAT32 Drive G: | 931,51 Gb Total Space | 781,82 Gb Free Space | 83,93% Space Free | Partition Type: NTFS Computer Name: GROSS-PC | User Name: Gross | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found [HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe File not found ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) http [open] -- Reg Error: Value error. https [open] -- Reg Error: Value error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~4\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 1 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found "VistaSp2" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0AC2F297-5DA9-4A41-9004-60B32D1FDCFD}" = rport=137 | protocol=17 | dir=out | app=system | "{15CED677-3FC5-45BB-9A31-23733B1B7E37}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | "{4460B05D-BD7C-4F43-9327-CAB54157C776}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface | "{4DAFCAF3-B5FE-4FA8-A3B3-D88A0B8463AB}" = lport=138 | protocol=17 | dir=in | app=system | "{5FA9BF9B-1E7D-4096-8242-BA7339D4E47F}" = rport=445 | protocol=6 | dir=out | app=system | "{651B29D9-3424-4EC6-97C2-069145561A3E}" = lport=2869 | protocol=6 | dir=in | app=system | "{7C1CE133-4C6D-465A-808B-7E8FD4540591}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | "{7D15ED71-D6C4-468C-8060-3E36AE15E919}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | "{8B6842E4-AB1C-4D00-9F11-6FFEE4641C35}" = lport=50719 | protocol=6 | dir=in | name=akamai netsession interface | "{918C1AE2-D1AE-4E1D-9DA0-46D723368A14}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{B37FC679-D656-44EC-B5BA-24A81B4504AA}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | "{C14ED166-F218-4E2A-B755-600B0E01416A}" = rport=138 | protocol=17 | dir=out | app=system | "{C82BCAAE-F572-46A8-A776-0608DA177F9F}" = lport=137 | protocol=17 | dir=in | app=system | "{DD2C30B5-54A7-4450-95A5-A3E47DB2F955}" = lport=139 | protocol=6 | dir=in | app=system | "{E187A010-7EE6-4896-BD7F-41E303AAF635}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{E337AA90-6B49-4507-821D-D5ED8824E4E7}" = lport=445 | protocol=6 | dir=in | app=system | "{EF126E78-012B-48D4-BCC7-E490EB4B2CA2}" = rport=139 | protocol=6 | dir=out | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0F47084A-C3E6-4524-8008-397409F71DFD}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe | "{1667984A-C0C6-41E3-9DFF-78E1D2E22D43}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{166EF1AF-16F2-4CFF-8A78-9CF06C3E8480}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{1E4B4109-28F9-428B-988F-F3354E8AF415}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{2519480E-3659-41A0-825E-FE9DDF30C349}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{26E7A98D-9DE6-4724-9CED-F187651D1A26}" = dir=in | app=c:\program files\itunes\itunes.exe | "{289F4083-94FF-4FA0-964B-8AD17F302DA2}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | "{2ED6EC49-CDE0-4B41-A8BF-FC750FB625D2}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | "{3239E8B9-270F-4CA8-9CFA-485F190D95A9}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "{489AB371-E36D-4F46-AA87-5D2848A7786E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{55570B96-1C9D-4369-AD8E-4DF7E8CE7BFF}" = protocol=6 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | "{5ADE21EC-C410-47AB-B693-C90B5D7FF2CC}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{6CE02981-A999-48A3-9FC7-4D5AC280B0AC}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{72508D1B-D434-4F04-BF6A-C394BE823D42}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{751C97F4-59A0-4FF7-BC92-287E4314CC1B}" = dir=in | app=c:\program files\skype\phone\skype.exe | "{76AA2F8A-5176-4FEC-91F0-4E5DBC12A7DF}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "{826F7892-1DF8-43A2-91DA-96B34345CC01}" = protocol=17 | dir=in | app=c:\program files\2k games\firaxis games\sid meier's civilization 4 complete\civilization4.exe | "{89123A18-F927-4700-8334-926539906B3C}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{91C1A3FE-C5A8-4EF6-B275-5FAB499843BC}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{92E39538-9A60-4B43-B23D-10A3FE6EAEA3}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{95A7C276-05C2-42B5-8BD8-1A1A4B32C361}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{96EE7343-328E-460B-B372-2B36D01EE775}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe | "{9CC3C7EF-F2CA-4D14-AC98-1E1B6AAF8A54}" = dir=in | app=c:\program files\homecinema\powerdvd\powerdvd.exe | "{9D073A91-3FF4-4CCF-A22B-7512BA0229F4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{A260A4AC-C43D-4925-AA48-6C1142A84951}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | "{A3F28025-7604-40E5-A991-8A9930CBFE30}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{ADAB77E5-A4A7-448D-88A9-D68F95D71C1F}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "{AE7F59D8-2E45-4F35-9CDF-79C9D84D16E9}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{C04D1C46-9DEE-403D-BA42-E2137DB8FE19}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | "{C227D39D-0F66-475A-99BB-9EE6965DF638}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "{C7502F25-D77E-45AC-A118-9FB6F5CFC59F}" = dir=in | app=c:\program files\homecinema\powerdirector\pdr.exe | "{C9B1122A-FC10-4DF2-8997-5AAAC8528EAE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe | "{C9E034A2-027C-40DD-AC30-331437011759}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{CCA2E593-FBD0-4A08-952B-2783C2A5B2AE}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe | "{CCD43553-BDB4-431B-8F95-71A9CC0A23BD}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | "{D0C149E3-679F-4339-A35B-D19514EAFE85}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe | "{D29FA71B-2968-4640-8D23-3008DE96F67B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{D9801DC9-A2F9-4A2F-BC97-307383E798A1}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version5\teamviewer_service.exe | "{DC73C1B5-FC81-49BE-9F0C-3B4FC1C508CD}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "{E51D1F59-4CED-4925-8283-2E42565D2F15}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{EC69E0B8-2DBB-43E7-93DD-EEB91D5CB6FA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version5\teamviewer.exe | "TCP Query User{07F3FFB2-5F75-42C0-A587-89EB43236E20}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | "TCP Query User{4A4FAF70-B82A-435E-BED9-948C36D69B1B}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{4EB61411-17DB-4C36-B3FA-296D52969CBC}C:\program files\firefly studios\civcity rom\civcity rome.exe" = protocol=6 | dir=in | app=c:\program files\firefly studios\civcity rom\civcity rome.exe | "TCP Query User{5429EDB7-1860-4A0B-A3F8-9CD5B15BD6F6}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | "TCP Query User{5CA4F608-6328-4E8A-B50C-4DA63442AC53}C:\users\gross\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "TCP Query User{5FAB2B90-8747-47AB-A0B5-7708255A4DD2}C:\program files\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "TCP Query User{60EE8999-5A7C-4A4E-B596-F7BA1DEE296E}C:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe" = protocol=6 | dir=in | app=c:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe | "TCP Query User{6D597724-262F-47B5-99A4-DE654EAF3B7A}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | "TCP Query User{6E4FBD08-D28A-441A-A279-417294BA2482}C:\program files\icq7.0\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | "TCP Query User{73775B64-DFE3-4202-92B0-83D38B6D03DD}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "TCP Query User{784F0FDE-49E5-4106-BFB2-C38D484C25BC}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=6 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "TCP Query User{7FBA2DFA-16CF-4EC4-8D35-EF732B2E749F}C:\games\paintball2\paintball2.exe" = protocol=6 | dir=in | app=c:\games\paintball2\paintball2.exe | "TCP Query User{8720084B-7B00-45AF-8B89-3CB8C30B446D}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "TCP Query User{A2C79EED-D20C-4E4B-8E21-36890AE22FFE}C:\users\gross\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "TCP Query User{A52F70B8-405F-4EE5-8FE0-B1BE4DBD99C7}C:\program files\cabal online\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\cabal online\launcher\update\estdnheadless.exe | "TCP Query User{B6B3B337-93E2-4CD6-A850-E67F107D2291}C:\program files\ea sports\fifa 11 demo\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 11 demo\game\fifa.exe | "TCP Query User{BBADE203-77D2-479D-A910-1581A8D72B70}C:\aeriagames\wolfteam-de\wolfteam.bin" = protocol=6 | dir=in | app=c:\aeriagames\wolfteam-de\wolfteam.bin | "TCP Query User{BBC87D89-8BE0-418E-85CC-506C4F9EB536}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | "TCP Query User{BDD37F86-9F04-4286-8DE4-D528854F71B6}C:\program files\poptop software\shattered union\shatteredunion.exe" = protocol=6 | dir=in | app=c:\program files\poptop software\shattered union\shatteredunion.exe | "TCP Query User{C1A217B0-10C7-4B8C-A6CF-240F698A18B9}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=6 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "TCP Query User{D176C001-A0ED-479E-9622-18EDA0098185}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "TCP Query User{D47364EA-306C-4B7B-971F-A97DEA43267A}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | "TCP Query User{DCCA0F86-30BD-42F5-8B3C-D9EE972E3640}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "TCP Query User{E86899AD-C985-48C3-A6F2-00DBD24D740F}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe | "TCP Query User{FC1B01D5-E4D9-4EA7-9AA3-04D9E32FAA75}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | "TCP Query User{FF99CDA9-44F5-4EDF-9B19-DE31D7213BD4}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=6 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe | "UDP Query User{042A1079-869F-4A0A-A3E6-25A6F17E1474}C:\games\paintball2\paintball2.exe" = protocol=17 | dir=in | app=c:\games\paintball2\paintball2.exe | "UDP Query User{05426C61-99E7-4384-837C-2EE0AB5AA71F}C:\aeriagames\wolfteam-de\wolfteam.bin" = protocol=17 | dir=in | app=c:\aeriagames\wolfteam-de\wolfteam.bin | "UDP Query User{1028C509-5E1F-4098-8A14-27828734F277}C:\users\gross\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "UDP Query User{3B8FDD40-DECD-4EA2-B39E-7715C27E7835}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=17 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "UDP Query User{60DDF314-F806-4A6A-A5CD-AAD3C73B37CA}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | "UDP Query User{624C4FC5-FA17-40D9-A7FD-DC9841694DC3}C:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe" = protocol=17 | dir=in | app=c:\users\gross\downloads\fogdownloader-rom_2_1_0_1871.exe | "UDP Query User{630E3F68-8974-44C6-8763-98888B72222D}C:\program files\sixteen tons entertainment\emergency4\em4.exe" = protocol=17 | dir=in | app=c:\program files\sixteen tons entertainment\emergency4\em4.exe | "UDP Query User{6703147A-C5C7-407D-90F3-07A8AFEAF9CD}C:\program files\ea sports\fifa 11 demo\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 11 demo\game\fifa.exe | "UDP Query User{6D9F262A-5CFD-4F3B-8BA7-354DF45AC03A}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe | "UDP Query User{6F36DD27-9A4F-4B4C-A6E7-0C448AD98DC1}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "UDP Query User{790C16EA-FE34-4403-AFE7-BE697920F460}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe | "UDP Query User{7DA35949-1A31-451C-B3BD-67AA5DDF2DBD}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe | "UDP Query User{81AB5603-4B86-4998-8054-955C669184B0}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe | "UDP Query User{9BEDC2B1-69BF-4A82-8AF3-DA367D575E6E}C:\program files\cabal online\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\cabal online\launcher\update\estdnheadless.exe | "UDP Query User{A72A8B93-5B3B-4F78-875F-BB1CA59D7522}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe | "UDP Query User{AF294144-ACBF-46AC-9424-D6A09F2BFB0D}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | "UDP Query User{B194AD43-69D4-4C68-8627-0A8E84193728}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | "UDP Query User{B348C33F-1B51-491B-A536-D0738C33BF2E}C:\program files\ea sports\fifa 09\fifa09.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 09\fifa09.exe | "UDP Query User{BB514999-B119-411A-ADFF-13F3A5F186CD}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | "UDP Query User{C19A8821-4A5E-4562-913C-60F9B4FF6C66}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | "UDP Query User{C84976A0-0809-4F6D-B42E-604FB4B03976}C:\program files\icq7.0\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | "UDP Query User{D0F11A6B-BE48-4DC1-9C92-846382470708}C:\users\gross\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\gross\program files\dna\btdna.exe | "UDP Query User{DC5F1031-369F-4199-9366-F98ECAD84128}C:\program files\ea sports\fifa 11\game\fifa.exe" = protocol=17 | dir=in | app=c:\program files\ea sports\fifa 11\game\fifa.exe | "UDP Query User{F3695F60-BE2B-4A6A-93DE-5DB7D99BF322}C:\program files\poptop software\shattered union\shatteredunion.exe" = protocol=17 | dir=in | app=c:\program files\poptop software\shattered union\shatteredunion.exe | "UDP Query User{F9AA2576-6DAC-4B61-93DC-9D5555FB1F88}C:\program files\firefly studios\civcity rom\civcity rome.exe" = protocol=17 | dir=in | app=c:\program files\firefly studios\civcity rom\civcity rome.exe | "UDP Query User{FF00A183-1CB2-4254-ACF0-0DDBA789810D}C:\program files\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\eadm\core.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 "{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant "{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas "{11AFE21E-B193-430D-B57A-DFF7815BB962}" = Ulead PhotoImpact 12 "{18DC1F9A-15B9-4707-A9CD-C2F66239261E}" = COMPUTERBILD-Abzockschutz "{1AA7DDDB-A253-4E0F-867A-6E450E7F9022}" = A-Train8EU "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable "{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder "{2315B23D-3E21-4920-837D-AE6460934ECB}" = FIFA 09 "{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader "{255FC1CF-2620-4B64-BE02-79B9E609BB3D}" = Webzen Game Starter "{2B091530-69AA-442E-AB09-39ED06B58220}" = Windows Live Messenger "{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = Suyin Webcam "{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{3FEA6CD1-EA13-4CE7-A74E-A74A4A0A7B5C}" = FIFA 11 "{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth "{47948554-90C6-4AAC-8CFA-D23CE11C1031}" = Nero 8 Essentials "{4EC8B911-98AB-4819-B5EE-D32E8A0A8AAA}_is1" = DVDx 2 "{56780980-C930-4775-88B8-85301EDBEBE6}_is1" = Transport Manager "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime "{5B5A6B3A-9DF7-4B81-9F29-5CC668406904}" = Pixia "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites "{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 "{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2 "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 "{781D316B-77BA-48C3-8310-42EAFB61ED31}" = Shattered Union "{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}" = Windows Live installer "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE "{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility "{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista "{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2 "{89E0B0D4-DFC3-49B9-8E88-F1B801325C8A}" = Emergency 3 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007 "{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007 "{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007 "{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007 "{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007 "{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager "{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3 "{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German) "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9A4C534E-431F-4A17-97D4-D1682B19A054}" = Emergency4 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch "{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc "{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{BD1587F7-B8D0-4111-8F1F-3327628AB02F}" = 3531-W-D "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D0846526-66DD-4DC9-A02C-98F9A2806812}" = Launch Manager V1.4.9 "{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center "{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow! "{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4 "{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow "{D8D22773-14BF-4178-A683-3DBA515C2A26}" = WISO Mein Geld 2008 Professional "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware "{E0091C29-DEE8-4B24-BF65-8C35B5940D77}" = Letstrade "{E08DE897-B6AF-4DFF-9E90-131E80C876B4}" = DIE SIEDLER - Das Erbe der Könige - Gold Edition "{E4A71A41-BCC8-480a-9E69-0DA29CBA7ECA}" = 1 "{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0 "{E815FB81-995F-4F33-8E25-F16712123AB7}" = AuthenTec Fingerprint Sensor Minimum Install "{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer "{EA926717-CE5A-4CB4-AB21-9E6E9565A458}" = RCT3 Soaked "{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}" = Samsung PC Studio 3 USB Driver Installer "{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}" = ANNO 1503 "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support "{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729) "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01 "{F4E57F49-84B4-4CF2-B0A1-8CA1752BDF7E}" = OmniPass 5.00.91 "{F916C6DF-2601-4385-9500-C45FF398D4CB}" = Install(GE) "{FEDE400D-3381-4087-ACCB-689DD8A56123}" = Inst5657 "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour "3554AA4B-9B0B-451a-A269-2B5F53982209_is1" = ThreatFire "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites "Ad-Aware" = Ad-Aware "Adobe Acrobat 4.0" = Adobe Acrobat 4.0 "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "Akamai" = Akamai NetSession Interface "Aktiv MP3 Recorder" = Aktiv MP3 Recorder "Art Mahjongg 1" = Art Mahjongg 1 "Audacity_is1" = Audacity 1.2.6 "AutoGK" = Auto Gordian Knot 2.55 "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "AviSynth" = AviSynth 2.5 "Bridge Construction Set Demo_is1" = Bridge Construction Set Demo 1.37 "CCleaner" = CCleaner "CloneDVD2" = CloneDVD2 "conduitEngine" = Conduit Engine "EADM" = EA Download Manager "EASEUS Todo Backup Home 2.0_is1" = EASEUS Todo Backup Home 2.0 "ENTERPRISE" = Microsoft Office Enterprise 2007 "Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4 "Free Audio Converter_is1" = Free Audio Converter version 1.4 "Free DVD Video Converter_is1" = Free DVD Video Converter version 1.5 "Free Sound Recorder" = Free Sound Recorder "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8 "Glary Utilities_is1" = Glary Utilities 2.29.0.1032 "Google Desktop" = Google Desktop "Google Updater" = Google Updater "GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen) "ImgBurn" = ImgBurn "InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "LetsTrade" = LetsTrade Komponenten "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Neffy" = Neffy 1,3,29,0 "NVIDIA Drivers" = NVIDIA Drivers "OpenAL" = OpenAL "OpenTTD" = OpenTTD 1.0.0 "pc-profi-Chart_de2010_is1" = pc-profi-Chart_de2010 "PhotoScape" = PhotoScape "Picasa 3" = Picasa 3 "ProtectDisc Driver 11" = ProtectDisc Driver, Version 11 "Samsung ML-2240 Series" = Samsung ML-2240 Series "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "ShapeCollage" = Shape Collage "softonic-de3 Toolbar" = softonic-de3 Toolbar "SopCast" = SopCast 3.2.4 "SynTPDeinstKey" = Synaptics Pointing Device Driver "Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2 "TeamViewer 5" = TeamViewer 5 "Train Simulator 1.0" = Microsoft Train Simulator "Uninstall_is1" = Uninstall 1.0.0.1 "VobSub" = VobSub v2.23 (Remove Only) "WinRAR archiver" = WinRAR "WolfTeam" = WolfTeam "WolfTeam-DE" = WolfTeam-DE "XviD MPEG4 Video Codec" = XviD MPEG4 Video Codec (remove only) "ZonerPhotoStudio12_DE_is1" = Zoner Photo Studio 12 "Zylom Games Player Plugin" = Zylom Games Player Plugin ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-3059421624-3991891353-2127967058-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BitTorrent DNA" = DNA ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 01.01.2011 13:59:17 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000096, Fehleroffset 0x00003c04, Prozess-ID 0xa58, Anwendungsstartzeit 01cba9da8060a935. Error - 01.01.2011 13:59:38 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003c14, Prozess-ID 0x1520, Anwendungsstartzeit 01cba9dd9efbc6b5. Error - 01.01.2011 13:59:40 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung Explorer.EXE, Version 6.0.6002.18005, Zeitstempel 0x49e01da5, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003d16, Prozess-ID 0x1520, Anwendungsstartzeit 01cba9dd9efbc6b5. Error - 01.01.2011 14:45:44 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 01.01.2011 15:33:42 | Computer Name = Gross-PC | Source = Application Hang | ID = 1002 Description = Programm ImgBurn.exe, Version 2.5.4.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 1204 Anfangszeit: 01cba9e9de5b32d0 Zeitpunkt der Beendigung: 20 Error - 01.01.2011 18:01:29 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 01.01.2011 20:32:27 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung spoolsv.exe, Version 6.0.6002.18294, Zeitstempel 0x4c6a9898, fehlerhaftes Modul TFWAH.dll, Version 4.10.1.14, Zeitstempel 0x4b4fa0ac, Ausnahmecode 0xc0000005, Fehleroffset 0x0000439a, Prozess-ID 0x770, Anwendungsstartzeit 01cba9ff639aa459. Error - 02.01.2011 06:28:17 | Computer Name = Gross-PC | Source = WinMgmt | ID = 10 Description = Error - 02.01.2011 07:13:09 | Computer Name = Gross-PC | Source = Application Error | ID = 1000 Description = Fehlerhafte Anwendung GPhotos.scr, Version 3.6.105.67, Zeitstempel 0x4c071660, fehlerhaftes Modul mscms.dll, Version 6.0.6002.18005, Zeitstempel 0x49e03790, Ausnahmecode 0xc0000005, Fehleroffset 0x00003d16, Prozess-ID 0x134, Anwendungsstartzeit 01cbaa6df866f281. Error - 02.01.2011 07:22:33 | Computer Name = Gross-PC | Source = Application Hang | ID = 1002 Description = Programm iexplore.exe, Version 7.0.6002.18005 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen. Prozess-ID: 1194 Anfangszeit: 01cbaa6bbe18deb1 Zeitpunkt der Beendigung: 63 [ OSession Events ] Error - 01.12.2009 15:59:47 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash. Error - 29.03.2010 12:09:37 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 11 seconds with 0 seconds of active time. This session ended with a crash. Error - 03.04.2010 04:06:12 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8 seconds with 0 seconds of active time. This session ended with a crash. Error - 05.05.2010 16:25:25 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 906 seconds with 0 seconds of active time. This session ended with a crash. Error - 06.07.2010 16:38:25 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 58 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:40:51 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 35 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:41:03 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash. Error - 23.07.2010 16:41:11 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash. Error - 26.07.2010 05:41:42 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 21 seconds with 0 seconds of active time. This session ended with a crash. Error - 26.07.2010 15:47:17 | Computer Name = Gross-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 17 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 01.01.2011 20:20:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:26:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:32:26 | Computer Name = Gross-PC | Source = iaStor | ID = 262153 Description = Das Gerät \Device\Ide\iaStor0 hat innerhalb der Fehlerwartezeit nicht geantwortet. Error - 01.01.2011 20:32:33 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7031 Description = Error - 01.01.2011 20:32:39 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7031 Description = Error - 02.01.2011 06:27:22 | Computer Name = Gross-PC | Source = Microsoft-Windows-TaskScheduler | ID = 412 Description = Error - 02.01.2011 06:28:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000 Description = Error - 02.01.2011 06:28:18 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7000 Description = Error - 02.01.2011 06:33:23 | Computer Name = Gross-PC | Source = Service Control Manager | ID = 7022 Description = Error - 02.01.2011 06:59:01 | Computer Name = Gross-PC | Source = DCOM | ID = 10010 Description = Ich hoffe ihr könnt damit was anfangen... Ich habe kein Plan davon  Grüße Dagro |
|
02.01.2011, 13:09
| #6 |
| /// Malware-holic | TR/Buzus.cjzh bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ --> TR/Buzus.cjzh |
|
| Themen zu TR/Buzus.cjzh |
| aktion, antivir, aufspielen, browser, buzus, datei, explorer, firefox, folge, folgendes, helft, hijack, hijackthis, internetexplorer, mozilla, namen, nichts, problem, programm, rechner, tr/buzus, tr/buzus.cjzh, trojan, trojaner, unerwünschtes programm, verschoben, virus, windows |
Linear-Darstellung
