| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spyeye - keylogger noch da?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
10.02.2011, 21:07
| #7 |
 |  Spyeye - keylogger noch da? Hallo, hier die zwei gewünschten Einträge. Code:
ATTFilter OTL logfile created on: 10.02.2011 20:42:43 - Run 1 OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\user\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 68,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 110,32 Gb Total Space | 20,26 Gb Free Space | 18,36% Space Free | Partition Type: NTFS Computer Name: D611 | User Name: user | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Juniper Networks\Common Files\dsNcService.exe (Juniper Networks) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) PRC - C:\Programme\Synaptics\SynTP\SynToshiba.exe (Synaptics, Inc.) ========== Modules (SafeList) ========== MOD - C:\Users\user\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (dsNcService) -- C:\Programme\Juniper Networks\Common Files\dsNcService.exe (Juniper Networks) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (dsNcAdpt) -- C:\Windows\System32\drivers\dsNcAdpt.sys (Juniper Networks) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation) DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics) DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.) DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation) DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.) DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex) DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.) DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.) DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation) DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.) DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.) DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd) DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation) DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.) DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.) DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation) DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation) DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH) DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems) DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation) DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.) DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.) DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic) DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.) DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company) DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.) DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.) DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.) DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic) DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic) DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic) DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic) DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation) DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic) DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation) DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.) DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.) DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.) DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.) DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.) DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.) DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.) DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.) DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.) DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems) DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies) DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation) DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.tagesschau.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost;<local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:62646 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Forestle (de)" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "hxxp://www.tagesschau.de/" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}:0.6.7 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..network.proxy.autoconfig_url: "hxxp://www.hadiko.de/proxy.pac" FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 62646 FF - prefs.js..network.proxy.no_proxies_on: "*.hadiko.de,*.uni-karlsruhe.de,*.uka.de" FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.02.05 17:37:26 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.02.08 21:39:10 | 000,000,000 | ---D | M] [2009.01.09 12:32:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Extensions [2011.02.09 22:34:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\5u76vgar.default\extensions [2010.12.21 08:15:53 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\5u76vgar.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.02.06 10:42:39 | 000,000,000 | ---D | M] (Ad blocker) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\5u76vgar.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} [2011.02.06 23:34:30 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\5u76vgar.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2009.08.23 10:51:24 | 000,002,314 | ---- | M] () -- C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\5u76vgar.default\searchplugins\forestle-de.xml [2011.02.08 21:39:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.02.08 21:39:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2009.01.09 12:31:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\inspector@mozilla.org [2009.09.18 16:58:47 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2011.02.08 21:39:12 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2010.11.12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2009.12.07 20:04:38 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Programme\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll [2011.02.05 17:37:18 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.02.05 17:37:18 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.02.05 17:37:18 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.02.05 17:37:18 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.02.05 17:37:18 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.01.23 19:20:30 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programme\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc) O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll (Google Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programs\PartyGaming\PartyPoker\RunApp.exe () O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5 Control) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} hxxp://gfx2.hotmail.com/mail/w3/pr01/resources/VistaMSNPUpldde-de.cab (MSN Photo Upload Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0019-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Java Plug-in 1.4.2_19) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\x-sdch {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programme\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll (Google Inc.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img4.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img4.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{7d322c1e-5080-11df-a1a4-df13895e06d5}\Shell\AutoRun\command - "" = E:\hbcd\wintools\autorun.exe O33 - MountPoints2\{7d322c1e-5080-11df-a1a4-df13895e06d5}\Shell\Option1\Command - "" = E:\hbcd\wintools\autorun.exe O33 - MountPoints2\{a474ad27-ea16-11dd-9933-00a0d16e1d6a}\Shell\Auto\command - "" = E:\AdobeR.exe e O33 - MountPoints2\{a474ad27-ea16-11dd-9933-00a0d16e1d6a}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\AdobeR.exe e O33 - MountPoints2\{ce9b5fbf-f904-11dd-ae29-00a0d16e1d6a}\Shell - "" = AutoRun O33 - MountPoints2\{ce9b5fbf-f904-11dd-ae29-00a0d16e1d6a}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a O33 - MountPoints2\{eed17a7e-b02b-11df-b003-c1f59f2d5004}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL TaUoBex.eXE O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.02.10 20:39:23 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2011.02.09 22:53:22 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011.02.08 21:43:29 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\Malwarebytes [2011.02.08 21:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.02.08 21:43:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.02.08 21:43:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.02.08 21:43:15 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.02.08 21:43:15 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.02.08 21:39:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun [2011.02.08 21:39:10 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll [2011.02.08 21:39:10 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2011.02.08 21:39:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2011.02.08 21:39:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2011.02.08 19:28:31 | 002,039,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2011.02.08 19:28:25 | 003,602,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2011.02.08 19:28:23 | 003,550,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2011.02.08 19:28:10 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll [2011.02.08 19:28:09 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2011.02.08 19:28:09 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2011.02.08 19:28:08 | 000,979,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll [2011.02.08 19:28:08 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.02.08 19:28:08 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2011.02.08 19:28:08 | 000,288,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2011.02.08 19:28:08 | 000,135,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2011.02.08 19:28:07 | 001,554,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll [2011.02.08 19:28:07 | 000,357,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll [2011.02.08 19:28:07 | 000,302,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll [2011.02.08 19:28:07 | 000,261,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll [2011.02.08 19:28:04 | 000,847,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll [2011.02.08 19:28:03 | 000,478,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2011.02.08 19:28:03 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2011.02.08 19:28:02 | 002,873,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2011.02.08 19:28:02 | 001,029,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2011.02.08 19:28:02 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2011.02.08 19:28:01 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe [2011.02.08 19:28:01 | 000,486,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2011.02.08 19:28:01 | 000,189,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2011.02.08 19:28:00 | 000,209,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll [2011.02.08 19:27:57 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll [2011.02.08 19:27:57 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2011.02.08 19:27:57 | 000,026,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll [2011.02.08 19:27:28 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2011.02.08 19:27:27 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.02.08 19:27:27 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.02.08 19:27:27 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.02.08 19:27:26 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2011.02.08 19:27:26 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll [2011.02.08 19:27:21 | 000,292,352 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2011.02.08 19:27:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2011.01.14 19:30:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung ML-2010 Series [2011.01.14 19:30:02 | 000,000,000 | ---D | C] -- C:\Windows\Samsung [2011.01.14 19:05:10 | 000,890,368 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrv.dll [2011.01.14 19:05:10 | 000,371,200 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvdu.dll [2011.01.14 19:05:10 | 000,204,800 | ---- | C] (SEC) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvcm.dll [2011.01.14 19:05:10 | 000,151,552 | ---- | C] (SS) -- C:\Windows\System32\sugs2ci.exe [2011.01.14 19:05:10 | 000,151,552 | ---- | C] (SS) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\coinst.exe [2011.01.14 19:05:10 | 000,065,536 | ---- | C] (SS) -- C:\Windows\System32\sugs2ci.dll [2011.01.14 19:05:10 | 000,065,536 | ---- | C] (SS) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\coinst.dll [2011.01.14 19:05:10 | 000,019,456 | ---- | C] (Windows (R) 2000 DDK provider) -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpc.dll [2011.01.14 19:05:10 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series [2011.01.14 19:05:10 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\Samsung [2011.01.14 19:05:09 | 000,041,984 | ---- | C] (Samsung Electronics Co., Ltd.) -- C:\Windows\System32\drivers\DGIVECP.SYS [2011.01.14 19:05:09 | 000,005,120 | ---- | C] (Samsung Electronics) -- C:\Windows\System32\drivers\SSPORT.SYS [2011.01.14 19:05:05 | 000,000,000 | ---D | C] -- C:\Programme\Samsung [2011.01.14 18:56:05 | 026,260,019 | ---- | C] (Samsung ) -- C:\Users\user\Desktop\20070129090602265_ML-2010_GDI_Vista.exe [2011.01.12 08:04:44 | 001,169,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sdclt.exe [2011.01.12 08:04:40 | 000,413,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\odbc32.dll ========== Files - Modified Within 30 Days ========== [2011.02.10 20:45:15 | 000,000,416 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{34C2ED70-4BDF-40D6-ACDB-2E9CEE113BD2}.job [2011.02.10 20:39:24 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Users\user\Desktop\OTL.exe [2011.02.10 18:55:10 | 000,004,528 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.02.10 18:55:10 | 000,004,528 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.02.10 16:55:44 | 000,087,024 | ---- | M] () -- C:\Users\user\AppData\Roaming\nvModes.001 [2011.02.10 16:55:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.02.10 16:54:34 | 2145,443,840 | -HS- | M] () -- C:\hiberfil.sys [2011.02.09 22:47:03 | 000,633,580 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.02.09 22:47:03 | 000,600,138 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.02.09 22:47:03 | 000,128,796 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.02.09 22:47:03 | 000,106,014 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.02.09 22:41:20 | 000,286,688 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.02.08 21:43:21 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.02.08 21:14:18 | 000,721,199 | ---- | M] () -- C:\Users\user\Desktop\iExplore.exe.exe [2011.01.23 19:14:38 | 000,232,088 | ---- | M] () -- C:\Users\user\Desktop\Indonesian SME.pdf [2011.01.23 18:22:00 | 000,693,655 | ---- | M] () -- C:\Users\user\Desktop\Indonesia Analysts Report.pdf [2011.01.23 18:10:01 | 000,026,624 | ---- | M] () -- C:\Users\user\Desktop\GDP Indonesia+.xls [2011.01.23 18:09:53 | 000,018,432 | ---- | M] () -- C:\Users\user\Desktop\Establishments by Subsector.xls [2011.01.23 18:08:45 | 000,114,662 | ---- | M] () -- C:\Users\user\Desktop\Indonesia Economic Setting.docx [2011.01.20 17:08:16 | 000,478,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxgi.dll [2011.01.20 17:08:06 | 001,029,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10.dll [2011.01.20 17:08:06 | 000,219,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2011.01.20 17:08:06 | 000,189,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10core.dll [2011.01.20 17:08:06 | 000,160,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2011.01.20 17:07:58 | 000,037,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2011.01.20 17:06:38 | 002,873,344 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mf.dll [2011.01.20 17:06:35 | 000,026,112 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelineprxy.dll [2011.01.20 17:04:54 | 000,209,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfplat.dll [2011.01.20 17:04:54 | 000,098,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfps.dll [2011.01.20 15:28:38 | 001,554,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\xpsservices.dll [2011.01.20 15:27:50 | 000,876,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.01.20 15:26:30 | 000,667,648 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\printfilterpipelinesvc.exe [2011.01.20 15:25:25 | 000,847,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\OpcServices.dll [2011.01.20 15:24:32 | 000,288,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2011.01.20 15:24:26 | 000,135,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2011.01.20 15:15:10 | 000,979,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFH264Dec.dll [2011.01.20 15:14:39 | 000,357,376 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MFHEAACdec.dll [2011.01.20 15:14:03 | 000,302,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfmp4src.dll [2011.01.20 15:14:03 | 000,261,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mfreadwrite.dll [2011.01.20 15:12:46 | 001,172,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2011.01.20 15:11:34 | 000,486,400 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d3d10level9.dll [2011.01.20 14:47:51 | 000,683,008 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2011.01.20 14:44:05 | 001,068,544 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2011.01.20 14:44:03 | 000,797,184 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\FntCache.dll [2011.01.14 19:30:10 | 000,000,138 | ---- | M] () -- C:\Users\Public\Desktop\SAMSUNG Dr.Printer.url [2011.01.14 19:03:50 | 026,260,019 | ---- | M] (Samsung ) -- C:\Users\user\Desktop\20070129090602265_ML-2010_GDI_Vista.exe ========== Files Created - No Company Name ========== [2011.02.08 21:43:21 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.02.08 21:14:17 | 000,721,199 | ---- | C] () -- C:\Users\user\Desktop\iExplore.exe.exe [2011.01.23 19:14:38 | 000,232,088 | ---- | C] () -- C:\Users\user\Desktop\Indonesian SME.pdf [2011.01.23 18:22:00 | 000,693,655 | ---- | C] () -- C:\Users\user\Desktop\Indonesia Analysts Report.pdf [2011.01.23 11:54:17 | 000,018,432 | ---- | C] () -- C:\Users\user\Desktop\Establishments by Subsector.xls [2011.01.23 11:42:37 | 000,026,624 | ---- | C] () -- C:\Users\user\Desktop\GDP Indonesia+.xls [2011.01.23 11:34:47 | 000,114,662 | ---- | C] () -- C:\Users\user\Desktop\Indonesia Economic Setting.docx [2011.01.14 19:30:10 | 000,000,138 | ---- | C] () -- C:\Users\Public\Desktop\SAMSUNG Dr.Printer.url [2011.01.14 19:30:04 | 000,466,944 | ---- | C] () -- C:\Windows\ssndii.exe [2011.01.14 19:29:02 | 000,011,502 | ---- | C] () -- C:\Windows\Dr. Printer Icon.ico [2011.01.14 19:05:11 | 001,019,904 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvum.dll [2011.01.14 19:05:11 | 000,835,584 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvu2.dll [2011.01.14 19:05:11 | 000,704,512 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvu.dll [2011.01.14 19:05:11 | 000,626,874 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvua.bmp [2011.01.14 19:05:11 | 000,206,278 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvub.bmp [2011.01.14 19:05:11 | 000,054,820 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpt.dat [2011.01.14 19:05:11 | 000,054,623 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvsp.dat [2011.01.14 19:05:11 | 000,052,212 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvru.dat [2011.01.14 19:05:11 | 000,050,699 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvsw.dat [2011.01.14 19:05:11 | 000,041,384 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\SUGS2u.bmp [2011.01.14 19:05:11 | 000,035,914 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\sugs2.cat [2011.01.14 19:05:11 | 000,031,277 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvru.chm [2011.01.14 19:05:11 | 000,030,247 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvsw.chm [2011.01.14 19:05:11 | 000,030,025 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvsp.chm [2011.01.14 19:05:11 | 000,022,723 | ---- | C] () -- C:\Windows\System32\sugs2l3.dll [2011.01.14 19:05:11 | 000,022,723 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\sugs2l3.dll [2011.01.14 19:05:11 | 000,013,577 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvum.xml [2011.01.14 19:05:11 | 000,008,179 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\SUGS2.inf [2011.01.14 19:05:11 | 000,004,883 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\SUGS2u.ini [2011.01.14 19:05:11 | 000,004,072 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvul.bmp [2011.01.14 19:05:11 | 000,000,518 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\SUGS2pp.ver [2011.01.14 19:05:11 | 000,000,409 | ---- | C] () -- C:\Windows\System32\sugs2l3.smt [2011.01.14 19:05:11 | 000,000,409 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\sugs2l3.SMT [2011.01.14 19:05:10 | 000,217,088 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvo.dll [2011.01.14 19:05:10 | 000,208,896 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvm.dll [2011.01.14 19:05:10 | 000,057,777 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvfn.dat [2011.01.14 19:05:10 | 000,054,652 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvgr.dat [2011.01.14 19:05:10 | 000,053,892 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvit.dat [2011.01.14 19:05:10 | 000,053,348 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvdt.dat [2011.01.14 19:05:10 | 000,053,248 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvlf.dll [2011.01.14 19:05:10 | 000,053,102 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvhu.dat [2011.01.14 19:05:10 | 000,051,911 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpo.dat [2011.01.14 19:05:10 | 000,051,542 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvfi.dat [2011.01.14 19:05:10 | 000,051,207 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvdn.dat [2011.01.14 19:05:10 | 000,050,167 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvnr.dat [2011.01.14 19:05:10 | 000,049,294 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrven.dat [2011.01.14 19:05:10 | 000,049,152 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvex.exe [2011.01.14 19:05:10 | 000,047,487 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvkr.dat [2011.01.14 19:05:10 | 000,042,628 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvcp.dat [2011.01.14 19:05:10 | 000,042,583 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvct.dat [2011.01.14 19:05:10 | 000,038,192 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvcm.ctd [2011.01.14 19:05:10 | 000,031,381 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpo.chm [2011.01.14 19:05:10 | 000,031,155 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvhu.chm [2011.01.14 19:05:10 | 000,031,132 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvkr.chm [2011.01.14 19:05:10 | 000,030,711 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvgr.chm [2011.01.14 19:05:10 | 000,030,437 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvfn.chm [2011.01.14 19:05:10 | 000,030,389 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvct.chm [2011.01.14 19:05:10 | 000,030,383 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvcp.chm [2011.01.14 19:05:10 | 000,030,223 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvfi.chm [2011.01.14 19:05:10 | 000,030,199 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvdn.chm [2011.01.14 19:05:10 | 000,029,945 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvdt.chm [2011.01.14 19:05:10 | 000,029,865 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpt.chm [2011.01.14 19:05:10 | 000,029,803 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvnr.chm [2011.01.14 19:05:10 | 000,029,737 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvit.chm [2011.01.14 19:05:10 | 000,029,624 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvM3.bmp [2011.01.14 19:05:10 | 000,029,624 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvM2.bmp [2011.01.14 19:05:10 | 000,029,624 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvM1.bmp [2011.01.14 19:05:10 | 000,029,323 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrven.chm [2011.01.14 19:05:10 | 000,015,318 | ---- | C] () -- C:\Windows\System32\drivers\Samsung\Samsung ML-2010 Series\itdrvpp.dll [2010.12.30 17:05:23 | 000,106,496 | R--- | C] () -- C:\Windows\System32\vshp1018.dll [2010.12.25 04:13:19 | 000,002,016 | ---- | C] () -- C:\Users\user\AppData\Roaming\187E.548 [2009.12.29 23:25:28 | 000,819,200 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009.12.29 23:25:28 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009.08.05 09:42:25 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2008.09.25 18:40:31 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.09.18 15:58:49 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2008.07.10 07:07:22 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2008.06.10 22:02:51 | 000,000,534 | ---- | C] () -- C:\Windows\ODBC.INI [2008.06.08 09:01:44 | 000,000,600 | ---- | C] () -- C:\Users\user\AppData\Local\PUTTY.RND [2008.05.07 00:02:41 | 000,065,536 | ---- | C] () -- C:\Users\user\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.04.15 15:36:29 | 000,087,024 | ---- | C] () -- C:\Users\user\AppData\Roaming\nvModes.001 [2008.04.15 15:36:25 | 000,087,024 | ---- | C] () -- C:\Users\user\AppData\Roaming\nvModes.dat [2008.04.15 14:34:40 | 000,000,680 | ---- | C] () -- C:\Users\user\AppData\Local\d3d9caps.dat [2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.03.08 23:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll < End of report > Code:
ATTFilter OTL Extras logfile created on: 10.02.2011 20:42:45 - Run 1
OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\user\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 68,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 110,32 Gb Total Space | 20,26 Gb Free Space | 18,36% Space Free | Partition Type: NTFS
Computer Name: D611 | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{04C7BB1B-3F38-4FDE-BEA9-4F5A91627CB9}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{0EC6BBDE-D5C8-481B-9E54-8751A9BE3ECA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2050564B-2992-4D2F-B582-D4F0B0613F5C}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{54E1746F-6339-41F0-81F5-38B0CE4A6948}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{6581BD30-CA6E-40F4-AA08-F167F414A8B9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8463E32F-7383-4953-80FE-DF46EEC198F1}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{C75473D3-F215-4109-82FB-97652270A15D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DA286640-1D1F-4B56-9952-9F38B9A5B75B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1978BC59-ADE1-4AB6-A8EF-615D85F5AE18}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1C20488B-6912-4B49-96C4-5C63C66CD88F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2C533FA5-92E8-493B-AC5E-EC97798B233E}" = protocol=6 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{35519E2F-0106-430D-8F1C-D9F2EE231E92}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{4E4179B4-D92B-4095-A3A7-805AA7920D6C}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{59376345-4D5A-45B0-8986-C836549C080C}" = protocol=17 | dir=in | app=c:\program files\windows media player\wmplayer.exe |
"{5A3002F7-A9B7-49AC-85DD-9619054AD081}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{5F85413A-165B-46A8-93FB-AD9C70E912EE}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{66DED9AB-8520-4E11-A79B-E26A174A6DFD}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{73248C4A-39F2-44A2-A37D-2AFB055F2931}" = protocol=6 | dir=in | app=c:\program files\avira\antivir desktop\avcenter.exe |
"{8EA08831-ECBE-4A4D-BCB5-3323007FF842}" = protocol=6 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{A1D2345B-3B23-4647-917B-1DC8263926A0}" = protocol=17 | dir=out | app=c:\program files\windows media player\wmplayer.exe |
"{A1D4C61E-4B03-4256-90B8-73AF897BD5D1}" = protocol=17 | dir=in | app=c:\program files\avira\antivir desktop\avcenter.exe |
"{C953F87F-4301-4AD0-8621-77BA8DD677CD}" = protocol=17 | dir=in | app=c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe |
"{CBE6DFDB-C919-429F-A7AD-17A645D80903}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"TCP Query User{01A20D69-04F1-4E7F-88D8-55A41753C113}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{081BD8AA-A5A2-45A2-914D-C55CA4FD5FDC}C:\program files\dc++\dcplusplus.exe" = protocol=6 | dir=in | app=c:\program files\dc++\dcplusplus.exe |
"TCP Query User{1DCDD4AB-BE6E-48F1-9A73-35279B7EAF61}C:\windows\system32\taskeng.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskeng.exe |
"TCP Query User{27DBE0A2-3F30-4480-B75D-D0CC6ACD7567}C:\program files\amsn\bin\wish.exe" = protocol=6 | dir=in | app=c:\program files\amsn\bin\wish.exe |
"TCP Query User{33694486-10CA-4BC2-9897-3C5ACFF48C2B}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{4D0DC8E0-1124-4EF4-945E-18648322E94B}C:\program files\yworks\yed\yed.exe" = protocol=6 | dir=in | app=c:\program files\yworks\yed\yed.exe |
"TCP Query User{5622A8E8-00DA-4904-9DBD-E9238E7BCC91}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{840DD4A3-2243-4464-A8CB-8F83434CEA4D}C:\program files\dc++\dcplusplus.exe" = protocol=6 | dir=in | app=c:\program files\dc++\dcplusplus.exe |
"TCP Query User{8D177F00-AC6F-4EFF-B1C0-EAA3C62BDB59}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{8E06176E-353F-422F-B2E8-AC28C0E7B42B}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{99292E6A-DCF0-4EF7-88B7-87B6FE3B6BF1}C:\program files\amsn\bin\wish.exe" = protocol=6 | dir=in | app=c:\program files\amsn\bin\wish.exe |
"TCP Query User{A1460B0F-51D2-4E44-A302-F3EE9DA8401F}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{AE72BDA9-A72E-4324-B68A-11AE3F6A38F5}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{B61AFD14-A2D3-4F4E-B240-7E8C2A082A0A}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{CDDEA416-BF85-4AFD-9E1B-09772C98EB18}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{F528FC30-2F94-4E05-BE27-D6370338203B}C:\windows\temp\navbrowser.exe" = protocol=6 | dir=in | app=c:\windows\temp\navbrowser.exe |
"TCP Query User{FDA18BBA-F902-42E1-898E-CBFF26BD742F}C:\program files\cytoscape_v2.6.3\cytoscape.exe" = protocol=6 | dir=in | app=c:\program files\cytoscape_v2.6.3\cytoscape.exe |
"UDP Query User{229F33F9-0068-499B-93A8-9A5BDACE29CA}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{27D2012B-F555-466C-8C66-3474D8621C8E}C:\program files\amsn\bin\wish.exe" = protocol=17 | dir=in | app=c:\program files\amsn\bin\wish.exe |
"UDP Query User{34CBF508-6F08-44E0-9668-86EFFF282E01}C:\program files\amsn\bin\wish.exe" = protocol=17 | dir=in | app=c:\program files\amsn\bin\wish.exe |
"UDP Query User{35915093-08FD-403F-89E1-CDB2ED2B1190}C:\windows\temp\navbrowser.exe" = protocol=17 | dir=in | app=c:\windows\temp\navbrowser.exe |
"UDP Query User{419327C7-56BF-4DB4-8412-8233EB553C5F}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{5F2BB582-BAA1-423D-8A37-591B5D7687B5}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{8AEA6115-3529-4449-BF37-9538B0258147}C:\program files\cytoscape_v2.6.3\cytoscape.exe" = protocol=17 | dir=in | app=c:\program files\cytoscape_v2.6.3\cytoscape.exe |
"UDP Query User{9608E347-F61B-4D71-BF4B-56870C170AA9}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{976F4231-6EC8-470A-84EF-462DEFCBA32F}C:\program files\dc++\dcplusplus.exe" = protocol=17 | dir=in | app=c:\program files\dc++\dcplusplus.exe |
"UDP Query User{9F435DB8-F525-4D35-9D17-62625EB4C136}C:\program files\dc++\dcplusplus.exe" = protocol=17 | dir=in | app=c:\program files\dc++\dcplusplus.exe |
"UDP Query User{AB3244DA-9C55-422C-8040-1CBF02504994}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{AE2AF04A-0130-4434-91DC-74A0DE2DF1C6}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{BE3B337C-FCD7-463C-8208-E0F1121CC1A5}C:\program files\yworks\yed\yed.exe" = protocol=17 | dir=in | app=c:\program files\yworks\yed\yed.exe |
"UDP Query User{E45ABE36-B7D7-45CC-81D9-EF3D6385BFCB}C:\windows\system32\taskeng.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskeng.exe |
"UDP Query User{E8E63E2A-4335-4211-B75A-959109F0F658}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{F1F02F0A-7DF2-4103-AF47-D33F6CEFF925}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{FE65868D-B3A6-476E-B18A-DC07276FA767}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1838C5A2-AB32-4145-85C1-BB9B8DFA24CD}" = QuickTime
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1B14B0C3-2D60-477C-A1FE-B88E60948854}" = OpenOffice.org 2.4
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 23
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{44734179-8A79-4DEE-BB08-73037F065543}" = Apple Mobile Device Support
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{585776BC-4BD6-4BD2-A19A-1D6CB44A403B}" = iTunes
"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7148F0A8-6813-11D6-A77B-00B0D0142190}" = Java 2 Runtime Environment, SE v1.4.2_19
"{7A7B0BF3-2F00-4F03-8A9B-6ABCC07B90C6}" = Windows Live installer
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_VISPROR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_VISPROR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_VISPROR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0054-0409-0000-0000000FF1CE}" = Microsoft Office Visio MUI (English) 2007
"{90120000-0054-0409-0000-0000000FF1CE}_VISPROR_{519D9F45-CBF4-4E57-B419-11F196CCA8AE}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_VISPROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_VISPROR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{91120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{91120000-0051-0000-0000-0000000FF1CE}_VISPROR_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{91120000-0051-0000-0000-0000000FF1CE}_VISPROR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aMSN" = aMSN 0.97.2
"Applian FLV Player2.0.24" = Applian FLV Player
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Der Schreibtrainer" = Der Schreibtrainer 3.7
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"Foxit Reader" = Foxit Reader
"FreePDF_XP" = FreePDF XP (Remove only)
"GPL Ghostscript 8.63" = GPL Ghostscript 8.63
"GSview 4.9" = GSview 4.9
"HP OrderReminder" = HP OrderReminder
"HP-LaserJet 1018" = LaserJet 1018
"Juniper Network Connect 6.3.0" = Juniper Networks Network Connect 6.3.0
"Juniper Network Connect 6.5.0" = Juniper Networks Network Connect 6.5.0
"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MatlabR2009a" = MATLAB R2009a
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"NVIDIA Drivers" = NVIDIA Drivers
"PartyPoker" = PartyPoker
"pdfsam" = pdfsam
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Veoh Web Player Beta" = Veoh Web Player Beta
"VISPROR" = Microsoft Office Visio Professional 2007 Trial
"VLC media player" = VLC media player 0.9.2
"Vpskeys_is1" = Vpskeys 4.3
"Winamp" = Winamp
"WinRAR archiver" = WinRAR Archivierer
"winscp3_is1" = WinSCP 4.2.7
"Xvid_is1" = Xvid 1.2.2 final uninstall
"yEd Graph Editor 3.4.0.2" = yEd Graph Editor 3.4.0.2
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Juniper_Setup_Client" = Juniper Networks Setup Client
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 10.02.2010 05:56:08 | Computer Name = D611 | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6856.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
das Problem zu suchen. Prozess-ID: d34 Anfangszeit: 01caaa33dc8ccebb Zeitpunkt der
Beendigung: 47
Error - 11.02.2010 15:04:05 | Computer Name = D611 | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6856.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
das Problem zu suchen. Prozess-ID: 334 Anfangszeit: 01caab46105e6a0a Zeitpunkt der
Beendigung: 0
Error - 12.02.2010 09:08:53 | Computer Name = D611 | Source = Windows Search Service | ID = 3013
Description =
Error - 12.02.2010 09:09:09 | Computer Name = D611 | Source = Windows Search Service | ID = 3013
Description =
Error - 12.02.2010 09:09:12 | Computer Name = D611 | Source = Windows Search Service | ID = 3013
Description =
Error - 13.02.2010 12:10:27 | Computer Name = D611 | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.0.3623 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 480 Anfangszeit: 01caaca93e24acad Zeitpunkt der Beendigung:
21
Error - 14.02.2010 10:44:34 | Computer Name = D611 | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 1.9.0.3623 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: bf0 Anfangszeit: 01caad757e282a21 Zeitpunkt der Beendigung:
36
Error - 25.02.2010 14:06:52 | Computer Name = D611 | Source = Windows Search Service | ID = 3013
Description =
Error - 05.03.2010 05:58:18 | Computer Name = D611 | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung winamp.exe, Version 5.5.4.2165, Zeitstempel
0x4896392e, fehlerhaftes Modul winamp.exe, Version 5.5.4.2165, Zeitstempel 0x4896392e,
Ausnahmecode 0xc0000005, Fehleroffset 0x0003b34e, Prozess-ID 0x894, Anwendungsstartzeit
01cabc4a16629cbe.
Error - 09.03.2010 13:11:52 | Computer Name = D611 | Source = Microsoft-Windows-SpoolerSpoolss | ID = 1031
Description =
[ System Events ]
Error - 07.02.2011 12:37:03 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 07.02.2011 12:37:03 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 08.02.2011 16:31:59 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 08.02.2011 16:31:59 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 09.02.2011 13:06:53 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 09.02.2011 13:06:53 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 09.02.2011 17:42:04 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 09.02.2011 17:42:04 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 10.02.2011 11:56:16 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
Error - 10.02.2011 11:56:16 | Computer Name = D611 | Source = Service Control Manager | ID = 7000
Description =
< End of report >
|
| Themen zu Spyeye - keylogger noch da? |
| anschluss, anti-malware, antworten, appdata, aufsetzen, dateien, doppel, doppelt, explorer, forum, gelöscht, infizierte, keylogger, leute, microsoft, neu, neu aufsetzen, problem, rechner, roaming, security, service, software, start, start menu, trojan.spyeyes, version, worte |
Baum-Darstellung