| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware.Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.03.2011, 23:56
| #1 |
 |  Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. Hallo. Sorry bin ein Anfänger in sachen Viren und so Zeug. Aber könnt ihr mir bitte Helfen? Also: Mein Netbook ist ziehmlich langsam geworden,dauernd öffnet sich der Windows Installer und will shredder.msi öffnen auf einem Pfad der nicht existiert. Es öffnen sich sachen von alleine und Chrome läuft nichtmehr. Habe einen Komplett Scan mit Adaware gemacht und 6 Funde. Diese Bereinigt aber die Probleme halten an. Ich hoffe ihr könnt mir sagen was ich tuhen soll und wie ich jetz weiter mach. Weiteres kann ich euch zu den Funden nicht sagen. PS : Ich würde gerne Spenden, da ich so einen super Dienst gerne Supporte.  MFG Der Moneyboy PPS: wie muss ich ein logfile zensieren? |
|
09.03.2011, 12:25
| #2 |
| /// Malware-holic   | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. wie meinst du zensieren?
__________________namen löschen? versuchs mal mit bearbeiten, suchen und ersetzen. dort gibst du in das eine feld den namen ein und in das andere *** dann gehts los. spenden kannst du über den link in meiner signatur. danke übrigens :-) Systemscan mit OTL download otl: http://filepony.de/download-otl/ Doppelklick auf die OTL.exe (user von Windows 7 und Vista: Rechtsklick als Administrator ausführen) 1. Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output 2. Hake an "scan all users" 3. Unter "Extra Registry wähle: "Use Safelist" "LOP Check" "Purity Check" 4. Kopiere in die Textbox: netsvcs msconfig safebootminimal safebootnetwork activex drivers32 %ALLUSERSPROFILE%\Application Data\*. %ALLUSERSPROFILE%\Application Data\*.exe /s %APPDATA%\*. %APPDATA%\*.exe /s %SYSTEMDRIVE%\*.exe /md5start userinit.exe eventlog.dll scecli.dll netlogon.dll cngaudit.dll ws2ifsl.sys sceclt.dll ntelogon.dll winlogon.exe logevent.dll user32.DLL explorer.exe iaStor.sys nvstor.sys atapi.sys IdeChnDr.sys viasraid.sys AGP440.sys vaxscsi.sys nvatabus.sys viamraid.sys nvata.sys nvgts.sys iastorv.sys ViPrt.sys eNetHook.dll ahcix86.sys KR10N.sys nvstor32.sys ahcix86s.sys /md5stop %systemroot%\system32\drivers\*.sys /lockedfiles %systemroot%\System32\config\*.sav %systemroot%\*. /mp /s %systemroot%\system32\*.dll /lockedfiles CREATERESTOREPOINT 5. Klicke "Scan" 6. 2 reporte werden erstellt: OTL.Txt Extras.Txt beide posten
__________________ |
|
09.03.2011, 14:32
| #3 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. hier mal das Malwarebytes logfile.aber,ich habe nie eine setup.exe in diesen ordner gesteckt !und morphvox ist mir auch unbekannt
__________________Code:
ATTFilter Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 5997
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
09.03.2011 14:25:23
mbam-log-2011-03-09 (14-25-01).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|)
Durchsuchte Objekte: 444496
Laufzeit: 4 Stunde(n), 8 Minute(n), 45 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\program files\screaming bee\morphvox pro\patch.exe (Trojan.Downloader) -> No action taken.
c:\Users\kniebeugengurkenfeld\AppData\Local\microsoft\Windows\Burn\Burn3\setup.EXE (Dont.Steal.Our.Software) -> No action taken.
c:\Users\mediazentrum\downloads\mc.exe (Trojan.Agent.CK) -> No action taken.
c:\Windows\KMSAct.exe (Spyware.Banker) -> No action taken.
OTL wird folgen sobald fertig |
|
09.03.2011, 16:40
| #4 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. bei mir ist das deutsch. es gibt kein output kästchen! |
|
09.03.2011, 16:43
| #5 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. dann eben ausgabe.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.03.2011, 14:54
| #6 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. So hier erstmal das OTL.txt : Code:
ATTFilter OTL logfile created on: 10.03.2011 11:52:13 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Mediazentrum\Downloads Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1.013,00 Mb Total Physical Memory | 86,00 Mb Available Physical Memory | 8,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 36,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 215,79 Gb Total Space | 89,10 Gb Free Space | 41,29% Space Free | Partition Type: NTFS Drive D: | 4,00 Gb Total Space | 2,65 Gb Free Space | 66,43% Space Free | Partition Type: FAT32 Computer Name: ALLESKÖNNER | User Name: Mediazentrum | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Mediazentrum\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) PRC - C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) PRC - C:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) PRC - C:\Programme\PC Tools Security\pctsGui.exe (PC Tools) PRC - C:\Users\League of Legends\Downloads\Pictures\SbieSvc.exe (SANDBOXIE L.T.D) PRC - C:\Programme\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - C:\Programme\ICQ6Toolbar\ICQ Service.exe () PRC - C:\Programme\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.) PRC - C:\Programme\CyberLink\YouCam\YCMMirage.exe (CyberLink) PRC - C:\Programme\Acer\Updater\iUpdate.exe (Insyde Software Corp.) PRC - C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer ePower Management\ePowerEvent.exe (Acer Incorporated) PRC - C:\Programme\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation) PRC - C:\Programme\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) PRC - C:\Programme\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.) PRC - C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.) PRC - C:\Programme\Launch Manager\LMworker.exe (Dritek System Inc.) PRC - C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) PRC - C:\Programme\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) PRC - C:\Programme\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) PRC - C:\Programme\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) PRC - C:\Programme\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) PRC - C:\Programme\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated) PRC - C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Acer\Registration\GREGsvc.exe (Acer Incorporated) PRC - C:\Programme\Acer\Android Manager\iSync.exe (Insyde Software Corp.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Programme\Stardock\MyColors\WBVista.exe () PRC - C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation) PRC - C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\Mediazentrum\Downloads\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) MOD - C:\Programme\Acer\Acer ePower Management\SysHook.dll (Acer Incorporated) ========== Win32 Services (SafeList) ========== SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH) SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (Akamai) -- c:\Programme\Common Files\Akamai\netsession_win_dbc0250.dll () SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (sdCoreService) -- C:\Programme\PC Tools Security\pctsSvc.exe (PC Tools) SRV - (SbieSvc) -- C:\Users\League of Legends\Downloads\Pictures\SbieSvc.exe (SANDBOXIE L.T.D) SRV - (AdobeActiveFileMonitor9.0) -- C:\Programme\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe (Adobe Systems Incorporated) SRV - (ICQ Service) -- C:\Programme\ICQ6Toolbar\ICQ Service.exe () SRV - (ePowerSvc) -- C:\Programme\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) SRV - (NOBU) -- C:\Program Files\Symantec\Norton Online Backup\NOBuAgent.exe (Symantec Corporation) SRV - (MWLService) -- C:\Programme\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.) SRV - (DsiWMIService) -- C:\Programme\Launch Manager\dsiwmis.exe (Dritek System Inc.) SRV - (sftvsa) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) SRV - (sftlist) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) SRV - (sdAuxService) -- C:\Programme\PC Tools Security\pctsAuxs.exe (PC Tools) SRV - (SwitchBoard) -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) SRV - (RS_Service) -- C:\Programme\Acer\Acer VCM\RS_Service.exe (Acer Incorporated) SRV - (Updater Service) -- C:\Programme\Acer\Acer Updater\UpdaterService.exe (Acer Group) SRV - (GREGService) -- C:\Programme\Acer\Registration\GREGsvc.exe (Acer Incorporated) SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WindowBlinds) -- C:\Programme\Stardock\MyColors\VistaSrv.exe (Stardock Corporation) ========== Driver Services (SafeList) ========== DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (Lavasoft Kernexplorer) -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys () DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation) DRV - (PCTCore) -- C:\Windows\system32\drivers\PCTCore.sys (PC Tools) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (SbieDrv) -- C:\Users\League of Legends\Downloads\Pictures\SbieDrv.sys (SANDBOXIE L.T.D) DRV - (clwvd) -- C:\Windows\System32\drivers\clwvd.sys (CyberLink Corporation) DRV - (pctEFA) -- C:\Windows\system32\drivers\pctEFA.sys (PC Tools) DRV - (pctDS) -- C:\Windows\system32\drivers\pctDS.sys (PC Tools) DRV - (EUCR) -- C:\Windows\System32\drivers\EUCR6SK.sys (ENE Technology Inc.) DRV - (CEDRIVER55) -- C:\Users\League of Legends\Desktop\Random Stuff -_-\Cheat Engine\dbk32.sys () DRV - (L1C) -- C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.) DRV - (Sftvol) -- C:\Windows\System32\drivers\Sftvollh.sys (Microsoft Corporation) DRV - (Sftredir) -- C:\Windows\System32\drivers\Sftredirlh.sys (Microsoft Corporation) DRV - (Sftplay) -- C:\Windows\System32\drivers\Sftplaylh.sys (Microsoft Corporation) DRV - (Sftfs) -- C:\Windows\System32\drivers\Sftfslh.sys (Microsoft Corporation) DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.) DRV - (mwlPSDVDisk) -- C:\Windows\System32\drivers\mwlPSDVDisk.sys (Egis Technology Inc.) DRV - (mwlPSDNServ) -- C:\Windows\System32\drivers\mwlPSDNserv.sys (Egis Technology Inc.) DRV - (mwlPSDFilter) -- C:\Windows\System32\drivers\mwlPSDFilter.sys (Egis Technology Inc.) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (SCREAMINGBDRIVER) -- C:\Windows\System32\drivers\ScreamingBAudio.sys (Screaming Bee LLC) DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234 IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyng.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 190.190.10.2:8080 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 190.190.10.2:8080 IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-4078793537-602570694-1006584548-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234 IE - HKU\S-1-5-21-4078793537-602570694-1006584548-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234 IE - HKU\S-1-5-21-4078793537-602570694-1006584548-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "resource:///locales/de-DE/readme.html" FF - HKLM\software\mozilla\Firefox\Extensions\\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}: C:\Program Files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2011.02.09 18:40:48 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.03.02 05:58:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.03.02 05:58:56 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\K-Meleon\Extensions\\Plugins: C:\Program Files\K-Meleon\Plugins [2010.12.05 12:03:23 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\K-Meleon\Extensions\\Components: C:\Program Files\K-Meleon\Components [2010.11.20 11:34:14 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.06 21:14:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.06 21:14:17 | 000,000,000 | ---D | M] [2011.02.09 21:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mediazentrum\AppData\Roaming\mozilla\Extensions [2011.02.09 21:15:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mediazentrum\AppData\Roaming\mozilla\Firefox\Profiles\sbvt0t63.default\extensions [2011.02.24 21:31:12 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.11.22 16:01:52 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.03.27 18:06:04 | 000,067,032 | ---- | M] (Adobe Systems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npContribute.dll [2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.11.03 07:45:27 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.11.03 07:45:27 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.11.03 07:45:27 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.11.03 07:45:27 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.11.03 07:45:27 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.02.28 19:50:06 | 000,001,191 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (ContributeBHO Class) - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyng.dll (Conduit Ltd.) O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll (Google Inc.) O2 - BHO: (Social Point Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\Adobe Contribute CS5\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.) O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Programme\Zynga\tbZyng.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Social Point Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-4078793537-602570694-1006584548-1005\..\Toolbar\WebBrowser: (Zynga Toolbar) - {7B13EC3E-999A-4B70-B9CB-2617B8323822} - C:\Programme\Zynga\tbZyng.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-4078793537-602570694-1006584548-1005\..\Toolbar\WebBrowser: (Social Point Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [Acer ePower Management] C:\Programme\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated) O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AndroidManager] C:\Programme\Acer\Android Manager\AML.exe () O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [iPatchData] C:\Programme\Acer\Updater\iUpdate.exe (Insyde Software Corp.) O4 - HKLM..\Run: [ISTray] C:\Program Files\PC Tools Security\pctsGui.exe (PC Tools) O4 - HKLM..\Run: [iSyncData] C:\Programme\Acer\Android Manager\iSync.exe (Insyde Software Corp.) O4 - HKLM..\Run: [LManager] C:\Programme\Launch Manager\LManager.exe (Dritek System Inc.) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [mwlDaemon] C:\Programme\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.) O4 - HKLM..\Run: [Norton Online Backup] C:\Programme\Symantec\Norton Online Backup\NOBuClient.exe (Symantec Corporation) O4 - HKLM..\Run: [SuiteTray] C:\Program Files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [YouCam Mirage] C:\Program Files\CyberLink\YouCam\YCMMirage.exe (CyberLink) O4 - HKLM..\Run: [YouCam Tray] C:\Program Files\CyberLink\YouCam\YouCamTray.exe (CyberLink Corp.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O4 - Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O4 - Startup: C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O4 - Startup: C:\Users\League of Legends\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O4 - Startup: C:\Users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Programme\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk = C:\Programme\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - File not found O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files\Common Files\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH) O13 - gopher Prefix: missing O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} hxxp://support.asus.com/common/asusTek_sys_ctrl.cab (asusTek_sysctrl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Acer\Acer VCM\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O22 - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation) O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{c0b63296-3904-11e0-ba50-5cac4c1278bb}\Shell - "" = AutoRun O33 - MountPoints2\{c0b63296-3904-11e0-ba50-5cac4c1278bb}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) SafeBootMin: MCODS - Reg Error: Value error. SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: Hamachi2Svc - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.) SafeBootNet: HelpSvc - Service SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) SafeBootNet: McMPFSvc - Service SafeBootNet: MCODS - Reg Error: Value error. SafeBootNet: Messenger - File not found SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {3E29CA06-BC7B-E6B9-4F1E-7E9D5F8825C6} - Internet Explorer ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C97AB1F3-D7BD-E41D-FF47-6C9647633BDE} - Internet Explorer ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.) Drivers32: vidc.iv50 - C:\Windows\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation) Drivers32: vidc.yv12 - C:\Windows\System32\DivX.dll (DivX, Inc.) ========== Files/Folders - Created Within 30 Days ========== [2011.03.09 21:20:37 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll [2011.03.09 21:20:36 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll [2011.03.09 21:20:35 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll [2011.03.09 21:20:35 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2011.03.09 19:08:24 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\ImgBurn [2011.03.09 12:36:52 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Acer GameZone [2011.03.09 10:13:52 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Malwarebytes [2011.03.09 10:13:19 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.03.09 10:13:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.03.09 10:13:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.03.09 10:13:11 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.03.09 10:13:10 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.03.07 00:46:27 | 000,026,176 | -H-- | C] (LogMeIn, Inc.) -- C:\Windows\System32\hamachi.sys [2011.03.06 22:28:55 | 000,000,000 | ---D | C] -- C:\Programme\ManyCam [2011.03.05 23:12:03 | 000,064,512 | ---- | C] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys [2011.03.05 23:11:55 | 000,098,392 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2011.03.05 23:07:15 | 000,000,000 | -H-D | C] -- C:\ProgramData\{A5847AFF-A1FE-4929-A3C0-16C23AB1D29D} [2011.03.05 23:06:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft [2011.03.05 23:06:08 | 000,000,000 | ---D | C] -- C:\Programme\Lavasoft [2011.03.05 23:06:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft [2011.03.05 12:02:59 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Google [2011.03.04 14:32:36 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Liteon [2011.03.04 11:03:29 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Desktop\Spiele [2011.03.03 20:44:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Documents\GTA San Andreas User Files [2011.03.03 18:45:56 | 000,098,304 | ---- | C] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll [2011.03.03 18:45:36 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games [2011.03.03 18:20:28 | 000,000,000 | ---D | C] -- C:\Programme\Rockstar Games [2011.03.03 18:20:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games [2011.02.28 09:58:36 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\LogMeIn Hamachi [2011.02.26 23:33:22 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan [2011.02.26 23:33:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager [2011.02.26 23:32:48 | 000,000,000 | ---D | C] -- C:\Programme\Security Task Manager [2011.02.26 00:05:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.02.26 00:04:31 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.02.26 00:04:21 | 000,135,096 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.02.26 00:04:21 | 000,061,960 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.02.26 00:04:21 | 000,051,992 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntdd.sys [2011.02.26 00:04:21 | 000,017,016 | ---- | C] (AVIRA GmbH) -- C:\Windows\System32\drivers\avgntmgr.sys [2011.02.26 00:04:13 | 000,000,000 | ---D | C] -- C:\Programme\Avira [2011.02.26 00:04:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.02.25 14:56:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BestGameEver [2011.02.25 14:56:15 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Mfc42loc.dll [2011.02.25 14:56:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks [2011.02.25 14:56:08 | 000,000,000 | ---D | C] -- C:\Programme\Bethesda Softworks [2011.02.25 14:53:21 | 000,000,000 | ---D | C] -- C:\Programme\BestGameEver [2011.02.25 14:05:28 | 000,000,000 | ---D | C] -- C:\Programme\Raptr [2011.02.25 13:39:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neo Steam [2011.02.25 13:03:53 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt [2011.02.25 06:27:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2011.02.24 19:14:30 | 000,000,000 | ---D | C] -- C:\AeriaGames [2011.02.24 14:53:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NeoSteam_DE [2011.02.24 14:53:06 | 000,000,000 | ---D | C] -- C:\GAMIGO [2011.02.23 15:12:26 | 000,442,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.02.23 15:12:25 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll [2011.02.22 20:11:55 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\DESIGNER [2011.02.20 22:30:45 | 000,032,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msonpmon.dll [2011.02.20 22:11:40 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio [2011.02.20 21:52:15 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Visual Studio 8 [2011.02.20 18:34:12 | 000,039,352 | ---- | C] (Infowatch) -- C:\Windows\System32\drivers\CSVirtualDiskDrv.sys [2011.02.20 18:34:11 | 000,088,632 | ---- | C] (Infowatch) -- C:\Windows\System32\drivers\CSCrySec.sys [2011.02.20 18:34:10 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE [2011.02.18 18:54:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi [2011.02.18 18:53:59 | 000,000,000 | ---D | C] -- C:\Programme\LogMeIn Hamachi [2011.02.16 14:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVD Flick [2011.02.16 14:42:59 | 000,040,960 | ---- | C] (vbAccelerator) -- C:\Windows\System32\ssubtmr6.dll [2011.02.16 14:42:59 | 000,036,864 | ---- | C] (Robdogg Inc.) -- C:\Windows\System32\trayicon_handler.ocx [2011.02.16 14:42:59 | 000,028,672 | ---- | C] (-) -- C:\Windows\System32\mousewheel.ocx [2011.02.16 14:42:58 | 000,164,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\comct232.ocx [2011.02.16 14:42:53 | 000,000,000 | ---D | C] -- C:\Programme\DVD Flick [2011.02.15 18:34:37 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\.minecraft [2011.02.11 15:48:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free FLV Converter [2011.02.11 15:48:17 | 000,307,200 | ---- | C] (FLV.com) -- C:\Windows\System32\TubeFinder.exe [2011.02.11 15:48:14 | 000,119,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\VB6FR.DLL [2011.02.11 15:48:14 | 000,084,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PICCLP32.OCX [2011.02.11 15:48:13 | 000,141,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MSCMCFR.DLL [2011.02.11 15:48:13 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CMDLGFR.DLL [2011.02.11 15:48:13 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\PCCLPFR.DLL [2011.02.11 15:48:12 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\FreeFLVConverter [2011.02.11 15:48:12 | 000,000,000 | ---D | C] -- C:\Programme\Free FLV Converter [2011.02.11 14:20:04 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Desktop\Poopmaterial [2011.02.11 14:19:09 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Documents\DVDVideoSoft [2011.02.11 10:54:18 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\vlc [2011.02.11 10:45:12 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Publish Providers [2011.02.11 10:44:55 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Documents\Vegas Movie Studio PE 9.0 Projekte [2011.02.11 10:44:55 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Sony [2011.02.11 10:44:55 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Sony [2011.02.11 06:10:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony [2011.02.11 06:10:20 | 000,000,000 | ---D | C] -- C:\Programme\Vstplugins [2011.02.11 06:10:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony [2011.02.11 06:09:51 | 000,000,000 | ---D | C] -- C:\Programme\Sony [2011.02.11 06:06:47 | 000,000,000 | ---D | C] -- C:\Programme\Sony Setup [2011.02.11 05:59:11 | 013,311,744 | ---- | C] (Sony Creative Software Inc.) -- C:\Users\Mediazentrum\Documents\VegasMovieStudioPE90.exe [2011.02.11 05:59:10 | 000,792,320 | ---- | C] (Sony Creative Software Inc.) -- C:\Users\Mediazentrum\Documents\sfapprw.dll [2011.02.11 05:48:02 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\DivX [2011.02.11 05:47:35 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Documents\Adobe [2011.02.11 05:44:10 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Adobe Flash Builder [2011.02.11 05:39:32 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\.eclipse [2011.02.10 21:49:03 | 000,000,000 | ---D | C] -- C:\Programme\Ask.com [2011.02.09 22:19:22 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Skype [2011.02.09 21:15:00 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Mozilla [2011.02.09 21:15:00 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Mozilla [2011.02.09 19:17:00 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\K-Meleon [2011.02.09 19:16:58 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\K-Meleon [2011.02.09 19:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\ALM [2011.02.09 18:50:18 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\Adobe Flash Builder 4 [2011.02.09 18:43:22 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Adobe [2011.02.09 18:33:23 | 000,000,000 | ---D | C] -- C:\Programme\My Company Name [2011.02.09 18:27:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Master Collection CS5 [2011.02.09 17:26:54 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\WinRAR [2011.02.09 15:07:21 | 002,329,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2011.02.09 15:07:16 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2011.02.09 15:07:15 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2011.02.09 15:06:59 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll [2011.02.09 15:06:59 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.02.09 15:06:59 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2011.02.09 15:06:58 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.02.09 15:06:58 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2011.02.09 15:06:58 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2011.02.09 15:06:57 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2011.02.09 15:06:56 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.02.09 15:06:56 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.02.09 15:06:49 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2011.02.09 15:06:49 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2011.02.09 15:06:42 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2011.02.09 15:06:42 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2011.02.09 15:06:38 | 001,170,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2011.02.09 15:06:38 | 000,739,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2011.02.09 15:06:37 | 001,074,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2011.02.09 15:06:36 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2011.02.09 15:06:35 | 001,495,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ExplorerFrame.dll [2011.02.09 15:06:35 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2011.02.09 15:06:35 | 000,135,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsRasterService.dll [2011.02.09 15:06:29 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\upnp.dll [2011.02.09 15:06:25 | 000,080,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\davclnt.dll [2011.02.09 15:06:25 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wscapi.dll [2011.02.09 15:06:25 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\slwga.dll [2011.02.09 15:06:19 | 000,219,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys [2011.02.09 15:06:19 | 000,107,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cdd.dll [2011.02.09 14:55:06 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Google [2011.02.09 14:53:24 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Stardock [2011.02.09 14:53:08 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Adobe [2011.02.09 14:53:07 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Adobe [2011.02.09 14:52:51 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\EgisTec IPS [2011.02.09 14:52:06 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Searches [2011.02.09 14:52:06 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.02.09 14:51:42 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Identities [2011.02.09 14:51:27 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Contacts [2011.02.09 14:51:04 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\VirtualStore [2011.02.09 14:50:51 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\AppData\Local\Temporary Internet Files [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Vorlagen [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\AppData\Local\Verlauf [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Startmenü [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\SendTo [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Recent [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Netzwerkumgebung [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Lokale Einstellungen [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Documents\Eigene Videos [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Documents\Eigene Musik [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Eigene Dateien [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Documents\Eigene Bilder [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Druckumgebung [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Cookies [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\AppData\Local\Anwendungsdaten [2011.02.09 14:50:50 | 000,000,000 | -HSD | C] -- C:\Users\Mediazentrum\Anwendungsdaten [2011.02.09 14:50:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Temp [2011.02.09 14:50:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Microsoft Help [2011.02.09 14:50:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Local\Microsoft [2011.02.09 14:50:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Media Center Programs [2011.02.09 14:50:47 | 000,000,000 | ---D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Macromedia [2011.02.09 14:50:46 | 000,000,000 | --SD | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Links [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Favorites [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Downloads [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Documents [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Desktop [2011.02.09 14:50:46 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.02.09 14:50:46 | 000,000,000 | -H-D | C] -- C:\Users\Mediazentrum\AppData [2011.02.09 14:50:45 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Videos [2011.02.09 14:50:45 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Saved Games [2011.02.09 14:50:45 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Pictures [2011.02.09 14:50:45 | 000,000,000 | R--D | C] -- C:\Users\Mediazentrum\Music [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.03.10 12:09:08 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.03.10 12:09:08 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.03.10 11:49:17 | 000,013,920 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.03.10 11:49:16 | 000,013,920 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.03.10 11:36:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.03.10 11:36:40 | 796,729,344 | -HS- | M] () -- C:\hiberfil.sys [2011.03.09 21:20:15 | 001,109,042 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB [2011.03.09 12:36:59 | 000,001,170 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Acer GameZone Online.lnk [2011.03.09 12:36:55 | 000,002,156 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Solitaire for Dummies.lnk [2011.03.09 10:13:19 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.03.06 15:08:42 | 001,966,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.03.06 15:08:42 | 001,009,180 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.03.06 15:08:42 | 000,547,306 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.03.06 15:08:42 | 000,482,214 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.03.05 23:11:55 | 000,098,392 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2011.03.05 23:07:12 | 000,001,112 | ---- | M] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.03.04 11:01:46 | 079,040,418 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\sohphia und deine mudda.psd [2011.03.04 09:20:24 | 000,064,512 | ---- | M] (Lavasoft AB) -- C:\Windows\System32\drivers\Lbd.sys [2011.03.04 09:20:23 | 000,016,432 | ---- | M] () -- C:\Windows\System32\lsdelete.exe [2011.03.03 18:45:56 | 000,098,304 | ---- | M] (Sony DADC Austria AG.) -- C:\Windows\System32\CmdLineExt.dll [2011.03.03 18:20:19 | 000,001,856 | ---- | M] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2011.02.28 19:50:06 | 000,001,191 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts [2011.02.26 16:00:59 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.02.26 16:00:59 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.02.26 11:50:26 | 003,799,648 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.02.25 13:39:14 | 000,000,988 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Neo Steam.lnk [2011.02.15 14:32:16 | 000,001,772 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\tanks.lnk [2011.02.14 16:04:08 | 019,067,589 | ---- | M] () -- C:\Users\Mediazentrum\Documents\Youtube Kacke - Witz Witz Klopfe.mp4 [2011.02.14 15:49:39 | 001,273,411 | ---- | M] () -- C:\Users\Mediazentrum\Documents\00000000.mp4 [2011.02.14 13:35:47 | 000,001,145 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\00000000.restored.lnk [2011.02.14 10:16:48 | 000,035,296 | ---- | M] () -- C:\Users\Mediazentrum\Documents\editable intro.veg [2011.02.11 16:25:54 | 068,471,725 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.wmv [2011.02.11 16:09:58 | 071,571,272 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.mp4 [2011.02.11 16:07:06 | 000,012,232 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\WTF Boom sound.avi.sfk [2011.02.11 16:02:44 | 000,027,928 | ---- | M] () -- C:\Users\Mediazentrum\Documents\editable intro.veg.bak [2011.02.11 16:00:31 | 000,892,216 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.avi.sfk [2011.02.11 15:58:16 | 068,980,520 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.avi [2011.02.11 15:56:27 | 000,380,110 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\WTF Boom sound.avi [2011.02.11 15:48:18 | 000,001,079 | ---- | M] () -- C:\Users\Mediazentrum\Desktop\Free FLV Converter.lnk [2011.02.11 15:27:25 | 000,018,288 | ---- | M] () -- C:\Users\Mediazentrum\Documents\Ohne Titel.veg [2011.02.11 15:09:19 | 000,002,688 | ---- | M] () -- C:\Users\Mediazentrum\Documents\Vegas Pro registrieren.htm [2011.02.11 10:44:40 | 000,002,680 | ---- | M] () -- C:\Users\Mediazentrum\Documents\Vegas Movie Studio Platinum registrieren.htm [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.03.09 12:36:59 | 000,001,170 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Acer GameZone Online.lnk [2011.03.09 12:36:55 | 000,002,156 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Solitaire for Dummies.lnk [2011.03.09 10:13:19 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.03.06 12:43:08 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe [2011.03.05 23:07:12 | 000,001,112 | ---- | C] () -- C:\Users\Public\Desktop\Ad-Aware.lnk [2011.03.04 11:01:44 | 079,040,418 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\sohphia und deine mudda.psd [2011.03.03 18:20:19 | 000,001,856 | ---- | C] () -- C:\Users\Public\Desktop\GTA San Andreas.lnk [2011.02.25 13:39:14 | 000,000,988 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Neo Steam.lnk [2011.02.15 14:29:57 | 000,001,772 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\tanks.lnk [2011.02.14 15:54:33 | 019,067,589 | ---- | C] () -- C:\Users\Mediazentrum\Documents\Youtube Kacke - Witz Witz Klopfe.mp4 [2011.02.14 15:48:49 | 001,273,411 | ---- | C] () -- C:\Users\Mediazentrum\Documents\00000000.mp4 [2011.02.14 13:35:47 | 000,001,145 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\00000000.restored.lnk [2011.02.11 16:20:58 | 068,471,725 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.wmv [2011.02.11 16:06:08 | 000,012,232 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\WTF Boom sound.avi.sfk [2011.02.11 16:05:39 | 071,571,272 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.mp4 [2011.02.11 15:59:43 | 000,892,216 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.avi.sfk [2011.02.11 15:56:07 | 000,380,110 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\WTF Boom sound.avi [2011.02.11 15:54:04 | 068,980,520 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Kuchenbome.avi [2011.02.11 15:48:18 | 000,001,079 | ---- | C] () -- C:\Users\Mediazentrum\Desktop\Free FLV Converter.lnk [2011.02.11 15:48:14 | 000,364,544 | ---- | C] () -- C:\Windows\System32\PropertyGrid.ocx [2011.02.11 15:48:14 | 000,208,500 | ---- | C] () -- C:\Windows\System32\ReyXpBasics.tlb [2011.02.11 15:48:13 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ControlSubX.ocx [2011.02.11 15:43:12 | 000,035,296 | ---- | C] () -- C:\Users\Mediazentrum\Documents\editable intro.veg [2011.02.11 15:43:12 | 000,027,928 | ---- | C] () -- C:\Users\Mediazentrum\Documents\editable intro.veg.bak [2011.02.11 15:27:24 | 000,018,288 | ---- | C] () -- C:\Users\Mediazentrum\Documents\Ohne Titel.veg [2011.02.11 15:09:18 | 000,002,688 | ---- | C] () -- C:\Users\Mediazentrum\Documents\Vegas Pro registrieren.htm [2011.02.11 10:43:50 | 000,002,680 | ---- | C] () -- C:\Users\Mediazentrum\Documents\Vegas Movie Studio Platinum registrieren.htm [2011.02.09 14:52:12 | 000,001,413 | ---- | C] () -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.02.09 14:50:47 | 000,001,441 | ---- | C] () -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Think Green Weather.lnk [2011.01.23 00:29:48 | 000,105,736 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2010.12.15 19:53:56 | 000,868,352 | ---- | C] () -- C:\Windows\cygcrypto-0.9.8.dll [2010.12.15 14:05:27 | 000,000,193 | ---- | C] () -- C:\Windows\WORDPAD.INI [2010.12.05 12:00:43 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI [2010.12.04 15:25:31 | 000,001,796 | ---- | C] () -- C:\Windows\Sandboxie.ini [2010.12.02 20:16:39 | 001,970,176 | ---- | C] () -- C:\Windows\System32\d3dx9.dll [2010.11.24 15:17:43 | 000,000,237 | ---- | C] () -- C:\Windows\wininit.ini [2010.09.20 08:44:26 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat [2010.09.10 10:33:21 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat [2010.08.05 11:11:50 | 001,966,708 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2010.08.05 11:11:50 | 000,547,306 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2010.08.05 11:11:50 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2010.08.05 11:11:50 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2010.07.01 14:15:24 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe [2010.07.01 14:14:16 | 000,361,808 | ---- | C] () -- C:\Windows\EMCRI_E.dll [2010.07.01 14:06:31 | 000,247,560 | ---- | C] () -- C:\Windows\System32\drivers\RTConvEQ.dat [2010.07.01 14:06:31 | 000,037,468 | ---- | C] () -- C:\Windows\System32\drivers\RtPCEE3.DAT [2010.07.01 14:06:31 | 000,001,448 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat [2010.07.01 14:06:31 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX3.dat [2010.07.01 14:06:31 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat [2010.07.01 14:06:31 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat [2010.07.01 14:06:31 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat [2010.07.01 14:06:31 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat [2010.07.01 14:06:31 | 000,000,024 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 05:33:53 | 003,799,648 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 001,009,180 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,482,214 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2009.06.09 08:55:58 | 000,057,904 | ---- | C] () -- C:\Windows\System32\wbload.dll [2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2007.07.23 09:03:32 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2007.07.23 09:03:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll ========== LOP Check ========== [2011.02.22 21:29:34 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\SoftGrid Client [2011.02.19 09:25:12 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\.minecraft [2011.01.28 19:13:27 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Ashampoo Cover Studio [2011.01.28 19:42:08 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Ashampoo Cover Studio 2 [2011.02.20 21:27:58 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\DAEMON Tools Lite [2011.01.20 19:28:52 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\ImgBurn [2011.01.28 19:12:47 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\K-Meleon [2011.03.06 22:30:21 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\ManyCam [2011.02.07 17:17:51 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\OpenOffice.org [2011.03.08 13:47:56 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Raptr [2011.01.23 00:56:25 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\Screaming Bee [2011.02.06 14:11:13 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\ScummVM [2011.02.03 19:53:38 | 000,000,000 | ---D | M] -- C:\Users\KniebeugenGurkenfeld\AppData\Roaming\SoftGrid Client [2010.12.23 16:55:00 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\.minecraft [2010.12.14 06:45:00 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\Ashampoo Cover Studio 2 [2010.12.21 14:26:14 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\DAEMON Tools Lite [2010.12.02 07:43:30 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\DVDVideoSoftIEHelpers [2010.11.24 12:56:49 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\gtk-2.0 [2010.12.10 11:52:23 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\ImgBurn [2010.11.20 11:34:27 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\K-Meleon [2010.12.02 19:17:49 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\Liteon [2010.11.17 19:18:31 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\LolClient [2011.01.28 10:46:01 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\Screaming Bee [2010.12.14 06:57:24 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\SoftGrid Client [2010.11.21 00:09:40 | 000,000,000 | ---D | M] -- C:\Users\League of Legends\AppData\Roaming\uTorrent [2010.11.23 11:46:29 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\gtk-2.0 [2011.03.01 14:09:13 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\K-Meleon [2010.12.09 11:57:40 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Liteon [2010.09.20 20:25:27 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\OpenOffice.org [2011.02.14 09:26:51 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Publish Providers [2011.01.24 12:19:28 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Screaming Bee [2011.02.10 08:40:11 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\SoftGrid Client [2011.02.14 09:26:36 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\Sony [2010.09.30 07:44:27 | 000,000,000 | ---D | M] -- C:\Users\Leon\AppData\Roaming\TP [2011.02.15 18:34:37 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\.minecraft [2011.02.11 16:05:10 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\FreeFLVConverter [2011.03.09 19:10:48 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\ImgBurn [2011.02.09 19:17:15 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\K-Meleon [2011.03.04 14:32:36 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Liteon [2011.02.11 10:45:12 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Publish Providers [2011.02.11 15:09:47 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Sony [2011.03.07 20:45:50 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011.02.15 18:34:37 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\.minecraft [2011.03.04 10:53:09 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Adobe [2011.02.14 09:41:20 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\DivX [2011.02.11 16:05:10 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\FreeFLVConverter [2011.03.05 12:02:59 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Google [2011.02.09 14:51:44 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Identities [2011.03.09 19:10:48 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\ImgBurn [2011.02.09 19:17:15 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\K-Meleon [2011.03.04 14:32:36 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Liteon [2010.11.30 19:09:08 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Macromedia [2011.03.09 10:13:52 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Malwarebytes [2011.01.23 14:21:57 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Media Center Programs [2011.03.09 12:36:19 | 000,000,000 | --SD | M] -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft [2011.02.09 21:15:13 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Mozilla [2011.02.11 10:45:12 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Publish Providers [2011.03.05 12:50:29 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Skype [2011.02.11 15:09:47 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\Sony [2011.02.28 10:04:32 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\vlc [2011.02.09 19:20:08 | 000,000,000 | ---D | M] -- C:\Users\Mediazentrum\AppData\Roaming\WinRAR < %APPDATA%\*.exe /s > [2010.11.30 19:08:33 | 000,038,784 | ---- | M] () -- C:\Users\Mediazentrum\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe [2011.02.09 18:33:24 | 000,010,134 | R--- | M] () -- C:\Users\Mediazentrum\AppData\Roaming\Microsoft\Installer\{024521CF-C07E-4F8E-8481-0D75695E03AF}\ARPPRODUCTICON.exe < %SYSTEMDRIVE%\*.exe > [2008.04.29 00:35:00 | 000,013,894 | ---- | M] () -- C:\freethewads.exe < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2010.02.04 10:56:31 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2010.02.04 10:56:31 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe < MD5 for: IASTOR.SYS > [2009.10.13 18:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Programme\Intel\Intel Matrix Storage Manager\driver\IaStor.sys [2009.10.13 18:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\drivers\iaStor.sys [2009.10.13 18:09:36 | 000,331,288 | ---- | M] (Intel Corporation) MD5=0BAA4115DFFFD6A6D809A89D65E1281A -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_b12590c8dd605296\iaStor.sys [2009.10.13 18:16:40 | 000,409,624 | ---- | M] (Intel Corporation) MD5=BE7D72FCF442C26975942007E0831241 -- C:\Programme\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys < MD5 for: IASTORV.SYS > [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\drivers\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys < MD5 for: NETLOGON.DLL > [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\drivers\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll < MD5 for: USERINIT.EXE > [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > [2010.11.11 17:34:23 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] ========== Alternate Data Streams ========== @Alternate Data Stream - 145 bytes -> C:\ProgramData\TEMP:1D32EC29 @Alternate Data Stream - 143 bytes -> C:\ProgramData\TEMP:93EB7685 @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:DFC5A2B2 @Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:2A8A3140 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:4F636E25 @Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:E1F04E8D @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:E36F5B57 @Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:CDFF58FE @Alternate Data Stream - 119 bytes -> C:\ProgramData\TEMP:4D066AD2 @Alternate Data Stream - 118 bytes -> C:\ProgramData\TEMP:798A3728 < End of report > Extras.TXT Code:
ATTFilter OTL Extras logfile created on: 10.03.2011 11:52:13 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Mediazentrum\Downloads
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1.013,00 Mb Total Physical Memory | 86,00 Mb Available Physical Memory | 8,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 36,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 215,79 Gb Total Space | 89,10 Gb Free Space | 41,29% Space Free | Partition Type: NTFS
Drive D: | 4,00 Gb Total Space | 2,65 Gb Free Space | 66,43% Space Free | Partition Type: FAT32
Computer Name: ALLESKÖNNER | User Name: Mediazentrum | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = K-Meleon.HTML] -- C:\Program Files\K-Meleon\K-Meleon.exe (hxxp://kmeleon.sf.net/)
[HKEY_USERS\S-1-5-21-4078793537-602570694-1006584548-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\K-Meleon\K-Meleon.exe" "%1" (hxxp://kmeleon.sf.net/)
https [open] -- "C:\Program Files\K-Meleon\K-Meleon.exe" "%1" (hxxp://kmeleon.sf.net/)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{098A2A49-7CF3-4F08-A38D-FB879117152A}" = Adobe Color NA Extra Settings CS4
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0D7CD0D9-4A88-4A63-8F91-3F4E8F371768}" = MyWinLocker
"{0DC0E85F-36E4-463B-B3EA-4CD8ED2222A1}" = Adobe Color EU Recommended Settings CS4
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{10C6EB34-4423-4DBA-AECA-76540029FF83}" = MorphVOX Pro
"{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1BBD8D70-721A-41AD-AC8F-7308A0C8FA92}" = Adobe Creative Suite 5 Master Collection
"{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}" = Morrowind
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{25175695-4B20-4298-9F34-C2C57CD277B3}" = Elements STI Installer
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 22
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer ePower Management
"{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}" = Norton Online Backup
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{433EACD8-4747-4A6A-826A-FFA9F39B0D40}" = Elements 9 Organizer
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{51F026FA-5146-4232-A8BA-1364740BD053}" = Acer Crystal Eye webcam
"{523281E5-91DD-49F5-9D85-954148F7596A}" = AndroidInstaller
"{58F4D244-314F-4D26-B5EF-C28AB32E22CB}_is1" = Acer GameZone Console
"{5E77082C-5DFC-42EF-9B16-64AD165F6BE2}" = MX vs ATV Unleashed Demo
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{639673E9-D53F-44F4-A046-485C8A6ADA15}" = Paint.NET v3.5.6
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6D316D67-DA52-4659-9C98-F479963534D6}" = Audiosurf
"{6E9EF98E-259E-416D-B5F8-0ABDB99942CE}" = Adobe Flash Player 10 ActiveX
"{6F7614CC-F33A-4877-8814-49856F441F3C}" = Stardock MyColors
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{825E9A84-1E03-4526-9F8E-45015C938A7C}" = WBFS Manager 4.0
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110184263}" = Puzzle Express
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110300453}" = Spin & Win
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111199750}" = Cake Mania
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111355427}" = Poker Pop
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}" = Merriam Websters Spell Jam
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}" = Amazonia
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113009953}" = Turbo Pizza
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}" = Heroes of Hellas
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}" = Dream Day First Home
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-114803710}" = Star Defender 4
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11505173}" = Airport Mania First Flight
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}" = Farm Frenzy 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11560627}" = Solitaire for Dummies
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117693570}" = Zuma’s Revenge
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D1E61D1-1395-4E97-997F-D002DB3A5074}" = OpenOffice.org 3.2
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_VISPRO_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_VISPRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_VISPRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_VISPRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{0FD405D3-CAF8-4CA6-8BFD-911D2F8A6585}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-0051-0000-0000-0000000FF1CE}_VISPRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPRO_{60CC0F2D-BFA0-4851-903D-809D876DD87B}" = Microsoft Office Visio 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_VISPRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-006D-0407-0000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010
"{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}" = AGEIA PhysX v7.11.13
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BC41C09D-FAA9-4346-9FE6-1E0017BC551A}" = Adobe Flash Player 10 Plugin
"{C2695E83-CF1D-43D1-84FE-B3BEC561012A}" = Shredder
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D9D1A2FD-56B2-4F21-B959-745FE43CAB8C}" = Vegas Pro 9.0
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E0B19DF7-B1C7-4937-82C4-0E4B1E346965}" = eBay Worldwide
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EB9955F8-467C-47FC-90F8-12CD5DF684C3}" = Adobe Premiere Elements 9
"{EE171732-BEB4-4576-887D-CB62727F01CA}" = Acer Updater
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"3B29FD3CCF1F5B855DA0C521597413EBABE97DFB" = ENE USB Card Reader Driver
"Acer Registration" = Acer Registration
"Acer Screensaver" = Acer ScreenSaver
"Acer Welcome Center" = Welcome Center
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Akamai" = Akamai NetSession Interface
"Ashampoo Cover Studio 2_is1" = Ashampoo Cover Studio 2.2.0
"Ashampoo Cover Studio_is1" = Ashampoo Cover Studio 1.01
"Audacity_is1" = Audacity 1.2.6
"Avira AntiVir Desktop" = Avira AntiVir Premium
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"DivX Setup.divx.com" = DivX-Setup
"DVD Flick_is1" = DVD Flick 1.3.0.7
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free FLV Converter_is1" = Free FLV Converter V 6.93.0
"Free YouTube Download_is1" = Free YouTube Download 2.9
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9
"GEONExT_is1" = GEONExT 1.73
"Google Chrome" = Google Chrome
"Grand Fantasia" = Grand Fantasia
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HyperCam 2" = HyperCam 2
"ICQToolbar" = ICQ Toolbar
"Identity Card" = Identity Card
"ImgBurn" = ImgBurn
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}" = eSobi v2
"InstallShield_{523281E5-91DD-49F5-9D85-954148F7596A}" = AndroidInstaller
"InstallShield_{6748E773-5DA0-4D19-8AA5-273B4133A09B}" = SmartSound Quicktracks for Premiere Elements 9.0
"InstallShield_{738BF5C3-AF7B-4BB0-B7EF-E505EFC756BE}" = MyWinLocker Suite
"JDownloader" = JDownloader
"K-Meleon" = K-Meleon 1.5.4 de-DE (nur entfernen)
"LManager" = Launch Manager
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"ManyCam" = ManyCam 2.6.30 (remove only)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"mIRC" = mIRC
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"Office14.Click2Run" = Microsoft Office Klick-und-Los 2010
"OpenAL" = OpenAL
"PremElem90" = Adobe Premiere Elements 9
"Raptr" = Raptr
"Sandboxie" = Sandboxie 3.50
"ScummVM_is1" = ScummVM 1.2.1
"Security Task Manager" = Security Task Manager 1.8c
"Spyware Doctor" = Spyware Doctor 8.0
"ST6UNST #1" = Visual Basic 6.0 Runtime&Steuerelemente
"Stardock MyColors" = Stardock MyColors
"Steam App 13210" = Unreal Tournament 3: Black Edition
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"VISPRO" = Microsoft Office Visio Professional 2007
"VLC media player" = VLC media player 1.1.4
"WinGimp-2.0_is1" = GIMP 2.6.10
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Zynga Toolbar" = Zynga Toolbar
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 05.03.2011 11:46:41 | Computer Name = Alleskönner | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Die Daten sind unzulässig. .
Error - 05.03.2011 11:56:57 | Computer Name = Alleskönner | Source = CVHSVC | ID = 100
Description = Nur zur Information. Error: Unexpected MSI query product info result
ErrorCode: 1608(0x648).
Error - 05.03.2011 12:05:09 | Computer Name = Alleskönner | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Die Daten sind unzulässig. .
Error - 05.03.2011 18:09:56 | Computer Name = Alleskönner | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 05.03.2011 18:27:17 | Computer Name = Alleskönner | Source = CVHSVC | ID = 100
Description = Nur zur Information. Error: Unexpected MSI query product info result
ErrorCode: 1608(0x648).
Error - 06.03.2011 10:08:37 | Computer Name = Alleskönner | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 06.03.2011 10:08:37 | Computer Name = Alleskönner | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 06.03.2011 10:08:37 | Computer Name = Alleskönner | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 06.03.2011 17:34:19 | Computer Name = Alleskönner | Source = CVHSVC | ID = 100
Description = Nur zur Information. Error: Unexpected MSI query product info result
ErrorCode: 1608(0x648).
Error - 06.03.2011 17:35:43 | Computer Name = Alleskönner | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: raptr_im.exe, Version: 1.5.7.0, Zeitstempel:
0x4bbd3163 Name des fehlerhaften Moduls: libpurple.dll, Version: 2.7.4.0, Zeitstempel:
0x4cc0be61 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000219bd ID des fehlerhaften Prozesses:
0x1468 Startzeit der fehlerhaften Anwendung: 0x01cbdc4660d742bf Pfad der fehlerhaften
Anwendung: C:\PROGRA~1\Raptr\raptr_im.exe Pfad des fehlerhaften Moduls: C:\PROGRA~1\Raptr\libpurple.dll
Berichtskennung:
b017a22b-4839-11e0-b12b-1c750820d3f6
[ System Events ]
Error - 09.03.2011 11:04:48 | Computer Name = Alleskönner | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\athExt.dll Fehlercode: 126
Error - 09.03.2011 11:32:50 | Computer Name = Alleskönner | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst ShellHWDetection erreicht.
Error - 09.03.2011 11:33:35 | Computer Name = Alleskönner | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
Error - 09.03.2011 16:03:57 | Computer Name = Alleskönner | Source = DCOM | ID = 10016
Description =
Error - 09.03.2011 16:05:19 | Computer Name = Alleskönner | Source = DCOM | ID = 10016
Description =
Error - 10.03.2011 06:36:49 | Computer Name = Alleskönner | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?09.?03.?2011 um 21:28:52 unerwartet heruntergefahren.
Error - 10.03.2011 06:36:54 | Computer Name = Alleskönner | Source = Microsoft-Windows-WLAN-AutoConfig | ID = 10000
Description = Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad:
C:\Windows\system32\athExt.dll Fehlercode: 126
Error - 10.03.2011 06:45:43 | Computer Name = Alleskönner | Source = DCOM | ID = 10005
Description =
Error - 10.03.2011 06:45:43 | Computer Name = Alleskönner | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
Volumeschattenkopie erreicht.
Error - 10.03.2011 06:45:43 | Computer Name = Alleskönner | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Volumeschattenkopie" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
< End of report >
|
|
10.03.2011, 15:08
| #7 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.03.2011, 17:33
| #8 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. ich glaube ich habe es total versaut... es war bei irgendwie beim 3. teil fertig.. gibt ja so ca 40 wenn du weist was ich mein. aufjedenfall hat es sich aufgehängt und ich habe über taskmngr beendet. jetz wenn ich es lade kommt nur dieser ladebalken wo combofix drüber steht dann ist der balken fast fertig und es geht aus habe ich es kaputt gemacht?  |
|
10.03.2011, 17:34
| #9 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. lösche mal deine version, lads erneut runter. diesmal starte im abgesicherten modus ohnenetzwerk, sollte bei pc start mit f8 klappen und führe combofix erneut aus.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.03.2011, 18:32
| #10 |
| |  Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. Also angeblich war adaware antispy und adwatch live und antivirus geöffnet während des scans obwohl es nicht so war! beeinträchtigt das das ergebnis? naja hier der COMBOFIX log: Code:
ATTFilter ComboFix 11-03-05.01 - Mediazentrum 10.03.2011 17:55:09.2.2 - x86 MINIMAL
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.1013.458 [GMT 1:00]
ausgeführt von:: c:\users\Mediazentrum\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
AV: Lavasoft Ad-Watch Live! Virenschutz *Enabled/Updated* {9FF26384-70D4-CE6B-3ECB-E759A6A40116}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Lavasoft Ad-Watch Live! *Enabled/Updated* {24938260-56EE-C1E5-047B-DC2BDD234BAB}
SP: Spyware Doctor *Disabled/Updated* {94076BB2-F3DA-227F-9A1E-F060FF73600F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\FullRemove.exe
c:\users\League of Legends\uninstall.exe
c:\windows\system32\install
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-02-10 bis 2011-03-10 ))))))))))))))))))))))))))))))
.
.
2011-03-10 17:14 . 2011-03-10 17:14 -------- d-----w- c:\users\Leon\AppData\Local\temp
2011-03-10 17:14 . 2011-03-10 17:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-10 17:14 . 2011-03-10 17:14 -------- d-----w- c:\users\League of Legends\AppData\Local\temp
2011-03-10 17:14 . 2011-03-10 17:14 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Local\temp
2011-03-10 17:14 . 2011-03-10 17:14 -------- d-----w- c:\users\Gast\AppData\Local\temp
2011-03-10 16:03 . 2011-03-10 16:11 -------- d-----w- C:\32788R22FWJFW.2.tmp
2011-03-10 15:57 . 2011-03-10 16:03 -------- d-----w- C:\32788R22FWJFW.1.tmp
2011-03-09 20:20 . 2011-02-19 05:32 1074176 ----a-w- c:\windows\system32\DWrite.dll
2011-03-09 20:20 . 2011-02-19 05:33 802304 ----a-w- c:\windows\system32\FntCache.dll
2011-03-09 20:20 . 2011-02-19 05:32 739840 ----a-w- c:\windows\system32\d2d1.dll
2011-03-09 20:20 . 2010-12-23 05:28 642048 ----a-w- c:\windows\system32\CPFilters.dll
2011-03-09 20:20 . 2010-12-23 05:28 534528 ----a-w- c:\windows\system32\EncDec.dll
2011-03-09 20:20 . 2010-12-23 05:28 850432 ----a-w- c:\windows\system32\sbe.dll
2011-03-09 20:20 . 2010-12-23 05:24 199680 ----a-w- c:\windows\system32\mpg2splt.ax
2011-03-09 20:20 . 2010-12-18 05:30 2690560 ----a-w- c:\windows\system32\mstscax.dll
2011-03-09 20:20 . 2010-12-18 05:26 1034240 ----a-w- c:\windows\system32\mstsc.exe
2011-03-09 20:05 . 2011-03-09 20:05 -------- d-----w- c:\users\Gast\AppData\Roaming\Malwarebytes
2011-03-09 10:54 . 2003-02-27 15:12 696320 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll
2011-03-09 10:54 . 2002-12-05 13:10 155648 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll
2011-03-09 10:54 . 2002-12-02 14:22 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe
2011-03-09 10:54 . 2002-12-02 12:33 57344 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll
2011-03-09 10:54 . 2002-12-02 12:33 237568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll
2011-03-09 10:53 . 2011-03-09 10:53 163972 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll
2011-03-09 10:53 . 2011-03-09 10:53 282756 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll
2011-03-09 09:13 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-09 09:13 . 2011-03-09 09:13 -------- d-----w- c:\programdata\Malwarebytes
2011-03-09 09:13 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-09 09:13 . 2011-03-09 09:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-06 23:46 . 2009-03-18 15:35 26176 ---ha-w- c:\windows\system32\hamachi.sys
2011-03-06 21:30 . 2011-03-06 21:39 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Local\ManyCam
2011-03-06 21:29 . 2011-03-06 21:30 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\ManyCam
2011-03-06 21:28 . 2011-03-06 21:29 -------- d-----w- c:\program files\ManyCam
2011-03-06 11:43 . 2011-03-04 08:20 16432 ----a-w- c:\windows\system32\lsdelete.exe
2011-03-05 22:12 . 2011-03-04 08:20 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-03-05 22:11 . 2011-03-05 22:11 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-03-05 22:10 . 2011-03-05 22:10 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Local\Sunbelt Software
2011-03-05 22:07 . 2011-03-05 22:07 -------- dc-h--w- c:\programdata\{A5847AFF-A1FE-4929-A3C0-16C23AB1D29D}
2011-03-05 22:06 . 2011-03-05 22:09 -------- d-----w- c:\programdata\Lavasoft
2011-03-05 22:06 . 2011-03-05 22:06 -------- d-----w- c:\program files\Lavasoft
2011-03-03 17:45 . 2011-03-03 17:45 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-03-03 17:20 . 2011-03-09 10:54 -------- d-----w- c:\program files\Rockstar Games
2011-03-03 17:19 . 2004-10-22 01:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-03-03 17:19 . 2004-10-22 01:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-03-03 17:19 . 2004-10-22 01:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-03-03 17:19 . 2004-10-22 01:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-03-03 17:19 . 2004-10-22 01:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-03-03 17:19 . 2011-03-03 17:19 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-03-03 17:19 . 2011-03-03 17:19 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-03-02 09:46 . 2011-03-02 09:46 -------- d-----w- c:\users\Leon\AppData\Roaming\Avira
2011-03-01 13:09 . 2011-03-01 13:09 -------- d-----w- c:\users\Leon\AppData\Local\K-Meleon
2011-03-01 13:09 . 2011-03-01 13:09 -------- d-----w- c:\users\Leon\AppData\Roaming\K-Meleon
2011-02-28 11:21 . 2011-03-03 11:16 -------- d-----w- c:\users\Leon\AppData\Local\LogMeIn Hamachi
2011-02-27 16:06 . 2011-02-27 16:06 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\Avira
2011-02-26 22:33 . 2011-03-05 19:34 -------- d-----w- c:\programdata\SecTaskMan
2011-02-26 22:32 . 2011-02-26 22:33 -------- d-----w- c:\program files\Security Task Manager
2011-02-25 23:04 . 2011-02-26 15:00 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-02-25 23:04 . 2011-02-26 15:00 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-02-25 23:04 . 2009-05-11 11:49 51992 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2011-02-25 23:04 . 2009-05-11 11:49 17016 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2011-02-25 23:04 . 2011-02-25 23:04 -------- d-----w- c:\programdata\Avira
2011-02-25 23:04 . 2011-02-25 23:04 -------- d-----w- c:\program files\Avira
2011-02-25 14:43 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0D9718F7-30DA-4E69-B7FC-2DF352AA7574}\mpengine.dll
2011-02-25 13:56 . 1998-06-17 18:07 57344 ----a-w- c:\windows\system32\Mfc42loc.dll
2011-02-25 13:56 . 2011-02-25 13:56 -------- d-----w- c:\program files\Bethesda Softworks
2011-02-25 13:55 . 2001-09-05 04:18 225280 ----a-w- c:\program files\Common Files\InstallShield\IScript\iscript.dll
2011-02-25 13:55 . 2001-09-05 04:14 176128 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
2011-02-25 13:55 . 2001-09-05 04:13 32768 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
2011-02-25 13:55 . 2001-09-05 04:18 77824 ----a-w- c:\program files\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
2011-02-25 13:53 . 2011-02-25 13:53 -------- d-----w- c:\program files\BestGameEver
2011-02-25 13:05 . 2011-03-08 12:47 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\Raptr
2011-02-25 13:05 . 2011-02-25 13:05 -------- d-----w- c:\program files\Raptr
2011-02-24 18:14 . 2011-02-24 18:14 -------- d-----w- C:\AeriaGames
2011-02-24 13:53 . 2011-02-24 13:53 -------- d-----w- C:\GAMIGO
2011-02-24 13:32 . 2011-02-24 18:39 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Local\PMB Files
2011-02-24 05:31 . 2010-09-14 06:07 276992 ----a-w- c:\windows\system32\wcncsvc.dll
2011-02-23 14:12 . 2011-01-07 07:31 442880 ----a-w- c:\windows\system32\XpsPrint.dll
2011-02-23 14:12 . 2011-01-07 07:31 288256 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-23 11:23 . 2011-02-23 11:23 -------- d-----w- c:\users\Gast\AppData\Local\Diagnostics
2011-02-22 20:27 . 2011-02-22 20:27 -------- d-----w- c:\users\Gast\AppData\Local\SoftGrid Client
2011-02-22 20:27 . 2011-02-22 20:29 -------- d-----w- c:\users\Gast\AppData\Roaming\SoftGrid Client
2011-02-22 19:46 . 2011-03-09 20:05 -------- d-----w- c:\users\Gast\AppData\Local\LogMeIn Hamachi
2011-02-22 19:15 . 2011-02-22 19:15 0 ----a-w- c:\windows\system32\sho91B4.tmp
2011-02-20 21:30 . 2008-11-10 10:41 32656 ----a-w- c:\windows\system32\msonpmon.dll
2011-02-20 21:30 . 2006-10-26 18:56 33104 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2011-02-20 20:52 . 2011-02-20 20:52 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-02-20 20:27 . 2011-02-20 20:27 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\DAEMON Tools Lite
2011-02-20 17:34 . 2009-12-14 11:44 39352 ----a-w- c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2011-02-20 17:34 . 2009-12-14 11:44 88632 ----a-w- c:\windows\system32\drivers\CSCrySec.sys
2011-02-20 17:34 . 2011-03-05 22:12 -------- dc----w- c:\windows\system32\DRVSTORE
2011-02-18 17:56 . 2011-03-08 12:41 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Local\LogMeIn Hamachi
2011-02-18 17:53 . 2011-02-18 17:54 -------- d-----w- c:\program files\LogMeIn Hamachi
2011-02-16 13:44 . 2011-02-16 20:20 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\DVD Flick
2011-02-16 13:42 . 2008-08-31 12:27 28672 ----a-w- c:\windows\system32\mousewheel.ocx
2011-02-16 13:42 . 2007-08-31 17:36 36864 ----a-w- c:\windows\system32\trayicon_handler.ocx
2011-02-16 13:42 . 2003-01-26 12:41 40960 ----a-w- c:\windows\system32\ssubtmr6.dll
2011-02-16 13:42 . 1998-06-23 23:00 164144 ----a-w- c:\windows\system32\comct232.ocx
2011-02-16 13:42 . 2011-02-16 13:43 -------- d-----w- c:\program files\DVD Flick
2011-02-16 13:31 . 2011-02-16 13:32 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\DivX
2011-02-15 14:57 . 2011-03-07 22:20 -------- d-----w- c:\users\KniebeugenGurkenfeld\AppData\Roaming\Skype
2011-02-14 08:26 . 2011-02-14 08:26 -------- d-----w- c:\users\Leon\AppData\Roaming\Publish Providers
2011-02-14 08:26 . 2011-02-17 10:56 -------- d-----w- c:\users\Leon\AppData\Roaming\DivX
2011-02-14 08:26 . 2011-02-14 08:26 -------- d-----w- c:\users\Leon\AppData\Roaming\Sony
2011-02-14 08:26 . 2011-02-14 08:26 -------- d-----w- c:\users\Leon\AppData\Local\Sony
2011-02-11 14:48 . 2010-10-01 14:20 307200 ----a-w- c:\windows\system32\TubeFinder.exe
2011-02-11 14:48 . 2009-06-19 18:51 84512 ----a-w- c:\windows\system32\PICCLP32.OCX
2011-02-11 14:48 . 2009-06-19 18:51 364544 ----a-w- c:\windows\system32\PropertyGrid.ocx
2011-02-11 14:48 . 2009-06-19 18:51 119568 ----a-w- c:\windows\system32\VB6FR.DLL
2011-02-11 14:48 . 2009-06-19 18:51 9728 ----a-w- c:\windows\system32\PCCLPFR.DLL
2011-02-11 14:48 . 2009-06-19 18:51 32768 ----a-w- c:\windows\system32\CMDLGFR.DLL
2011-02-11 14:48 . 2009-06-19 18:51 24576 ----a-w- c:\windows\system32\ControlSubX.ocx
2011-02-11 14:48 . 2009-06-19 18:51 141312 ----a-w- c:\windows\system32\MSCMCFR.DLL
2011-02-11 14:48 . 2011-02-11 14:48 -------- d-----w- c:\program files\Free FLV Converter
2011-02-11 05:10 . 2011-02-11 05:10 -------- d-----w- c:\program files\Vstplugins
2011-02-11 05:10 . 2011-02-11 13:57 -------- d-----w- c:\programdata\Sony
2011-02-11 05:09 . 2011-02-11 13:57 -------- d-----w- c:\program files\Sony
2011-02-11 05:06 . 2011-02-11 05:06 -------- d-----w- c:\program files\Sony Setup
2011-02-10 20:49 . 2011-02-10 20:49 -------- d-----w- c:\program files\Ask.com
2011-02-09 18:04 . 2011-02-09 18:04 -------- d-----w- c:\programdata\ALM
2011-02-09 17:40 . 2010-03-27 17:06 67032 ----a-w- c:\program files\Mozilla Firefox\plugins\npContribute.dll
2011-02-09 17:33 . 2011-02-09 17:33 -------- d-----w- c:\program files\My Company Name
2011-02-09 14:07 . 2011-01-05 03:37 2329088 ----a-w- c:\windows\system32\win32k.sys
2011-02-09 14:07 . 2010-12-18 05:29 541184 ----a-w- c:\windows\system32\kerberos.dll
2011-02-09 14:07 . 2011-01-05 05:37 428032 ----a-w- c:\windows\system32\vbscript.dll
2011-02-09 13:50 . 2011-02-11 04:44 -------- d-----w- c:\users\Mediazentrum
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-09 13:41 . 2010-06-24 10:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-02-02 16:11 . 2010-10-06 14:44 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-30 10:53 . 2011-01-30 10:52 290816 ------w- c:\windows\Setup1.exe
2011-01-30 10:53 . 2011-01-30 10:52 74752 ----a-w- c:\windows\ST6UNST.EXE
2010-12-29 12:56 . 2010-12-29 12:56 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-12-29 12:56 . 2010-12-29 12:56 110592 ----a-w- c:\windows\system32\OpenAL32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
2010-12-01 10:27 2735200 ----a-w- c:\program files\Zynga\tbZyng.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 21:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7b13ec3e-999a-4b70-b9cb-2617b8323822}"= "c:\program files\Zynga\tbZyng.dll" [2010-12-01 2735200]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{7B13EC3E-999A-4B70-B9CB-2617B8323822}"= "c:\program files\Zynga\tbZyng.dll" [2010-12-01 2735200]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
.
[HKEY_CLASSES_ROOT\clsid\{7b13ec3e-999a-4b70-b9cb-2617b8323822}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:40 120176 ----a-w- c:\program files\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-07-01 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2010-05-25 960080]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-06-22 9292392]
"SuiteTray"="c:\program files\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"mwlDaemon"="c:\program files\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
"Norton Online Backup"="c:\program files\Symantec\Norton Online Backup\NOBuClient.exe" [2010-06-01 966488]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-16 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-16 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-16 150552]
"iSyncData"="c:\program files\Acer\Android Manager\iSync.exe" [2010-01-08 407416]
"AndroidManager"="c:\program files\Acer\Android Manager\AML.exe" [2010-01-08 508280]
"iPatchData"="c:\program files\Acer\Updater\iUpdate.exe" [2010-07-21 492096]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2010-06-11 715296]
"YouCam Mirage"="c:\program files\CyberLink\YouCam\YCMMirage.exe" [2010-08-20 136488]
"YouCam Tray"="c:\program files\CyberLink\YouCam\YouCamTray.exe" [2010-08-20 162912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-29 497648]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"LogMeIn Hamachi Ui"="c:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2010-12-06 1910152]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-02-26 281768]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
.
c:\users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\
Think Green Weather.lnk - c:\program files\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe [2010-10-22 728576]
.
c:\users\KniebeugenGurkenfeld\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
Think Green Weather.lnk - c:\program files\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe [2010-10-22 728576]
.
c:\users\League of Legends\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\
Think Green Weather.lnk - c:\program files\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe [2010-10-22 728576]
.
c:\users\Leon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\users\Mediazentrum\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\
Think Green Weather.lnk - c:\program files\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe [2010-10-22 728576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2010-7-1 704032]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Think Green Weather.lnk - c:\program files\Stardock\DesktopGadgets\Think Green Weather\Think Green Weather.exe [2010-10-22 728576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-11 691696]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 18992]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 16432]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60976]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
R2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [2010-09-30 169408]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2011-02-26 339624]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-02-26 135336]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-03-08 421032]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]
R2 DsiWMIService;Dritek WMI Service;c:\program files\Launch Manager\dsiwmis.exe [2010-05-25 325200]
R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2010-06-11 735776]
R2 GREGService;GREGService;c:\program files\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-10 135664]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [2010-12-06 1238408]
R2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2010-09-06 247096]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2011-03-04 1405384]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
R2 NOBU;Norton Online Backup;c:\program files\Symantec\Norton Online Backup\NOBuAgent.exe SERVICE [x]
R2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
R2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]
R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
R3 CEDRIVER55;CEDRIVER55;c:\users\League of Legends\Desktop\Random Stuff -_-\Cheat Engine\dbk32.sys [2010-06-15 61056]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-08-20 27632]
R3 EUCR;EUCR;c:\windows\system32\DRIVERS\EUCR6SK.SYS [2010-06-17 82768]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x86.sys [2010-05-20 68208]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [2011-03-04 15232]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-12-20 38224]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-03-27 23064]
R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools Security\pctsAuxs.exe [2010-03-15 366840]
R3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-23 550760]
R3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-23 195944]
R3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-23 21864]
R3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-23 19304]
R3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]
R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 XDva289;XDva289;c:\windows\system32\XDva289.sys [x]
R3 XDva356;XDva356;c:\windows\system32\XDva356.sys [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2011-03-04 64512]
S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-11-25 239168]
S0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2010-07-16 338880]
S0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2010-07-16 656320]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - PXHELP20
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2011-03-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2011-03-04 08:20]
.
2011-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-10 09:26]
.
2011-03-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-10 09:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aod255&r=27b50910k405l04f4wwi5w4732u234
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\Mediazentrum\AppData\Roaming\Mozilla\Firefox\Profiles\sbvt0t63.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Adobe Contribute Toolbar: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9} - c:\program files\Adobe\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
HKLM-RunOnce-<NO NAME> - (no file)
AddRemove-JDownloader - c:\users\League of Legends\uninstall.exe
AddRemove-Stardock MyColors - c:\programdata\{CFA6F4AE-B6D4-4F71-BBA4-ACFE805E7214}\MyColors.exe
AddRemove-{6F7614CC-F33A-4877-8814-49856F441F3C} - c:\programdata\{CFA6F4AE-B6D4-4F71-BBA4-ACFE805E7214}\MyColors.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-03-10 18:20:56
ComboFix-quarantined-files.txt 2011-03-10 17:20
.
Vor Suchlauf: 16 Verzeichnis(se), 89.921.994.752 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 108.716.199.936 Bytes frei
.
- - End Of File - - 7CC8990EDBFF15B88B8775802EA5BD89
|
|
10.03.2011, 18:54
| #11 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. lade den CCleaner slim: Piriform - Builds falls der CCleaner bereits instaliert, überspringen. instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen. hinter, jedes von dir benötigte programm, schreibe notwendig. hinter, jedes, von dir nicht benötigte, unnötig. hinter, dir unbekannte, unbekannt. liste posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.03.2011, 19:14
| #12 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. Acer Crystal Eye webcam Liteon 05.08.2010 4.0.2.1 (nötig) Acer ePower Management Acer Incorporated 05.08.2010 5.00.3005 (unbekannt) Acer eRecovery Management Acer Incorporated 01.07.2010 4.05.3013 (unbekannt) Acer GameZone Console Oberon Media, Inc. 01.07.2010 6.1.0.9 (unbekannt) Acer Registration Acer Incorporated 1.03.3003 (unbekannt) Acer ScreenSaver Acer Incorporated 1.1.0624.2010 (unbekannt) Acer Updater Acer Incorporated 01.07.2010 1.02.3001 (unbekannt) Acer VCM Acer Incorporated 01.07.2010 4.05.3002 (unbekannt) Acrobat.com Adobe Systems Incorporated 01.07.2010 1.6.65 (unbekannt) Ad-Aware Lavasoft 05.03.2011 (unnötig) Adobe AIR Adobe Systems Inc. 30.11.2010 1.5.3.9130 Adobe Community Help Adobe Systems Incorporated 30.11.2010 3.2.1.650(nötig) Adobe Creative Suite 5 Master Collection Adobe Systems Incorporated 5.0(nötig) Adobe Flash Player 10 ActiveX Adobe Systems, Inc. 09.02.2011 10.1.52.14(nötig) Adobe Flash Player 10 ActiveX Adobe Systems Incorporated 10.1.53.64(nötig) Adobe Flash Player 10 Plugin Adobe Systems, Inc. 09.02.2011 10.1.52.14(nötig) Adobe Flash Player 10 Plugin Adobe Systems Incorporated 10.2.152.32(nötig) Adobe Media Player Adobe Systems Incorporated 05.12.2010 1.1 (nötig) Adobe Photoshop CS4 Adobe Systems Incorporated 05.12.2010 11.0 (nötig) Adobe Premiere Elements 9 Adobe Systems Incorporated 30.11.2010 9.0(unnötig) Adobe Reader 9.3.4 - Deutsch Adobe Systems Incorporated 03.10.2010 9.3.4(nötig) AGEIA PhysX v7.11.13 AGEIA Technologies, Inc. 29.12.2010 7.11.13(unbekannt) Airport Mania First Flight Oberon Media 01.07.2010 (unnötig) Akamai NetSession Interface Amazonia Oberon Media 01.07.2010 (unnötig) Ashampoo Cover Studio 1.01 ashampoo GmbH & Co. KG 28.01.2011 1.0.1(unnötig) Ashampoo Cover Studio 2.2.0 ashampoo GmbH & Co. KG 28.01.2011 2.2.0(unnötig) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver Atheros Communications Inc. 05.08.2010 (unbekannt) 1.0.0.31 Audacity 1.2.6 (nötig) Audiosurf BestGameEver 25.02.2011 1.00.0000 (unnötig) Avira AntiVir Premium Avira GmbH 10.0.0.663(unnötig) Cake Mania Oberon Media 01.07.2010 (unnötig) Camtasia Studio 7 TechSmith Corporation 02.12.2010(unnötig) 7.0.1 CCleaner Piriform 3.00(nötig) CyberLink YouCam CyberLink Corp. 30.09.2010 4.0.0820(unnötig) DAEMON Tools Toolbar DT Soft Ltd 1.1.2.0185(unnötig) DivX-Setup DivX, LLC 2.4.0.6(nötig) Dream Day First Home Oberon Media 01.07.2010 (unnötig) DVD Flick 1.3.0.7 Dennis Meuwissen 16.02.2011(unnötig) 1.3.0.7 eBay Worldwide OEM 10.09.2010 2.1.0901(unnötig) ENE USB Card Reader Driver ENE 5.89.0.70(unbekannt) eSobi v2 esobi Inc. 01.07.2010 2.0.4.000274(unbekannt) Farm Frenzy 2 Oberon Media 01.07.2010 (unnötig) Free Audio CD Burner version 1.4 DVDVideoSoft Limited. 29.11.2010 (unnötig) Free FLV Converter V 6.93.0 Koyote Soft 11.02.2011 6.93.0.0(unnötig) Free YouTube Download 2.9 DVDVideoSoft Limited. 02.12.2010 (unnötig) Free YouTube to MP3 Converter version 3.9 DVDVideoSoft Limited. 29.11.2010(unnötig) Galapago Oberon Media 01.07.2010 (unnötig) GEONExT 1.73 GEONExT Group 29.10.2010 1.73(unnötig) GIMP 2.6.10 The GIMP Team 03.10.2010 2.6.10(unnötig) Google Chrome Google Inc. 02.11.2010 9.0.597.107(nötig) Google Earth Google 10.11.2010 5.2.1.1588 (unnötig) Google Toolbar for Internet Explorer Google Inc. 05.03.2011 (unnötig) 6.6.1409.1944 Grand Fantasia Grand Theft Auto Vice City 1.00.000(unnötig) GTA San Andreas Rockstar Games 03.03.2011 1.00.00001(unnötig) Heroes of Hellas Oberon Media 01.07.2010 (unnötig) HyperCam 2 (unnötig) ICQ Toolbar ICQ 3.0.0(unnötig) ICQ7.2 ICQ 17.11.2010 7.2(unnötig) Identity Card Acer Incorporated 1.00.3003(unbekannt) ImgBurn LIGHTNING UK! 10.12.2010 2.5.3.0(nötig) Intel(R) Graphics Media Accelerator Driver Intel Corporation(unbekannt) 8.14.10.2117 Intel® Matrix Storage Manager Intel Corporation (unbekannt) Java(TM) 6 Update 22 Sun Microsystems, Inc. 29.10.2010 6.0.220(unbekannt) K-Meleon 1.5.4 de-DE (nur entfernen) K-Meleon Team 1.5.4(unnötig) Launch Manager Acer Inc. 4.0.10 (unbekannt) League of Legends Riot Games 17.11.2010 1.02.0000(unbekannt) LogMeIn Hamachi LogMeIn, Inc. 07.03.2011 2.0.3.89 (nötig) Malwarebytes' Anti-Malware Malwarebytes Corporation 09(.03.2011 (nötig) ManyCam 2.6.30 (remove only) ManyCam LLC 2.6.30 (unnötig) Merriam Websters Spell Jam Oberon Media 01.07.2010 (unnötig) Microsoft .NET Framework 4 Client Profile Microsoft Corporation 10.09.2010 4.0.30319 Microsoft .NET Framework 4 Client Profile DEU Language Pack Microsoft Corporation 10.09.2010 4.0.30319 Microsoft Office 2010 Microsoft Corporation 05.08.2010 14.0.4763.1000 Microsoft Office Enterprise 2007 Microsoft Corporation 25.02.2011 12.0.6425.1000 Microsoft Office Klick-und-Los 2010 Microsoft Corporation 01.10.2010 14.0.4763.1000 Microsoft Office Starter 2010 - Deutsch Microsoft Corporation 14.0.4763.1000 Microsoft Office Visio Professional 2007 Microsoft Corporation 10.02.2011 12.0.6425.1000 Microsoft PowerPoint Viewer Microsoft Corporation 16.12.2010 14.0.4763.1000 Microsoft Silverlight Microsoft Corporation 21.02.2011 4.0.60129.0 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Corporation 05.08.2010 3.1.0000 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 02.10.2010 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 11.02.2011 8.0.59193 Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 10.09.2010 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 01.07.2010 9.0.30729 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 11.02.2011(ALLE OBIGEN MICROSOFT TEILE UNBEKANNT) 9.0.30729.4148 mIRC mIRC Co. Ltd. 7.15(unnötig) MorphVOX Pro Screaming Bee 23.01.2011 4.2.10(unnötig) Morrowind (unnötig) Mozilla Firefox (3.6.15) (nötig)Mozilla 3.6.15 (de) MyWinLocker Suite(unnötig) Egis Technology Inc. 01.07.2010 3.1.212.0 Norton Online backup (unnötig) Open AL (unbekannt) Paint.NET v3.5.6(unnötig) dotPDN LLC 19.11.2010 3.56.0 Pando Media Booster(unbekannt) Pando Networks Inc. 2.3.4.8 Poker Pop (unnötig)(unnötig)Oberon Media 01.07.2010 Puzzle Express Oberon Media 20.09.2010 Raptr (unnötig) Realtek High Definition Audio Driver Realtek Semiconductor Corp.(unbekannt) 01.07.2010 6.0.1.6141 Sandboxie 3.50 (unnötig) ScummVM 1.2.1 (nötig)06.02.2011 Security Task Manager 1.8c Neuber Software (unnötig) 1.8c Skype™ 5.0 Skype Technologies S.A. 05.03.2011(unnötig) 5.0.152 SmartSound Quicktracks for Premiere Elements 9.0(unnötig) SmartSound Software Inc 30.11.2010 3.12.3090 Social Point Toolbar Ask.com 10.02.2011 (unnötig) 1.9.1.0 Solitaire for Dummies Oberon Media 09.03.2011(unnötig) Spin & Win Oberon Media 01.07.2010 (unnötig) Spyware Doctor 8.0 PC Tools 27.12.2010(unnötig) 8.0 Star Defender 4 Oberon Media 20.09.2010 (unnötig) Stardock MyColors (unnötig) Steam Valve Corporation 29.12.2010 (unnötig) 1.0.0.0 Synaptics Pointing Device Driver Synaptics Incorporated (unbekannt) 15.0.7.0 Turbo Pizza Oberon Media 20.09.2010 (unnötig) Uninstall 1.0.0.1 02.12.2010 (unbekannt) Unreal Tournament 3: Black Edition(unnötig) Epic Games Vegas Movie Studio Platinum 9.0 Sony(unnötig) 11.02.2011 9.0.85 Vegas Pro 9.0 Sony 11.02.2011(unnötig) 9.0.1147 Visual Basic 6.0 Runtime&Steuerelemente (unbekannt) VLC media player 1.1.4 VideoLAN(unnötig) 1.1.4 Welcome Center Acer Incorporated(unnötig) 1.02.3002 Windows Live Essentials Microsoft Corporation 21.11.2010 (unbekannt) 15.4.3502.0922 Windows Live Sync Microsoft Corporation 05.08.2010 (unbekannt) 14.0.8089.726 WinRAR (nötig) Zuma’s Revenge Oberon Media 20.09.2010 (unnötig) Zynga Toolbar Zynga 5.7.4.0(unnötig) |
|
10.03.2011, 19:44
| #13 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. deinstaliere: Acer ePower Acer GameZone Acer ScreenSaver Acrobat.com Ad-Aware Adobe AIR steht nichts dazu, falls unnötig weg. Adobe Premiere Elements Adobe Reader 9.3.4 Adobe - Adobe Reader herunterladen - Alle Versionen lade die neueste version. bitte ohne mcafee virus scan! öffne den adobe reader, bearbeiten, voreinstellungen, javascript, dort den haken raus, internet, ebenfalls alle haken raus. so werden keine pdfs mehr automatisch geladen und es kann dir kein schadcode mehr auf diese weise untergeschoben werden. unter allgemein, nur zertifizierte zusatzmodule verwenden anhaken. unter update, auf instalieren stellen. klicke übernehmen /ok deinstaliere. Airport Mania Amazonia Ashampoo beide. Audiosurf Cake Mania Camtasia Studio CyberLink DAEMON Tools Toolbar Dream Day First DVD Flick eBay Worldwide eSobi Farm Frenzy Free Audio CD Burner Free FLV Converter Free YouTube beide. Galapago GEONExT GIMP Google Earth Google Toolbar for Internet Explorer Grand Fantasia nicht beschrifftet, weg falls unnötig Grand Theft Auto Vice GTA San Andreas Heroes of Hellas HyperCam ICQ Toolbar ICQ7.2 Java(TM) 6 Update 22 Java SE Downloads klicke auf download jre deinstaliere: K-Meleon Launch Manager League of Legends ManyCam Merriam Microsoft Silverlight Microsoft SQL mIRC MorphVOX Morrowind Norton Online backup Paint Poker Pop Puzzle Express ebenfalls falls unnötig weg. Raptr Security Task Manager Social Point Toolbar Solitaire Spin & Win Star Defender Spyware Doctor Stardock Steam Turbo Pizza Unreal Tournament Vegas beide Welcome Center Windows Live beide Zuma’s Zynga Toolbar starte nach den deinstalationen neu. bereinige mit dem CCleaner dateien und die registry. starte dann noch mal neu und prüfe welche probleme noch bestehen bzw ei der pc läuft.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
10.03.2011, 20:04
| #14 |
| | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. windows installer problem und chrome problem bestehen immernoch. |
|
10.03.2011, 20:29
| #15 |
| /// Malware-holic | Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. du schriebst ja es öffnen sich irgendwleche sachen, was genau meinst du damit? werbung oder was?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Computer verhält sich weiterhin komisch,nach bereinigung mit Ad-Aware. |
| ad-aware, adaware, anfänger, bereinigt, compu, computer, dauernd, dienst, hoffe, installer, komisch, komplett, langsam, logfile, probleme, sache, sachen, scan, spenden, super, viren, windows, windows installer, würde, öffnen, öffnet |
Linear-Darstellung
