| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Habe seit gestern den Virus Kazy.meml.1Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.04.2011, 08:34
| #1 |
 |  Habe seit gestern den Virus Kazy.meml.1 Seit gestern bin ich von dem oben genanntem Trojaner betroffen es kommen immer meldungen Kritischer festplattenfehler desktop ist schwarz nur papierkorb zu sehen schnellstart usw.. alles leer habe ein wenig im forum geschaut und schonmal die logfiles mit OTL gemacht nutze den pc im mom im abgesicherten Modus. muß aber gleich hinzufügen das ich mich nicht toll mit computern auskenne und manche dinge mir wie einem anfänger erklärt werden müssen. ich bin für jede hilfe dankbar. servus webtroll!OTL Logfile: Code:
ATTFilter OTL logfile created on: 22.04.2011 09:26:21 - Run 2 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\Biundo\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 79,00% Memory free 5,00 Gb Paging File | 4,00 Gb Available in Paging File | 87,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 29,30 Gb Total Space | 8,70 Gb Free Space | 29,69% Space Free | Partition Type: NTFS Drive E: | 98,69 Gb Total Space | 97,17 Gb Free Space | 98,47% Space Free | Partition Type: NTFS Drive F: | 126,96 Gb Total Space | 126,25 Gb Free Space | 99,45% Space Free | Partition Type: NTFS Drive G: | 210,81 Gb Total Space | 180,84 Gb Free Space | 85,78% Space Free | Partition Type: NTFS Computer Name: PRIVAT | User Name: Biundo | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\Biundo\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe (WinTrust) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - G:\COD4-2\Steam.exe (Valve Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) PRC - C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero AG) PRC - C:\Programme\GIGABYTE\EnergySaver\GSvr.exe () PRC - C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\WINDOWS\system32\attrib.exe (Microsoft Corporation) PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.) PRC - C:\Garmin\gStart.exe (GARMIN Corp.) PRC - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe () ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\Biundo\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (Nero BackItUp Scheduler 4.0) -- C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe (Nero AG) SRV - (GEST Service) -- C:\Programme\GIGABYTE\EnergySaver\GSvr.exe () SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (BlueSoleil Hid Service) -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe () ========== Driver Services (SafeList) ========== DRV - (gdrv) -- C:\WINDOWS\gdrv.sys (Windows (R) 2000 DDK provider) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (WmXlCore) -- C:\WINDOWS\system32\drivers\WmXlCore.sys (Logitech Inc.) DRV - (WmVirHid) -- C:\WINDOWS\system32\drivers\WmVirHid.sys (Logitech Inc.) DRV - (WmBEnum) -- C:\WINDOWS\system32\drivers\WmBEnum.sys (Logitech Inc.) DRV - (WmFilter) -- C:\WINDOWS\system32\drivers\WmFilter.sys (Logitech Inc.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\ACEDRV11.sys (Protect Software GmbH) DRV - (yukonwxp) -- C:\WINDOWS\system32\drivers\yk51x86.sys (Marvell) DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfvfs02.sys (Protection Technology (StarForce)) DRV - (WINFLASH) -- C:\Programme\U-ABIT\FlashMenu\WINFLASH.SYS () DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology) DRV - (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a) -- C:\WINDOWS\System32\drivers\sfdrv01a.sys (Protection Technology (StarForce)) DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology (StarForce)) DRV - (Memctl) -- C:\Programme\U-ABIT\FlashMenu\MEMCTL.SYS () DRV - (ABIT-IO) -- C:\Programme\U-ABIT\abitEQ\ABIT-IO.sys () DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology) DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation) DRV - (BTHidEnum) -- C:\WINDOWS\system32\drivers\vbtenum.sys () DRV - (BTNetFilter) -- C:\WINDOWS\system32\drivers\BTNetFilter.sys () DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation) DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation) DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation) DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation) DRV - (BT) -- C:\WINDOWS\system32\drivers\BtNetDrv.sys (IVT Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.biundo-online.de/ IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKCU\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - C:\WINDOWS\system32\dvmurl.dll (DeviceVM Inc.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Web Search..." FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.biundo-online.de" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..keyword.URL: "hxxp://vshare.toolbarhome.com/search.aspx?srch=ku&q=" FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\html5video [2011.03.05 18:27:40 | 000,000,000 | -H-D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Programme\DivX\DivX Plus Web Player\firefox\wpa [2011.03.05 18:27:40 | 000,000,000 | -H-D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.03.25 16:39:47 | 000,000,000 | -H-D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.03.25 16:39:47 | 000,000,000 | -H-D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011.04.07 18:46:24 | 000,000,000 | -H-D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.9\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins [2011.03.05 18:27:39 | 000,000,000 | -H-D | M] [2010.12.16 19:17:00 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Extensions [2010.12.16 19:17:00 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.04.20 16:59:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions [2011.01.15 16:31:12 | 000,000,000 | -H-D | M] ("Garmin Communicator") -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2010.04.27 10:02:07 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.02.19 23:09:41 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.04.01 06:34:53 | 000,000,000 | -H-D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2010.10.30 15:40:19 | 000,000,000 | -H-D | M] (vShare Plugin) -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\extensions\vshare@toolbar [2010.10.30 15:40:32 | 000,001,583 | -H-- | M] () -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Mozilla\Firefox\Profiles\axo1vl5o.default\searchplugins\web-search.xml [2011.04.20 16:59:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.09.01 20:21:24 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2011.01.11 13:59:01 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.11 17:23:04 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.03.05 18:27:40 | 000,000,000 | -H-D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO [2011.03.05 18:27:40 | 000,000,000 | -H-D | M] (DivX HiQ) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA [2009.04.07 09:17:53 | 000,000,000 | -H-D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.02.02 22:40:24 | 000,472,808 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.04.01 18:54:38 | 000,001,392 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.04.01 18:54:38 | 000,002,344 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2010.04.01 18:54:38 | 000,006,805 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.04.01 18:54:38 | 000,001,178 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.04.01 18:54:38 | 000,001,105 | -H-- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2001.08.18 14:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\alcwzrd.exe (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ControlCenter3] C:\Programme\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [GEST] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SSBkgdUpdate] C:\Programme\Gemeinsame Dateien\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe (Nuance Communications, Inc.) O4 - HKLM..\Run: [Start WingMan Profiler] C:\Programme\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [ABIT uGuruIII] C:\Programme\U-ABIT\abitEQ\abiteq.exe (Universal ABIT Corporation) O4 - HKCU..\Run: [gStart] C:\Garmin\gStart.exe (GARMIN Corp.) O4 - HKCU..\Run: [ICQ] File not found O4 - HKCU..\Run: [Steam] G:\COD4-2\Steam.exe (Valve Corporation) O4 - HKCU..\Run: [uvEWQXCeAJwf] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe (WinTrust) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BlueSoleil.lnk = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe (IVT Corporation) O4 - Startup: C:\Dokumente und Einstellungen\Biundo\Startmenü\Programme\Autostart\BUFFALO NAS Navigator.lnk = C:\Programme\BUFFALO\NASNAVI\NasNavi.exe (BUFFALO INC.) O4 - Startup: C:\Dokumente und Einstellungen\Biundo\Startmenü\Programme\Autostart\Xfire.lnk = C:\Programme\Xfire\xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: TOPTIP Web Editor - {2A465936-E5F0-11D2-91B5-00104B9C4765} - File not found O9 - Extra 'Tools' menuitem : TOPTIP Web Editor - {2A465936-E5F0-11D2-91B5-00104B9C4765} - File not found O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - File not found O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ICQ6.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\ICQ6.5\ICQ.exe (ICQ, LLC.) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208158008327 (WUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Biundo\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Biundo\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008.04.12 13:51:37 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.04.22 09:27:00 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Biundo\Recent [2011.04.22 09:13:37 | 000,000,000 | -H-D | C] -- C:\_OTL [2011.04.22 09:13:22 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Biundo\Desktop\OTL.exe [2011.04.21 19:35:28 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Biundo\Eigene Dateien\OTL.exe [2011.04.21 19:06:13 | 000,000,000 | -H-D | C] -- C:\WINDOWS\CSC [2011.04.21 17:27:15 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Biundo\Startmenü\Programme\Windows Recovery [2011.04.21 16:57:53 | 000,569,344 | -H-- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe [2011.04.14 03:05:47 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2011.04.10 15:58:34 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\SimBin [2011.04.09 15:16:07 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Biundo\Lokale Einstellungen\Anwendungsdaten\Logitech [2011.04.09 15:15:15 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Logitech [2011.04.09 15:14:38 | 000,000,000 | -H-D | C] -- C:\Programme\Gemeinsame Dateien\Logitech [2011.04.09 15:14:15 | 000,000,000 | -H-D | C] -- C:\Programme\Logitech ========== Files - Modified Within 30 Days ========== [2011.04.22 09:26:00 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Biundo\Desktop\OTL.exe [2011.04.22 09:22:04 | 000,001,044 | -H-- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job [2011.04.22 09:21:57 | 000,013,046 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.04.22 09:21:54 | 000,016,608 | -H-- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys [2011.04.22 09:21:54 | 000,001,084 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.04.22 09:21:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.04.22 09:02:02 | 000,001,088 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2011.04.21 19:35:31 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Biundo\Eigene Dateien\OTL.exe [2011.04.21 17:27:03 | 000,000,336 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18014004 [2011.04.21 16:57:53 | 000,569,344 | -H-- | M] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe [2011.04.14 03:24:02 | 000,149,992 | -H-- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.04.14 03:07:27 | 000,001,374 | -H-- | M] () -- C:\WINDOWS\imsins.BAK [2011.04.14 03:06:34 | 000,448,800 | -H-- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.04.14 03:06:34 | 000,432,492 | -H-- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.04.14 03:06:34 | 000,067,448 | -H-- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.04.14 03:06:33 | 000,080,108 | -H-- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.04.10 09:49:55 | 000,004,096 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\00000316.LCS [2011.04.08 13:28:58 | 000,041,872 | -H-- | M] () -- C:\WINDOWS\System32\xfcodec.dll [2011.04.07 18:32:08 | 000,516,136 | -H-- | M] () -- C:\Dokumente und Einstellungen\Biundo\Eigene Dateien\CCI07042011_00001.jpg ========== Files Created - No Company Name ========== [2011.04.21 17:27:03 | 000,000,336 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18014004 [2011.04.08 13:28:58 | 000,041,872 | -H-- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2011.04.07 18:36:46 | 000,516,136 | -H-- | C] () -- C:\Dokumente und Einstellungen\Biundo\Eigene Dateien\CCI07042011_00001.jpg [2011.03.11 22:23:07 | 000,000,332 | -H-- | C] () -- C:\WINDOWS\desctemp.dat [2011.02.19 15:42:59 | 000,000,032 | -H-- | C] () -- C:\WINDOWS\CD_Start.INI [2010.10.02 17:51:24 | 000,000,170 | -H-- | C] () -- C:\WINDOWS\Lilli.ini [2010.10.02 17:51:24 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\Lflor.ini [2010.10.02 17:51:24 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\Lado.ini [2010.04.11 21:04:27 | 000,000,172 | -H-- | C] () -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\default.rss [2010.01.22 22:06:31 | 000,116,224 | -H-- | C] () -- C:\WINDOWS\System32\redmonnt.dll [2010.01.22 22:06:31 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\unredmon.exe [2009.12.02 12:42:02 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat [2009.09.30 20:13:17 | 000,013,304 | -H-- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2009.09.30 20:13:17 | 000,012,500 | -H-- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2009.05.29 22:24:27 | 000,000,664 | -H-- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2009.05.29 22:24:25 | 000,000,552 | -H-- | C] () -- C:\WINDOWS\System32\d3d8caps.dat [2009.04.02 14:16:09 | 000,000,170 | -H-- | C] () -- C:\WINDOWS\wcx_ftp.ini [2009.04.02 14:14:14 | 000,003,346 | -H-- | C] () -- C:\WINDOWS\wincmd.ini [2009.02.18 23:04:42 | 000,025,088 | -H-- | C] () -- C:\Dokumente und Einstellungen\Biundo\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.01.29 21:08:56 | 000,010,848 | -H-- | C] () -- C:\WINDOWS\System32\drivers\WinFlash.sys [2009.01.29 20:40:25 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI [2008.11.03 19:36:33 | 000,000,069 | -H-- | C] () -- C:\WINDOWS\NeroDigital.ini [2008.11.03 19:22:51 | 000,004,767 | -H-- | C] () -- C:\WINDOWS\Irremote.ini [2008.10.21 15:39:36 | 000,000,432 | -H-- | C] () -- C:\WINDOWS\BRWMARK.INI [2008.10.21 15:39:23 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\Brpfx04a.ini [2008.10.21 15:39:23 | 000,000,093 | -H-- | C] () -- C:\WINDOWS\brpcfx.ini [2008.10.21 15:39:23 | 000,000,065 | -H-- | C] () -- C:\WINDOWS\System32\bd7440n.dat [2008.10.21 15:38:23 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\BRTCPCON.DLL [2008.10.21 15:38:23 | 000,000,114 | -H-- | C] () -- C:\WINDOWS\System32\BRLMW03A.INI [2008.10.21 15:38:21 | 000,000,091 | -H-- | C] () -- C:\WINDOWS\Brfaxrx.ini [2008.10.21 15:38:21 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\brdfxspd.dat [2008.10.21 15:38:20 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll [2008.10.21 14:45:05 | 000,031,664 | -H-- | C] () -- C:\WINDOWS\maxlink.ini [2008.04.30 11:12:14 | 000,022,328 | -H-- | C] () -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\PnkBstrK.sys [2008.04.30 11:11:45 | 000,000,263 | -H-- | C] () -- C:\WINDOWS\game.ini [2008.04.14 15:16:01 | 000,138,608 | -H-- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2008.04.14 15:15:55 | 000,189,800 | -H-- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe [2008.04.14 15:15:48 | 000,075,064 | -H-- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe [2008.04.14 13:50:34 | 000,000,303 | -H-- | C] () -- C:\WINDOWS\CoDUO.INI [2008.04.14 13:16:07 | 000,000,714 | -H-- | C] () -- C:\WINDOWS\CoD.INI [2008.04.14 09:49:14 | 000,049,152 | -H-- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008.04.14 09:36:06 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat [2008.04.14 09:22:22 | 000,000,305 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html [2008.04.14 09:08:25 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008.04.12 14:38:34 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI [2008.04.12 14:37:49 | 000,149,992 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008.04.12 13:52:40 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008.04.12 13:49:50 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2007.11.07 03:30:00 | 001,703,936 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2007.11.07 03:30:00 | 001,626,112 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe [2007.11.07 03:30:00 | 001,474,560 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll [2007.11.07 03:30:00 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2007.11.07 03:30:00 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2007.11.07 03:30:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll [2007.11.07 03:30:00 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2007.11.07 03:30:00 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe [2007.11.07 03:30:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2007.10.20 02:56:16 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2007.09.15 15:00:40 | 000,008,605 | -H-- | C] () -- C:\WINDOWS\UN060501.INI [2001.08.18 14:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin [2001.08.18 14:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat [2001.08.18 14:00:00 | 000,448,800 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat [2001.08.18 14:00:00 | 000,432,492 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001.08.18 14:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001.08.18 14:00:00 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat [2001.08.18 14:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat [2001.08.18 14:00:00 | 000,080,108 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat [2001.08.18 14:00:00 | 000,067,448 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001.08.18 14:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin [2001.08.18 14:00:00 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat [2001.08.18 14:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001.08.18 14:00:00 | 000,004,461 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat [2001.08.18 14:00:00 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin [2001.08.18 14:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat ========== LOP Check ========== [2009.09.30 20:17:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth [2010.04.11 10:30:18 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\elsterformular [2010.01.22 22:06:30 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF [2008.06.14 20:32:13 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN [2009.08.31 21:24:43 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ICQ [2011.01.14 16:47:44 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\KinderDuden [2008.10.21 14:45:05 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ScanSoft [2008.07.10 20:31:00 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VRCGameUpdater [2008.06.14 20:50:14 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ZoneFiveSoftware [2009.02.28 23:26:01 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Bierbuden Autoupdate [2011.03.05 18:28:22 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\DDMSettings [2011.02.19 23:09:41 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\DVDVideoSoftIEHelpers [2010.04.11 10:30:47 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\elsterformular [2008.06.14 20:32:13 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\GARMIN [2011.03.07 19:43:25 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\GetRightToGo [2008.10.01 09:13:19 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\ICQ [2008.10.01 09:08:27 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\ICQLite [2009.11.04 16:44:12 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\ProtectDisc [2011.03.09 20:42:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Rovio [2009.09.11 13:35:18 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\ScanSoft [2010.12.16 19:16:50 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\Thunderbird [2008.04.14 09:48:02 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Biundo\Anwendungsdaten\TMP ========== Purity Check ========== < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 22.04.2011 09:35:28 - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\Biundo\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 80,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,30 Gb Total Space | 8,70 Gb Free Space | 29,68% Space Free | Partition Type: NTFS
Drive E: | 98,69 Gb Total Space | 97,17 Gb Free Space | 98,47% Space Free | Partition Type: NTFS
Drive F: | 126,96 Gb Total Space | 126,25 Gb Free Space | 99,45% Space Free | Partition Type: NTFS
Drive G: | 210,81 Gb Total Space | 180,84 Gb Free Space | 85,78% Space Free | Partition Type: NTFS
Computer Name: PRIVAT | User Name: Biundo | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "E:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "E:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Xfire\xfire.exe" = C:\Programme\Xfire\xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
"E:\Download\ICQLite\ICQLite.exe" = E:\Download\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite
"C:\ICQ6\ICQ.exe" = C:\ICQ6\ICQ.exe:*:Enabled:ICQ6
"G:\COD4\iw3mp.exe" = G:\COD4\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- ()
"\\LS-LGL196\share\Enzo\Homepage\Toptip\toptip\toptip.exe" = \\LS-LGL196\share\Enzo\Homepage\Toptip\toptip\toptip.exe:*:Enabled:TopTip.Net-Editor 1.01
"E:\totalcmd\TOTALCMD.EXE" = E:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows -- (C. Ghisler & Co.)
"G:\COD2\CoD2MP_s.exe" = G:\COD2\CoD2MP_s.exe:*:Enabled:CoD2MP_s -- ()
"G:\COD1\CoDMP.exe" = G:\COD1\CoDMP.exe:*:Enabled:CoDMP -- ()
"G:\TrackMania Nations ESWC\TmNationsESWC.exe" = G:\TrackMania Nations ESWC\TmNationsESWC.exe:*:Enabled:TmNationsESWC -- ()
"G:\TrackMania Sunrise\TmSunrise.exe" = G:\TrackMania Sunrise\TmSunrise.exe:*:Enabled:TmSunrise -- ()
"C:\ICQ6.5\ICQ.exe" = C:\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\Programme\U-ABIT\abitEQ\abiteq.exe" = C:\Programme\U-ABIT\abitEQ\abiteq.exe:*:Enabled:abitEQ -- (Universal ABIT Corporation)
"C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe" = C:\Programme\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- (IVT Corporation)
"G:\COD4-2\Steam.exe" = G:\COD4-2\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"G:\COD4-2\SteamApps\common\call of duty modern warfare 2\iw4sp.exe" = G:\COD4-2\SteamApps\common\call of duty modern warfare 2\iw4sp.exe:*:Enabled:Call of Duty: Modern Warfare 2 -- ()
"G:\COD4-2\SteamApps\common\call of duty modern warfare 2\iw4mp.exe" = G:\COD4-2\SteamApps\common\call of duty modern warfare 2\iw4mp.exe:*:Enabled:Call of Duty: Modern Warfare 2 - Multiplayer -- ()
"D:\DVD-START.EXE" = D:\DVD-START.EXE:*:Enabled:Schnellstart-DVD
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{047E5F60-5357-43FB-A080-1912EB0132A4}" = FlashMenu
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0711500B-9912-4D60-9A49-C577B4503D42}" = Nero Recode Help
"{07FF7593-9DEA-40B5-9F87-F557E65BBF60}" = Nero Recode
"{0be4ee25-c13c-417c-9483-1121707aea23}" = Nero 9
"{11A84FCA-C3C7-4AFD-A797-111DB8569DBC}" = Nero BurningROM
"{1B040683-C390-4711-ABC7-DA8D85E470E7}" = NeroBurningROM
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 24
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{2D3455A8-3B15-41A8-99F8-0D4215746463}" = Nero StartSmart
"{3097B151-1F61-4211-A4CC-D70127B226AE}" = SoundTrax
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{33BABF46-8430-47A8-A98C-88B1E9DA5DE6}" = Garmin Training Center 3.4.1
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{3F30CC51-0788-487B-AA83-7214A239C0C0}" = Nero Disc Copy Gadget Help
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D42353B-533F-4306-AD0B-7FEF292ADE04}" = Nero CoverDesigner Help
"{4E0DAB77-8F7B-4DDC-88DB-7B214C8E6C2C}" = KYOSHO VIRTUAL RC RACING
"{548F99E0-14CC-4D53-A7D6-4A62A5F2C748}" = Nero PhotoSnap
"{56BE5CC9-95E6-4128-ABEA-968414CA9C80}" = DolbyFiles
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5A62A775-A29A-4CE1-BBC2-4A9CD0B211EF}" = Nero Live Help
"{5AE12194-3EAA-40DF-B2BF-FE1D6B78BBF4}" = Nero Vision
"{5C2E8A0F-80E2-4C68-8CC0-D8D16E7196BF}" = Nero RescueAgent Help
"{5C42EAB8-54F9-423A-948C-1CBEF25F8DB4}" = Nero PhotoSnap Help
"{5C9BB0B3-E830-4814-BBA4-D93535E1C7B9}" = Nero Live
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{60D32CDC-E3BE-4578-BA10-29322307CDDC}" = Logitech Gaming Software 5.10
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{64F974D4-135B-4BB9-9791-CD94AEBDAE5C}" = WGW Deutsch 1
"{75321954-2589-11DC-DDCC-E98356D81493}" = Nero DriveSpeed
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7A8FF745-BBC5-482B-88E4-18D3178249A9}" = ScanSoft PaperPort 11
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7ED169D4-5053-4166-93DF-53B12AE6C539}" = Energy Saver Advance B8.0711.1
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"{8C654BD0-1949-43DE-84F2-EC2A1ABB0CB4}" = Nero ShowTime
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"{943CC0C0-2253-4FE0-9493-DD386F7857FD}" = Nero Express
"{948FFAAE-C57F-447B-9B07-3721E950BFDC}" = Nero ShowTime
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A875B56-A35C-46BA-A3AA-DF8D03EE9F2F}" = Nero ControlCenter
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A3DB6885-DDFA-442A-A2C2-EC1842CA4953}" = abitEQ V1.1.1.6
"{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"{A73BEC3C-40A0-480E-87EF-EFCD33629088}" = NeroExpress
"{A8399F58-234A-48C6-BA55-30C15738BF3C}" = Nero CoverDesigner
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAA12554-2589-11DC-92EF-E98356D81493}" = Nero InfoTool
"{AABBCC54-D8B1-11DC-92EF-E98356D81493}" = Nero DiscSpeed
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.5 - Deutsch
"{AC76BA86-7AD7-1031-7B44-A81300000003}_814" = KB408682
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{B1102A25-3AA3-446B-AA0F-A699B07A02FD}" = Garmin USB Drivers
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B2C12C8D-65DC-40BD-B309-5ADB0C6C8D8F}" = Nero WaveEditor
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B96C2601-52F5-4D5D-816A-63469EA311EF}" = "Nero SoundTrax Help
"{B9F499B8-D1F0-42FC-84BE-CC552123CCCB}" = BlueSoleil
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BCD82AB5-670D-4242-90FA-1F97103C16CD}" = Movie Templates - Starter Kit
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax
"{C99C89A3-119A-45E6-B26E-DD5643CAA0C5}" = Menu Templates - Starter Kit
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB09F557-4821-46D0-BF86-8D1389AA6BC7}" = Tabellenbuch Metall digital
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D560A981-FEB3-42F0-A61A-13E9528E0C51}_is1" = GTR 2 1.0.0.0
"{D7C206B6-1A63-4389-A8B1-8F607D0BFF1F}" = Nero StartSmart Help
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live
"{E0783143-EAE2-4047-A8D6-E155523C594C}" = Garmin WebUpdater
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E4A8DD87-A746-4443-BF25-CAF99CED6767}" = Nero Disc Copy Gadget
"{E86156E5-9859-440D-8876-26CED1349802}" = Nero WaveEditor Help
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{E8AEA11B-E60A-455E-B008-E4E763604612}" = Browser Configuration Utility
"{EA9FFE54-D8B1-11DC-92EF-E98356D81493}" = Nero BurnRights
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F53F6769-AC46-49E3-ABE3-2C8AFD39D0DD}" = Nero Vision
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"45A7283175C62FAC673F913C1F532C5361F97841" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (03/08/2007 2.2.1.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"B991B020-2968-11D8-AF23-444553540000_is1" = FreeMind
"Baja 1000" = World Championship Offroad Racing
"Call of Duty" = Call of Duty
"ClearProg" = ClearProg 1.5.0 Final
"DivX Setup.divx.com" = DivX-Setup
"ElsterFormular 11.3.0.4235" = ElsterFormular
"FLV Player" = FLV Player 2.0 (build 25)
"Formelsammlung Chemie_is1" = Formelsammlung Chemie
"Formelsammlung Mathematik_is1" = Formelsammlung Mathematik
"Formelsammlung Physik_is1" = Formelsammlung Physik
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.33
"FreePDF_XP" = FreePDF (Remove only)
"Google Updater" = Google Updater
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
"InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
"InstallShield_{A662E280-64A8-4CF5-8407-13D0808602B3}" = Call of Duty - United Offensive
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"IrfanView" = IrfanView (remove only)
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.16)" = Mozilla Firefox (3.6.16)
"Mozilla Thunderbird (3.1.9)" = Mozilla Thunderbird (3.1.9)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"PokerStars" = PokerStars
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"TmNations_is1" = TrackMania Nations ESWC 1.7.9
"TmSunrise_is1" = TrackMania Sunrise Extreme 1.5.1
"Totalcmd" = Total Commander (Remove or Repair)
"UN060501" = BUFFALO NAS Navigator
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.7
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"wxPython2.8-unicode-py25_is1" = wxPython 2.8.4.0 (unicode) for Python 2.5
"Xfire" = Xfire (remove only)
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 12.04.2011 16:09:53 | Computer Name = PRIVAT | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung nerostartsmart.exe, Version 9.0.10.100,
fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x000010e6.
[ System Events ]
Error - 22.04.2011 03:13:38 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Nero BackItUp Scheduler 4.0" wurde unerwartet beendet.
Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 500 Millisekunden
durchgeführt: Starten Sie den Dienst neu..
Error - 22.04.2011 03:13:38 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 22.04.2011 03:13:38 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7034
Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 22.04.2011 03:13:38 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrA" wurde unerwartet beendet. Dies ist bereits 1 Mal
passiert.
Error - 22.04.2011 03:13:38 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7034
Description = Dienst "PnkBstrB" wurde unerwartet beendet. Dies ist bereits 1 Mal
passiert.
Error - 22.04.2011 03:15:28 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst NVSvc.
Error - 22.04.2011 03:23:14 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst NVSvc.
Error - 22.04.2011 03:23:14 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
Error - 22.04.2011 03:23:14 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
nicht gestartet: %%1053
Error - 22.04.2011 03:23:14 | Computer Name = PRIVAT | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst SharedAccess.
< End of report >
Geändert von webtroll (22.04.2011 um 08:41 Uhr) |
|
22.04.2011, 10:38
| #2 |
| /// Malware-holic   | Habe seit gestern den Virus Kazy.meml.1 • Starte bitte die OTL.exe
__________________• Kopiere nun das Folgende in die Textbox. :OTL PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe (WinTrust) O4 - HKCU..\Run: [uvEWQXCeAJwf] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe (WinTrust) :Files C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe C:\Dokumente und Einstellungen\Biundo\Startmenü\Programme\Windows Recovery C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18014004 :Commands [purity] [EMPTYFLASH] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. öffne arbeitsplatz, öffne C: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. das archiv nach anleitung hochladen: http://www.trojaner-board.de/54791-a...ner-board.html
__________________ |
|
22.04.2011, 11:12
| #3 |
| | Habe seit gestern den Virus Kazy.meml.1 hallo!
__________________hier nun das textdokument von OTL: All processes killed ========== OTL ========== No active process named uvEWQXCeAJwf.exe was found! Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uvEWQXCeAJwf not found. File C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe not found. ========== FILES ========== File\Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\uvEWQXCeAJwf.exe not found. C:\Dokumente und Einstellungen\Biundo\Startmenü\Programme\Windows Recovery folder moved successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\18014004 moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Biundo ->Flash cache emptied: 456 bytes User: Default User ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Biundo ->Temp folder emptied: 1048596 bytes ->Temporary Internet Files folder emptied: 45286239 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 37288860 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16895 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 80,00 mb OTL by OldTimer - Version 3.2.22.3 log created on 04222011_115751 Files\Folders moved on Reboot... Registry entries deleted on Reboot... ich kann den ordner_OTL unter C: nicht finden. es werden keine ordner unter c: angezeigt. was kann ich da machen? danke für deine hilfe. |
|
22.04.2011, 11:34
| #4 |
| /// Malware-holic | Habe seit gestern den Virus Kazy.meml.1 hi, den ordner brauch ich doch nicht mehr, danke. 1. lade unhide: Malwarebytes instalieren, öffnen, registerkarte aktualisierung, programm updaten. schalte alle laufenden programme ab, trenne die internetverbindung. registerkarte scanner, komplett scan, funde entfernen, log posten.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
22.04.2011, 19:36
| #5 |
| | Habe seit gestern den Virus Kazy.meml.1 hier das log von malwarebytes: Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6420 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 22.04.2011 20:32:48 mbam-log-2011-04-22 (20-32-48).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|F:\|G:\|) Durchsuchte Objekte: 219459 Laufzeit: 29 Minute(n), 18 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) scheint wieder alles da zu sein. aber antivir findet jetzt andauernd andere viren. was kann man da tun? ist antivir überhaupt gut oder sollte ich mir ein anderes virenprogramm zulegen? |
|
22.04.2011, 19:38
| #6 |
| /// Malware-holic | Habe seit gestern den Virus Kazy.meml.1 was heißt andere, sitze ich vor dem pc oder du... öffne avira, ereignisse fundmeldungen posten
__________________ --> Habe seit gestern den Virus Kazy.meml.1 |
|
| Themen zu Habe seit gestern den Virus Kazy.meml.1 |
| 0x00000001, 32 bit, adobe, antivir, avgntflt.sys, avira, bho, buffalo, call of duty, computer, computern, converter, desktop, disabletaskmgr, einstellungen, error, fehler, festplatte, firefox, format, google, helper, kritischer festplattenfehler, location, microsoft office word, mozilla, mozilla thunderbird, mp3, ntdll.dll, object, office 2007, oldtimer, plug-in, realtek, registry, scan, sched.exe, searchplugins, security update, shell32.dll, software, total commander, trojaner, virus, windows internet |
Linear-Darstellung
