| |
| |||||||
Log-Analyse und Auswertung: Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirmWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
12.05.2011, 00:40
| #1 |
| |  Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm Hallo, wie ich über die Suchfunktion schon mitbekommen habe bin ich nicht der einzige der dieses Problem hat. Naja das gibt wenigstens etwas Hoffnung. Also die Geschichte begann so: von einer Sekunde auf die andere spielte mein Virenscanner verrückt (Antivir) und zeigte unzählige verschiedene trojaner an. Dann ging es Schlag auf Schlag; zuerst wurde die IDA Sata Festplatte nicht mehr erkannt und ein Neustart empfohlen. Nachdem ich diesen ausgeführt hatte, war der Bildschirm nur noch schwarz und keine Datein mehr zu sehen. Ich hab jetzt mal malwarebyte,wie empfohlen drüberlaufen lassen und folgendes logfile erhalten (hab malwarebyte natürlich aktualisiert vorher) Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Datenbank Version: 6557 Windows 6.0.6002 Service Pack 2 (Safe Mode) Internet Explorer 9.0.8112.16421 12.05.2011 00:40:43 mbam-log-2011-05-12 (00-39-59).txt Art des Suchlaufs: Quick-Scan Durchsuchte Objekte: 169634 Laufzeit: 3 Minute(n), 13 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 2 Infizierte Registrierungswerte: 2 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 7 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CURRENT_USER\SOFTWARE\D1T2EUR7FZ (Trojan.FakeAlert.SA) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mzawohid (Trojan.Hiloti) -> Value: Mzawohid -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YvYKyGbjbi (Rogue.Installer.Gen) -> Value: YvYKyGbjbi -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\wolfgangk\AppData\Local\pralvin.dll (Trojan.Hiloti) -> No action taken. c:\programdata\yvykygbjbi.exe (Rogue.Installer.Gen) -> No action taken. c:\Users\wolfgangk\AppData\Local\Temp\0.30478326674881007.exe (Spyware.Passwords.XGen) -> No action taken. c:\Users\wolfgangk\AppData\Local\Temp\tmpB48F.tmp (Rogue.Installer.Gen) -> No action taken. c:\Windows\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> No action taken. c:\Users\wolfgangk\AppData\Roaming\Adobe\plugs\mmc119.exe (Trojan.Agent) -> No action taken. c:\Users\wolfgangk\AppData\Roaming\Adobe\plugs\mmc98.exe (Trojan.Agent) -> No action taken. Nachdem ich die viren trojaner oder was auch imer gelöscht habe, hab ich folgendes logfile bekommen. Habe einen kompletten scan durch geführt. weiters hab ich bevor ich mit Malwarebytes die viren/trojaner gelöscht habe ein OTL-logfile erstellt. was folgendermaßen aussieht.ich hoffe es ist noch was zu retten OTL Logfile: Code:
ATTFilter OTL logfile created on: 12.05.2011 00:19:20 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\wolfgangk\Desktop Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 136,43 Gb Total Space | 27,76 Gb Free Space | 20,35% Space Free | Partition Type: NTFS Drive D: | 10,00 Gb Total Space | 6,38 Gb Free Space | 63,75% Space Free | Partition Type: NTFS Computer Name: WOLFGANGK-PC | User Name: wolfgangk | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\wolfgangk\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Users\wolfgangk\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (a2AntiMalware) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH) SRV - (SbieSvc) -- C:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D) SRV - (HssTrayService) -- C:\Programme2\Setups2\Bwin\hotspot\Hotspot Shield\bin\HssTrayService.exe () SRV - (HotspotShieldService) -- C:\Programme2\Setups2\Bwin\hotspot\Hotspot Shield\bin\openvpnas.exe () SRV - (HssSrv) -- C:\Programme2\Setups2\Bwin\hotspot\Hotspot Shield\HssWPR\hsssrv.exe (AnchorFree Inc.) SRV - (HssWd) -- C:\Programme2\Setups2\Bwin\hotspot\Hotspot Shield\bin\hsswd.exe () SRV - (Microsoft SharePoint Workspace Audit Service) -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.) SRV - (SBSDWSCService) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (STacSV) -- C:\Windows\System32\stacsv.exe (IDT, Inc.) SRV - (AESTFilters) -- C:\Windows\System32\AEstSrv.exe (Andrea Electronics Corporation) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (GtFlashSwitch) -- C:\Program Files\Common Files\GtFlashSwitch\GtFlashSwitch.exe (OptionNV) ========== Driver Services (SafeList) ========== DRV - (a2acc) -- C:\Programme\Emsisoft Anti-Malware\a2accx86.sys (Emsi Software GmbH) DRV - (SbieDrv) -- C:\Programme\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D) DRV - (truecrypt) -- C:\Windows\System32\drivers\truecrypt.sys (TrueCrypt Foundation) DRV - (HMFAxCore56d706f6725c732df006697fd5ec3381) -- C:\Windows\System32\drivers\HMFAxCore56d706f6725c732df006697fd5ec3381.sys () DRV - (HssDrv) -- C:\Windows\System32\drivers\hssdrv.sys (AnchorFree Inc.) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.) DRV - (taphss) -- C:\Windows\System32\drivers\taphss.sys (AnchorFree Inc) DRV - (IT9135BDA) -- C:\Windows\System32\drivers\IT9135BDA.sys (ITE ) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (KeyScrambler) -- C:\Windows\System32\drivers\keyscrambler.sys (QFX Software Corporation) DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (OEM02Dev) -- C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.) DRV - (STHDA) -- C:\Windows\System32\drivers\stwrt.sys (IDT, Inc.) DRV - (OEM02Vfx) -- C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.) DRV - (s816mdm) -- C:\Windows\System32\drivers\s816mdm.sys (MCCI Corporation) DRV - (s816mgmt) Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s816mgmt.sys (MCCI Corporation) DRV - (s816unic) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM) -- C:\Windows\System32\drivers\s816unic.sys (MCCI) DRV - (s816obex) -- C:\Windows\System32\drivers\s816obex.sys (MCCI Corporation) DRV - (s816nd5) Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS) -- C:\Windows\System32\drivers\s816nd5.sys (MCCI Corporation) DRV - (s816mdfl) -- C:\Windows\System32\drivers\s816mdfl.sys (MCCI Corporation) DRV - (s816bus) Sony Ericsson Device 816 driver (WDM) -- C:\Windows\System32\drivers\s816bus.sys (MCCI Corporation) DRV - (GTMNDISIRPXP) -- C:\Windows\System32\drivers\Gtm51Irp.sys (Option NV) DRV - (GTUQBUS) -- C:\Windows\System32\drivers\gtuqbus.sys (Option N.V.) DRV - (GTPTSER) -- C:\Windows\System32\drivers\gtptser.sys (Option N.V.) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC) DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation) DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.) DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (pnetmdm) -- C:\Windows\System32\drivers\pnetmdm.sys (June Fabrics Technology) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com?o=14978&l=dis IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Ask.com" FF - prefs.js..browser.search.order.1: "Ask.com" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "orf.at" FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {038dc421-b19e-4711-a218-1fd10de9163b}:1.0.0.2 FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.8 FF - prefs.js..extensions.enabledItems: firegestures@xuldev.org:1.6.1 FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.4.1 FF - prefs.js..extensions.enabledItems: foxyproxy@eric.h.jung:2.22.5 FF - prefs.js..extensions.enabledItems: davidcarver88@gmail.com:0.3.7 FF - prefs.js..extensions.enabledItems: {cd617372-6743-4ee4-bac4-fbf60f35719e}:2.0 FF - prefs.js..extensions.enabledItems: {4776510a-a1f4-41f3-a3c8-35b474ecef23}:1.0.8 FF - prefs.js..extensions.enabledItems: {792BDDFE-2E7C-42ed-B18D-18154D2761BD}:0.9.6 FF - prefs.js..extensions.enabledItems: trackmenot@mrl.nyu.edu:0.6.723 FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3 FF - prefs.js..extensions.enabledItems: {62760FD6-B943-48C9-AB09-F99C6FE96088}:2.1.8 FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.0.9.9 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.6.2 FF - prefs.js..extensions.enabledItems: {1BC9BA34-1EED-42ca-A505-6D2F1A935BBB}:2.12.21.1 FF - prefs.js..extensions.enabledItems: keyscrambler@qfx.software.corporation:2.7.1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: {1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}:0.4.6 FF - prefs.js..extensions.enabledItems: {2f17f610-5e97-4fed-828f-9940b7b577a4}:1.6.5 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: universal@dubfire.net:1.0 FF - prefs.js..extensions.enabledItems: {4176DFF4-4698-11DE-BEEB-45DA55D89593}:0.8.7 FF - prefs.js..extensions.enabledItems: smarterwiki@wikiatic.com:4.3.5 FF - prefs.js..extensions.enabledItems: adblockpopups@jessehakanen.net:0.2.2 FF - prefs.js..extensions.enabledItems: browserprotect@browserprotect.com:1.1.2 FF - prefs.js..extensions.enabledItems: afurladvisor@anchorfree.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.12 16:13:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.12 16:13:55 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.29 19:21:29 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.23 04:47:07 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Components: C:\Program Files\Mozilla Firefox 4.0 Beta 12\components [2011.03.23 04:47:08 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0b12\extensions\\Plugins: C:\Program Files\Mozilla Firefox 4.0 Beta 12\plugins [2011.04.09 16:16:54 | 000,000,000 | ---D | M] [2008.12.18 01:05:31 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Extensions [2011.05.11 20:07:40 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions [2010.04.17 00:20:50 | 000,000,000 | -H-D | M] (Add N Edit Cookies) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{038dc421-b19e-4711-a218-1fd10de9163b} [2011.01.25 01:24:50 | 000,000,000 | -H-D | M] (IE Tab 2 (FF 3.6+)) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{1BC9BA34-1EED-42ca-A505-6D2F1A935BBB} [2010.04.27 23:35:34 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.03.23 01:24:48 | 000,000,000 | -H-D | M] (eBay Sidebar for Firefox) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088} [2008.12.18 01:24:05 | 000,000,000 | -H-D | M] (Add N Edit Cookies) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{bb6bc1bb-f824-4702-90cd-35e2fb24f25c} [2010.07.23 14:07:59 | 000,000,000 | -H-D | M] ("Show my Password") -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\{cd617372-6743-4ee4-bac4-fbf60f35719e} [2011.03.23 16:59:54 | 000,000,000 | -H-D | M] (Ant Video Downloader) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\anttoolbar@ant.com [2011.05.05 00:37:39 | 000,000,000 | -H-D | M] (FoxyProxy Standard) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\foxyproxy@eric.h.jung [2011.03.12 02:14:28 | 000,000,000 | -H-D | M] (KeyScrambler) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\keyscrambler@qfx.software.corporation [2011.03.14 00:03:47 | 000,000,000 | -H-D | M] (Personas) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\personas@christopher.beard [2011.03.23 04:54:00 | 000,000,000 | -H-D | M] (startup.service) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\startup.service@mozilla.com [2011.03.02 05:34:22 | 000,000,000 | -H-D | M] (TrackMeNot) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\trackmenot@mrl.nyu.edu [2011.02.09 16:38:04 | 000,000,000 | -H-D | M] (Universal Behavioral Advertising Opt-out) -- C:\Users\wolfgangk\AppData\Roaming\mozilla\Firefox\Profiles\3nfx0x5g.default\extensions\universal@dubfire.net [2009.10.31 03:49:38 | 000,002,255 | -H-- | M] () -- C:\Users\wolfgangk\AppData\Roaming\Mozilla\Firefox\Profiles\3nfx0x5g.default\searchplugins\askcom.xml [2009.09.22 10:08:58 | 000,002,164 | -H-- | M] () -- C:\Users\wolfgangk\AppData\Roaming\Mozilla\Firefox\Profiles\3nfx0x5g.default\searchplugins\bing.xml [2011.03.19 00:41:15 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.06.29 21:10:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.23 19:44:09 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.15 18:46:17 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.12.16 02:39:22 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.19 00:41:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.02.23 15:49:23 | 000,000,000 | ---D | M] (afurladvisor) -- C:\Programme\Mozilla Firefox\extensions\afurladvisor@anchorfree.com File not found (No name found) -- [2008.07.03 00:02:49 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} [2008.08.17 00:48:29 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2009.01.14 13:59:35 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009.03.31 14:27:12 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009.08.31 06:22:12 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009.11.30 21:54:04 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.03.31 03:17:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010.06.29 21:10:47 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.23 19:44:09 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.10.15 18:46:17 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010.12.16 02:39:22 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.19 00:41:15 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{4176DFF4-4698-11DE-BEEB-45DA55D89593}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{B749FC7C-E949-447F-926C-3F4EED6ACCFE}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{CE6E6E3B-84DD-4CAC-9F63-8D2AE4F30A4B}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\BROWSERPROTECT@BROWSERPROTECT.COM.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\FABTAB@CAPTAINCAVEMAN.NL.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\FIREGESTURES@XULDEV.ORG.XPI () (No name found) -- C:\USERS\WOLFGANGK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3NFX0X5G.DEFAULT\EXTENSIONS\SMARTERWIKI@WIKIATIC.COM.XPI [2011.04.29 19:21:17 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2011.03.23 02:21:28 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.03.23 02:21:29 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml [2011.03.23 02:21:29 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.03.23 02:21:29 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.03.23 02:21:29 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.03.23 02:21:29 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.05.11 23:41:09 | 000,435,555 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 123topsearch.com O1 - Hosts: 127.0.0.1 www.123topsearch.com O1 - Hosts: 127.0.0.1 132.com O1 - Hosts: 127.0.0.1 www.132.com O1 - Hosts: 127.0.0.1 136136.net O1 - Hosts: 127.0.0.1 www.136136.net O1 - Hosts: 127.0.0.1 163ns.com O1 - Hosts: 14988 more lines... O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme2\Programme\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Programme2\Setups2\Bwin\hotspot\Hotspot Shield\HssIE\HssIE.dll (AnchorFree Inc.) O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH) O3 - HKLM\..\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Programme\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [DELL Webcam Manager] C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.) O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( ) O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [PCMService] C:\Program Files\Dell\MediaDirect\PCMService.exe (CyberLink Corp.) O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions) O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\ssmmgr.exe () O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Programme\Sigmatel\C-Major Audio\WDM\sttray.exe (IDT, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [Mzawohid] C:\Users\wolfgangk\AppData\Local\pralvin.dll (madshi.net) O4 - HKCU..\Run: [Remote Control Editor] C:\Program Files\Common Files\TerraTec\Remote\TTTvRc.exe (Elgato Systems) O4 - HKCU..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D) O4 - HKCU..\Run: [YvYKyGbjbi] C:\ProgramData\YvYKyGbjbi.exe (QNP) O4 - Startup: C:\Users\wolfgangk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\wolfgangk\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\wolfgangk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.2.lnk = C:\Programme\OpenOffice.org 2.2\program\quickstart.exe () O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe () O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe () O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme2\Programme\Spybot - Search & Destroy\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0) O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\inspiron_NB_1280x864_01.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\inspiron_NB_1280x864_01.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a15a2e10-0c6e-11e0-a035-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{a15a2e10-0c6e-11e0-a035-001d09bb119a}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{a15a2e11-0c6e-11e0-a035-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{a15a2e11-0c6e-11e0-a035-001d09bb119a}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{d269aaa8-4fe7-11df-b4de-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{d269aaa8-4fe7-11df-b4de-001d09bb119a}\Shell\AutoRun\command - "" = F:\AutoRun.exe O33 - MountPoints2\{d269aab7-4fe7-11df-b4de-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{d269aab7-4fe7-11df-b4de-001d09bb119a}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{f9d79f54-c635-11df-9f36-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{f9d79f54-c635-11df-9f36-806e6f6e6963}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{f9d79f81-c635-11df-9f36-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{f9d79f81-c635-11df-9f36-001d09bb119a}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{f9d79f82-c635-11df-9f36-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{f9d79f82-c635-11df-9f36-001d09bb119a}\Shell\AutoRun\command - "" = H:\AutoRun.exe O33 - MountPoints2\{f9d79f83-c635-11df-9f36-001d09bb119a}\Shell - "" = AutoRun O33 - MountPoints2\{f9d79f83-c635-11df-9f36-001d09bb119a}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\AutoRun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.05.12 00:18:07 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\wolfgangk\Desktop\OTL.exe [2011.05.11 23:22:55 | 000,006,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\beep.sys [2011.05.11 23:21:07 | 000,507,392 | -H-- | C] (QNP) -- C:\ProgramData\YvYKyGbjbi.exe [2011.04.27 01:17:42 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll [2011.04.27 01:17:41 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll [2011.04.27 01:17:06 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll [2011.04.23 13:28:07 | 000,000,000 | -H-D | C] -- C:\Users\wolfgangk\AppData\Local\DDMSettings [2011.04.21 23:56:36 | 000,000,000 | -H-D | C] -- C:\Users\wolfgangk\Desktop\nav18gonl [2011.04.21 23:51:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2011.04.21 23:50:37 | 000,000,000 | ---D | C] -- C:\Programme\iPod [2011.04.21 23:50:30 | 000,000,000 | ---D | C] -- C:\Programme\iTunes [2011.04.21 23:44:11 | 000,000,000 | ---D | C] -- C:\Programme\Bonjour [2011.04.17 19:06:07 | 028,775,928 | -H-- | C] ( ) -- C:\Users\wolfgangk\Desktop\AdbeRdr940_de_DE.exe [2011.04.15 18:37:53 | 000,161,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2011.04.15 18:37:52 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2011.04.15 18:37:52 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2011.04.15 18:37:52 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2011.04.15 18:37:52 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2011.04.15 18:37:51 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2011.04.15 18:37:51 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2011.04.15 18:37:51 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2011.04.15 18:37:49 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2011.04.15 18:37:49 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.04.15 18:37:49 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2011.04.15 18:37:49 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2011.04.15 18:37:48 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2011.04.15 18:37:48 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2011.04.15 18:37:48 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2011.04.15 18:37:48 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2011.04.15 18:37:47 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2011.04.15 18:37:47 | 000,353,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2011.04.15 18:37:47 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2011.04.15 18:37:47 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2011.04.15 18:37:47 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2011.04.15 18:37:46 | 000,580,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.04.15 18:37:46 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2011.04.15 18:37:46 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2011.04.15 18:37:46 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2011.04.15 18:37:45 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.04.15 18:37:45 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2011.04.15 18:37:45 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2011.04.15 18:37:45 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2011.04.15 18:37:45 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2011.04.15 18:37:44 | 001,797,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2011.04.15 18:37:44 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2011.04.15 18:37:44 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2011.04.15 18:37:44 | 000,118,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.04.15 18:37:44 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2011.04.15 18:37:43 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2011.04.15 18:37:43 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2011.04.15 18:37:43 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2011.04.15 18:37:43 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [2011.04.12 20:41:50 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll [2011.04.12 20:41:50 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll [2011.04.12 20:36:51 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll [2011.04.12 20:36:51 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll [2011.04.12 20:32:32 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe [2011.04.12 20:32:06 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2009.09.11 11:21:29 | 000,114,688 | -H-- | C] (madshi.net) -- C:\Users\wolfgangk\AppData\Local\pralvin.dll [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.05.12 00:18:07 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\wolfgangk\Desktop\OTL.exe [2011.05.12 00:12:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.05.11 23:56:03 | 000,000,254 | -H-- | M] () -- C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job [2011.05.11 23:54:50 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.05.11 23:54:50 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.05.11 23:53:17 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2011.05.11 23:41:09 | 000,435,555 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts [2011.05.11 23:38:56 | 000,426,986 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.05.11 23:38:56 | 000,308,428 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.05.11 23:38:56 | 000,033,846 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.05.11 23:38:55 | 000,133,730 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.05.11 23:21:06 | 000,507,392 | -H-- | M] (QNP) -- C:\ProgramData\YvYKyGbjbi.exe [2011.05.11 23:20:24 | 000,000,000 | ---- | M] () -- C:\Users\wolfgangk\2gweorjqjutp92vjy9gake [2011.05.11 12:23:46 | 000,000,452 | ---- | M] () -- C:\Windows\tasks\COMODO System Cleaner Update.job [2011.05.09 17:17:04 | 000,000,600 | -H-- | M] () -- C:\Users\wolfgangk\AppData\Roaming\winscp.rnd [2011.05.06 16:28:48 | 000,002,120 | ---- | M] () -- C:\Windows\Sandboxie.ini [2011.05.02 22:13:17 | 000,033,425 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\Themen + Fragen zum Referat.pdf [2011.05.02 21:45:16 | 000,111,104 | -H-- | M] () -- C:\Users\wolfgangk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.04.30 23:46:59 | 051,879,861 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\World_Atlas-v1.1-Halb_Noob_-_Boerse.BZ.ipa [2011.04.30 22:41:09 | 001,924,304 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\Arbeitsblatt_Jemen.pdf [2011.04.30 03:41:57 | 000,021,004 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\Forschungsfrage IP.odt [2011.04.29 21:30:07 | 000,125,961 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\Referatsfragen_neo_institutionalismus.pdf [2011.04.29 21:28:35 | 000,011,611 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\Aufgaben_Diskussionsgruppen_3.5.pdf [2011.04.29 21:06:02 | 000,090,043 | -H-- | M] () -- C:\Users\wolfgangk\Desktop\001_Laudenbach_Fragile-Staatlichkeit.pdf [2011.04.28 02:19:33 | 325,267,535 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011.04.28 00:30:23 | 000,429,232 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.04.27 02:50:09 | 000,000,103 | ---- | M] () -- C:\Windows\wininit.ini [2011.04.27 01:31:41 | 000,434,295 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110511-234108.backup [2011.04.17 19:07:29 | 028,775,928 | -H-- | M] ( ) -- C:\Users\wolfgangk\Desktop\AdbeRdr940_de_DE.exe [2011.04.15 18:38:05 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2011.04.15 18:38:05 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2011.04.15 18:37:53 | 000,161,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll [2011.04.15 18:37:52 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll [2011.04.15 18:37:52 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe [2011.04.15 18:37:52 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe [2011.04.15 18:37:52 | 000,065,024 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2011.04.15 18:37:51 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2011.04.15 18:37:51 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll [2011.04.15 18:37:51 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll [2011.04.15 18:37:49 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat [2011.04.15 18:37:49 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec [2011.04.15 18:37:49 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll [2011.04.15 18:37:49 | 000,223,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll [2011.04.15 18:37:48 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll [2011.04.15 18:37:48 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll [2011.04.15 18:37:48 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe [2011.04.15 18:37:48 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2011.04.15 18:37:48 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll [2011.04.15 18:37:47 | 001,427,456 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2011.04.15 18:37:47 | 000,353,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll [2011.04.15 18:37:47 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2011.04.15 18:37:47 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll [2011.04.15 18:37:47 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll [2011.04.15 18:37:46 | 000,580,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2011.04.15 18:37:46 | 000,420,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2011.04.15 18:37:46 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe [2011.04.15 18:37:46 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe [2011.04.15 18:37:45 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2011.04.15 18:37:45 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll [2011.04.15 18:37:45 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2011.04.15 18:37:45 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll [2011.04.15 18:37:45 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll [2011.04.15 18:37:44 | 001,797,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2011.04.15 18:37:44 | 000,716,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll [2011.04.15 18:37:44 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll [2011.04.15 18:37:44 | 000,118,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll [2011.04.15 18:37:44 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll [2011.04.15 18:37:43 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll [2011.04.15 18:37:43 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll [2011.04.15 18:37:43 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll [2011.04.15 18:37:43 | 000,010,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.11 23:20:24 | 000,000,000 | ---- | C] () -- C:\Users\wolfgangk\2gweorjqjutp92vjy9gake [2011.05.02 22:13:17 | 000,033,425 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\Themen + Fragen zum Referat.pdf [2011.04.30 23:40:25 | 051,879,861 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\World_Atlas-v1.1-Halb_Noob_-_Boerse.BZ.ipa [2011.04.30 22:41:08 | 001,924,304 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\Arbeitsblatt_Jemen.pdf [2011.04.29 21:30:07 | 000,125,961 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\Referatsfragen_neo_institutionalismus.pdf [2011.04.29 21:28:35 | 000,011,611 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\Aufgaben_Diskussionsgruppen_3.5.pdf [2011.04.29 21:06:02 | 000,090,043 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\001_Laudenbach_Fragile-Staatlichkeit.pdf [2011.04.29 20:56:04 | 000,021,004 | -H-- | C] () -- C:\Users\wolfgangk\Desktop\Forschungsfrage IP.odt [2011.04.27 02:50:09 | 000,000,103 | ---- | C] () -- C:\Windows\wininit.ini [2011.04.23 19:27:50 | 000,000,254 | -H-- | C] () -- C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job [2011.04.15 18:37:48 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2011.02.20 05:33:04 | 000,002,120 | ---- | C] () -- C:\Windows\Sandboxie.ini [2010.10.08 14:28:55 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe [2010.10.08 14:27:11 | 000,026,624 | ---- | C] () -- C:\Windows\System32\ssp7ml3.dll [2010.09.04 02:07:17 | 000,015,872 | ---- | C] () -- C:\Windows\System32\drivers\HMFAxCore56d706f6725c732df006697fd5ec3381.sys [2010.09.01 18:28:49 | 000,000,000 | ---- | C] () -- C:\Windows\System32\cd.dat [2010.08.26 13:37:05 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat [2010.08.26 13:37:05 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat [2010.08.26 13:37:05 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat [2010.08.26 13:37:05 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat [2010.08.26 13:37:05 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat [2010.08.26 13:37:05 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat [2010.08.26 13:37:05 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat [2010.08.26 13:37:05 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat [2010.08.26 13:37:05 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat [2010.08.26 13:37:05 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat [2010.08.26 13:37:05 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat [2010.08.26 13:37:05 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat [2010.08.26 13:37:05 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat [2010.08.26 13:37:05 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat [2010.08.26 13:37:05 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat [2010.08.26 13:37:05 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat [2010.08.26 13:37:05 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat [2010.08.26 13:37:05 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat [2010.08.26 13:37:05 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini [2010.06.29 21:21:18 | 000,000,066 | ---- | C] () -- C:\Windows\hcs.dat [2010.05.30 23:57:11 | 000,000,600 | -H-- | C] () -- C:\Users\wolfgangk\AppData\Roaming\winscp.rnd [2010.03.29 23:43:53 | 000,000,552 | -H-- | C] () -- C:\Users\wolfgangk\AppData\Local\d3d8caps.dat [2010.03.02 04:46:38 | 000,000,008 | ---- | C] () -- C:\Windows\crpf.bin [2010.03.02 04:46:38 | 000,000,004 | ---- | C] () -- C:\Windows\crpf_sdum.bin [2009.09.11 11:22:02 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.09.11 11:20:17 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.04.20 12:25:44 | 000,000,040 | ---- | C] () -- C:\Windows\ujf635.bin [2009.02.22 22:04:23 | 000,001,356 | -H-- | C] () -- C:\Users\wolfgangk\AppData\Local\d3d9caps.dat [2008.11.11 00:10:35 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.10.01 22:21:20 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.05.12 14:15:26 | 000,111,104 | -H-- | C] () -- C:\Users\wolfgangk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.01.21 18:39:13 | 000,000,930 | -H-- | C] () -- C:\Users\wolfgangk\AppData\Roaming\wklnhst.dat [2008.01.16 17:38:11 | 001,238,832 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll [2008.01.16 17:38:11 | 000,249,856 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll [2008.01.16 17:38:11 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1322.dll [2008.01.16 17:38:11 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll [2008.01.16 17:38:05 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll [2008.01.16 17:37:56 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2008.01.16 10:01:49 | 000,054,784 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll [2008.01.16 10:01:48 | 000,024,064 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE [2008.01.16 10:01:21 | 000,000,076 | RHS- | C] () -- C:\Windows\CT4CET.bin [2008.01.16 09:54:59 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat [2006.11.15 19:59:40 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2006.11.07 21:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini [2006.11.02 17:38:05 | 000,426,986 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:38:05 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:38:05 | 000,133,730 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:38:05 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:44:53 | 000,429,232 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 12:33:01 | 000,308,428 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,033,846 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006.11.02 12:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.09.17 01:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll [2006.09.17 01:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 95 bytes -> C:\ProgramData\TEMP:5C321E34 @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\TCM 2005:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\TCM 2004:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\PacificPoker:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\My Videos:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\FM 2004:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\FM 08:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\FIFAM 08:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\FIFA MANAGER 10:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\Dell Webcam Center:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\Azureus Downloads:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Documents\Anti-Malware:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Wintersemester 2010:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\WilmaaTV:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Uni:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\STATA 11 SE:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Sommersemester 2011:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\office 2010:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\nav18gonl:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\iphone daten:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\groupon, daily deal:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Fußballmanager:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Fussball_Manager2002_(Serial):Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\wolfgangk\Desktop\Bummerl-v1.0.2-Miike.ipa:Roxio EMC Stream < End of report > und hier das otl-extraOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 12.05.2011 00:19:20 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\wolfgangk\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 66,00% Memory free
4,00 Gb Paging File | 4,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 136,43 Gb Total Space | 27,76 Gb Free Space | 20,35% Space Free | Partition Type: NTFS
Drive D: | 10,00 Gb Total Space | 6,38 Gb Free Space | 63,75% Space Free | Partition Type: NTFS
Computer Name: WOLFGANGK-PC | User Name: wolfgangk | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1F4C2C6C-9BF0-4E70-B16C-1E0E372B7C45}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office14\outlook.exe |
"{7B685A74-4D7D-4CE3-946E-3A27F867D2A5}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{7CA988BC-3114-467A-B1FC-9D3FDCEADD3D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{801AC123-4BA3-4140-BC31-AF967DA1A3A8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{ACD1FB86-DBD3-4468-8E4F-00AAC3FD8A4A}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{ACDD1E11-E6BD-4A6E-916F-82C680A33583}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B47E2F86-D560-45D9-8E85-8A2B37E44BA1}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BFEB57AF-24B6-4C67-9941-55E92EFAF0A4}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{D8ADC63F-D6D2-4141-9C3B-D064A92F7D8C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0579AB80-1750-4C79-A222-4372F7233077}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{099F0DC3-0E05-4C0E-B940-9120472108FF}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"{0C0DFB7D-9CBC-4BF7-81E2-D2BA7747EF30}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe |
"{13A49756-CA31-423F-AEF2-F668A8364C10}" = protocol=17 | dir=in | app=c:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe |
"{1DEE2D2D-BE90-41D5-AAB1-777616B147F6}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{284B5CE1-AF79-47F2-A61E-4A912C01ACE1}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2F10F9DA-4B82-4E9B-BDF6-3782FFE197B6}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe |
"{31B054F2-6690-4A4A-B11A-4E44915C4B5A}" = dir=in | app=c:\program files\dell\mediadirect\pcmservice.exe |
"{336B3079-351B-4139-B6BB-D4702B65E69C}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{367A17D1-645B-4141-97C2-F7FE201BBE20}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{43D621EC-29CE-4697-9C73-82A513E3CA2E}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe |
"{45C6E00B-F894-4856-BEC1-B489983880FF}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{47963EAA-F7FC-4A1A-B906-0B4376F373EF}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dmp\clbrowserengine.exe |
"{4D834609-51D0-485B-98B3-2CFAA8E2B223}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{4DBFE646-8522-4636-AE87-39001D6407F3}" = protocol=6 | dir=in | app=c:\program files\pplive\pplive.exe |
"{4EE14E1C-B3B6-4E92-A9AE-A1A16DB72243}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe |
"{4F05E6D2-83CA-4295-82C6-B2F9E4A80169}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe |
"{4FF1D353-629E-45B9-8790-84EC9FECD24C}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"{54419607-6DDC-452E-9F1D-1ACC2F93D909}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{599BD6B6-0657-477A-BCEC-42C2AA1555DB}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{601C594D-73B1-41D2-A2FD-BB5FACCFB059}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{60ABDF34-2970-43A7-9A19-17088E405793}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{653924DA-85DB-4ED4-8D04-D058185ABF69}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe |
"{6AF14C02-A439-4100-80E7-20AA2B9968C6}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{77A7902E-FC22-445F-A57C-292501336B68}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{78D1BCDC-7A37-4998-98D6-7E8E3D1BBCAC}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7F538629-8820-4A3D-8229-7878A5CF3601}" = protocol=6 | dir=in | app=c:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe |
"{8DC94F62-4642-4AA2-A549-D2C383BB27D3}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{937CC06C-0D8F-423E-ADA2-0A0ECC831BF4}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{99269C72-5158-4BC1-8669-C8647913E437}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9D266F8D-4DD1-4F28-A6D9-A62FE89CD633}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe |
"{A737E84E-E7B9-4335-812E-0AD8CB3E44AB}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{AB352C02-3F2A-4DE0-9992-321A4DE8A7B1}" = dir=in | app=c:\program files\dell\mediadirect\mediadirect.exe |
"{ABA79F3F-E889-498B-BCD4-3293E5443B92}" = protocol=17 | dir=in | app=c:\program files\pplive\pplive.exe |
"{B58C11DB-3587-48B9-9915-E5B24B4A1EEA}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office14\groove.exe |
"{BA8E8698-7243-4766-8C3B-D2E38557F3FE}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\tvtvsetup\tvtv_wizard.exe |
"{C0092CF4-C762-415D-B0DB-0110D7513DDF}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe |
"{C1ED8289-13D9-48FB-BF4C-E9604BA970E1}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"{C23F6ACA-7141-436E-9437-5CFF5E6E96A9}" = dir=in | app=c:\program files\dell\mediadirect\kernel\dms\clmsservice.exe |
"{C9731AFE-9562-4600-A37C-3933A4F21717}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office14\onenote.exe |
"{D308EBBC-19EE-4076-A012-76B9FE3D2693}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"{D30FA1C7-6C90-4542-945B-912F7BF51B7C}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"{D6A69E5F-5A1E-4FEF-A83D-035AC588F770}" = protocol=6 | dir=in | app=c:\programme2\programme\itunes\itunes.exe |
"{EFFAAC62-1295-46E8-A00E-27A0E32D242B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{F241F10A-C606-4152-9F55-6F95BBBC5C09}" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\insttool.exe |
"{F7F05196-132A-4AF6-B4E0-125C6C78C49B}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{FA72F775-FE74-4FD2-A386-4CE8482D5C39}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{FE4B8FDA-C117-4595-AF35-EAB15467D290}" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\cinergydvr.exe |
"TCP Query User{03F00903-1C8F-49B1-B5A8-2A6B28B756E0}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{0CD36867-9E43-4096-A20B-4889C1C3A390}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{1152618F-2570-46C6-BF24-4B2EDC6DCEC2}C:\program files\bittorrent\bittorrent.exe" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"TCP Query User{1588815B-5270-4EAC-BA03-205B5C8D7ED4}C:\users\wolfgangk\program files\dna\btdna.exe" = protocol=6 | dir=in | app=c:\users\wolfgangk\program files\dna\btdna.exe |
"TCP Query User{25360263-0866-4D7E-A1E8-C6398ECD6BBF}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{339594B6-EBBB-4B88-A883-B3A847623641}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"TCP Query User{34481D58-C2D9-44ED-96EB-7F674260B6F0}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{3B6FE8AF-611D-4387-B953-A65CB1B02104}C:\program files\tvuplayer\tvuplayer.exe" = protocol=6 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"TCP Query User{440C3C39-F1AC-450D-9CD4-1A5054B8DAAC}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{4B4FFF7F-0301-4970-A4AF-561A26DF8CEA}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{58F61F9B-9121-485F-B2CF-FCB5E0008F1C}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{5CBC5922-705E-48F1-8942-7B50D60C870F}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe |
"TCP Query User{63B255AB-7E20-45D6-B4E0-E7B789982D5C}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{680B6E3C-1F43-4450-A789-2AB6CBD1C229}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{6FBC0D30-0560-4A86-857F-C75B549CCFA9}C:\program files\tvants\tvants.exe" = protocol=6 | dir=in | app=c:\program files\tvants\tvants.exe |
"TCP Query User{74BD6892-6BB7-41DF-97B3-2420F9216FBA}C:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{7D695366-E50A-4EE8-B3D6-31C601E66FD9}C:\program files\wi-fi sync\wifisync.exe" = protocol=6 | dir=in | app=c:\program files\wi-fi sync\wifisync.exe |
"TCP Query User{7ECF5E0E-2FE5-41FC-91EB-74F896DCC7A2}C:\users\wolfgangk\appdata\local\temp\rarsfx1\bin\itunnel.exe" = protocol=6 | dir=in | app=c:\users\wolfgangk\appdata\local\temp\rarsfx1\bin\itunnel.exe |
"TCP Query User{828D3C4D-E2D6-4E93-9681-8E85C3F27185}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=6 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe |
"TCP Query User{8E8F301E-3E1E-4CA9-9313-208758F9CE5D}C:\users\wolfgangk\appdata\local\temp\rarsfx2\bin\itunnel.exe" = protocol=6 | dir=in | app=c:\users\wolfgangk\appdata\local\temp\rarsfx2\bin\itunnel.exe |
"TCP Query User{93CA215F-98FF-41F9-B117-0A754BA8018C}C:\program files\wi-fi sync\wifisync.exe" = protocol=6 | dir=in | app=c:\program files\wi-fi sync\wifisync.exe |
"TCP Query User{98258F3D-FCD8-45AD-B14B-0354C15AFE34}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{B3B826D5-B86B-4771-A8FA-9A68AE4EACF7}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=6 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe |
"TCP Query User{BEDD2F59-3664-4B39-B3DC-6BD8ABB33BF2}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{C93CCAF4-CD74-4CF9-A12F-744D1989A7C3}C:\programme2\programme\icq6\icq.exe" = protocol=6 | dir=in | app=c:\programme2\programme\icq6\icq.exe |
"TCP Query User{FE6E67A9-4C90-4C28-B4F9-452B175F82E3}C:\program files\pplive\pplive.exe" = protocol=6 | dir=in | app=c:\program files\pplive\pplive.exe |
"UDP Query User{003B3D30-EACD-4408-B821-0805A8DFFA72}C:\program files\wi-fi sync\wifisync.exe" = protocol=17 | dir=in | app=c:\program files\wi-fi sync\wifisync.exe |
"UDP Query User{0EF9B62F-A5F9-4A41-9949-6DA6C01A0F4C}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{18977C7F-7D80-489A-B499-143EA1B90854}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{1CEE692E-42A5-43C5-BC3A-F596827A511D}C:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\wolfgangk\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{2330C125-C562-4B0A-A0E9-CCC0640EA9F6}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe |
"UDP Query User{2CE8014F-F29C-47AF-89BD-0A55810AE0A0}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{5CA0977F-C476-4B7A-A203-D5D60724B5B4}C:\users\wolfgangk\appdata\local\temp\rarsfx1\bin\itunnel.exe" = protocol=17 | dir=in | app=c:\users\wolfgangk\appdata\local\temp\rarsfx1\bin\itunnel.exe |
"UDP Query User{622B7A1E-A2BC-433F-923C-8A16A8C3983D}C:\program files\tvuplayer\tvuplayer.exe" = protocol=17 | dir=in | app=c:\program files\tvuplayer\tvuplayer.exe |
"UDP Query User{71217BFC-664B-4271-ACB2-BE6456D1F7B5}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{73013D8F-AED6-4D41-B27B-8DBDA8CCA69C}C:\program files\wi-fi sync\wifisync.exe" = protocol=17 | dir=in | app=c:\program files\wi-fi sync\wifisync.exe |
"UDP Query User{88142F9C-1595-433E-B64F-D97467BAD34E}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"UDP Query User{8D29EC79-AD19-42AC-9C52-F425AB10375C}C:\users\wolfgangk\appdata\local\temp\rarsfx2\bin\itunnel.exe" = protocol=17 | dir=in | app=c:\users\wolfgangk\appdata\local\temp\rarsfx2\bin\itunnel.exe |
"UDP Query User{8F7F72DF-A254-43C2-BE7D-FB6F04E0D0FE}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{93BE57DD-F297-4C73-9074-78F5E8BEE30A}C:\program files\veoh networks\veoh\veohclient.exe" = protocol=17 | dir=in | app=c:\program files\veoh networks\veoh\veohclient.exe |
"UDP Query User{A4238674-93DA-4394-8AB0-8EFA862991F9}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{A5B449E2-DEAF-4A4D-9164-5BD02E8490E8}C:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe" = protocol=17 | dir=in | app=c:\program files\terratec\terratec home cinema\versioncheck\versioncheck.exe |
"UDP Query User{C8AB7E4C-C034-46B1-9AB5-B4A29FB7CFF2}C:\program files\tvants\tvants.exe" = protocol=17 | dir=in | app=c:\program files\tvants\tvants.exe |
"UDP Query User{C9D5141F-2DA6-47F6-93DF-5DB7A5EBFF16}C:\program files\bittorrent\bittorrent.exe" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"UDP Query User{D4CAA8D4-5448-4C52-A320-9AB163032E69}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{D77362EA-F834-4F27-8162-608F723EDFD3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{DC8A7CCA-745D-43D1-8E08-09816F3502DB}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{E5DB4D67-BB5F-40E9-8664-30406C11CE8A}C:\programme2\programme\icq6\icq.exe" = protocol=17 | dir=in | app=c:\programme2\programme\icq6\icq.exe |
"UDP Query User{EEFAF354-607B-47F3-8039-32FB5F9B4ACE}C:\users\wolfgangk\program files\dna\btdna.exe" = protocol=17 | dir=in | app=c:\users\wolfgangk\program files\dna\btdna.exe |
"UDP Query User{F2CEEC6E-68E4-4BD0-BD02-6CDB9B074669}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{F4E8D814-C4D8-4806-A16A-7CC7BCE2A50A}C:\program files\pplive\pplive.exe" = protocol=17 | dir=in | app=c:\program files\pplive\pplive.exe |
"UDP Query User{FC1DCB7A-827F-4BA5-8A27-32F19110D8A8}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar
"{1DBAF20E-DB61-4F15-AAB7-5EB57B7B6D08}" = GlobeTrotter Connect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{353FE16B-30FE-469A-BF55-B978F4218003}" = iTunes
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5386F5-C0F6-4532-A54A-374865AEAB71}" = Cisco PEAP Module
"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = Benutzerhandbuch
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{6E5BC38E-F22B-4197-00A2-CD8E58EF139C}" = Fussball Manager 2004
"{76F9CF97-FC4B-4E20-B363-D127C888448F}" = Cisco LEAP Module
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7F0C4457-8E64-491B-8D7B-991504365D1E}" = QuickSet
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Windows Mobile-Gerätecenter
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{925936AC-9C9A-4897-874B-60961AAB6D52}" = Disc2Phone
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A1A2073C-33FC-4890-86E2-FE7D2B8AFE0F}" = Betfair Poker
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B3276CB1-20B6-4AF9-AAEC-E72C83816495}" = IKEA Home Planner
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BF53252E-4AB2-4C7F-A0FD-6100755745E3}" = Cisco EAP-FAST Module
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C60BA916-9E44-4DA4-B11A-9E27B7624EF5}" = Sony Ericsson Drivers
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C92E7DF1-624A-4D95-A4C4-18CB491B44A4}" = Sony Ericsson Device Data
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D4C9692E-4EFA-4DA0-8B7F-9439466D9E31}" = Full Tilt Poker
"{D59AC9E9-FFAE-471B-B1FF-4B311D23417A}" = Sony Ericsson PC Suite
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{D6BF6477-8369-489F-8DE6-3731F4B88560}" = Sony Ericsson PC Suite
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E4C1DBF1-67D9-4973-9DEC-677E695E7CE0}" = AxCrypt 1.7.2126.0
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E7044E25-3038-4A76-9064-344AC038043E}" = Windows Mobile-Gerätecenter: Treiberupdate
"{E7DA9B23-5715-45D8-965E-E76688A2B948}" = OpenOffice.org 2.2
"{F63A3748-B93D-4360-9AD4-B064481A5C7B}" = Modem-Diagnose-Tool
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{FD023F61-65E9-465C-B558-7C64EB2B97E6}" = Dell Handbuch zum Einstieg
"{FE7FDB2F-4AFC-4B11-A2BE-95318CCA20F8}_is1" = Hide Folders v2.2
"3DataManager" = Mein 3DataManager
"8461-7759-5462-8226" = Vuze
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"AmoK DelayDel" = AmoK DelayDel 1.2
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Betfair Poker_is1" = Betfair Poker
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Karte
"bwin" = bwin Poker (remove only)
"CCleaner" = CCleaner
"Cinergy T Stick Mini" = Cinergy T Stick Mini V10.02.03.02
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F" = Conexant HDA D330 MDC V.92 Modem
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"EA Download Manager" = EA Download Manager
"EF Englishtown Advanced Speech Recognition_is1" = EF Englishtown Advanced Speech Recognition version 4.3.0.0
"Emsisoft Anti-Malware_is1" = Emsisoft Anti-Malware 5.1
"Eraser" = Eraser
"FIFA MANAGER 10" = FIFA MANAGER 10
"Fred Perry A07 v1" = Fred Perry A07 v1 Screen Saver
"FUSSBALL MANAGER 08" = FUSSBALL MANAGER 08
"FUSSBALL MANAGER 2002" = FUSSBALL MANAGER 2002
"HijackThis" = HijackThis 2.0.2
"HotspotShield" = Hotspot Shield 1.57
"JAP" = JAP
"JDownloader" = JDownloader
"KeyScrambler" = KeyScrambler
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"Mozilla Firefox 4.0b12 (x86 de)" = Mozilla Firefox 4.0b12 (x86 de)
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"PPLive" = PPLive 1.9
"Privoxy" = Privoxy 3.0.6
"Samsung ML-1660 Series" = Wartung Samsung ML-1660 Series
"Sandboxie" = Sandboxie 3.52
"SimpleScreenshot" = SimpleScreenshot 1.30
"SpywareBlaster_is1" = SpywareBlaster 4.4
"SynTPDeinstKey" = Dell Touchpad
"Tor" = Tor 0.1.2.19
"TrueCrypt" = TrueCrypt
"TVUPlayer" = TVUPlayer 2.4.7.2
"Veetle TV" = Veetle TV 0.9.18
"Vidalia" = Vidalia 0.0.16
"VLC media player" = VLC media player 1.1.3
"WinRAR archiver" = WinRAR
"winscp3_is1" = WinSCP 4.2.9
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
========== Last 10 Event Log Errors ==========
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
< End of report >
Nachdem ich die viren trojaner oder was auch immer gelöscht habe, ist eine erster Erfolg da, der Bildschirm ist nicht mehr schwarz und ich kann wieder einige datein sehen. Nur fehlen einige und die die ich sehen, wirken etwas durchsichtig von der Farbe und nicht so wie gewohnt. Weiters wird mir auch der Zugriff auf einige Datein verwehrt. Naja hoffe irgendjemand kann mir weiterhelfen und ich bekomme alle meine Datein zurück und den virus oder was auch immer wieder weg.  Mfg wolfgangk |
|
12.05.2011, 10:51
| #2 |
| /// Malware-holic   | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm hi, bist du nicht in der sandbox gesurft? du nutzt dieses programm ja wie ich sehe
__________________bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ |
|
12.05.2011, 16:27
| #3 | |
| | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirmZitat:
Danke erstmal für die schnelle Antwort und deine Hilfe. Leider verwende ich den PC nicht alleine und noch ein größeres leider surfen nicht alle, die ihn verwenden in der sandbox. hab jetzt mal ein logfile mit combofix erstellt. Combofix Logfile: Code:
ATTFilter ComboFix 11-05-11.04 - wolfgangk 12.05.2011 16:49:33.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.43.1031.18.2037.926 [GMT 2:00]
ausgeführt von:: c:\users\wolfgangk\Desktop\ComboFix.exe
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\sss
c:\program files\sss\licence.txt
c:\program files\sss\ReadMe.txt
c:\program files\sss\SimpleScreenshot.exe
c:\program files\sss\SimpleScreenshot.ini
c:\programme2\Setups2\Bwin\hotspot\Hotspot Shield\HssIE\HsSIe.dll
c:\users\wolfgangk\AppData\Roaming\Adobe\plugs
c:\users\wolfgangk\AppData\Roaming\Adobe\plugs\mmc1298645.txt
c:\users\wolfgangk\AppData\Roaming\Adobe\shed
c:\users\wolfgangk\AppData\Roaming\Adobe\shed\thr1.chm
.
Infizierte Kopie von c:\windows\system32\drivers\volsnap.sys wurde gefunden und desinfiziert
Kopie von - Kitty had a snack :p wurde wiederhergestellt
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-12 bis 2011-05-12 ))))))))))))))))))))))))))))))
.
.
2011-05-11 22:35 . 2011-05-11 22:35 -------- d-----w- c:\users\wolfgangk\AppData\Roaming\Malwarebytes
2011-05-11 22:35 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-11 22:35 . 2011-05-11 22:35 -------- d-----w- c:\programdata\Malwarebytes
2011-05-11 22:35 . 2011-05-11 22:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-11 21:22 . 2008-01-19 05:49 6144 ----a-w- c:\windows\system32\beep.sys
2011-05-11 14:48 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-05-10 12:50 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B22926D-C669-4DFE-B526-2396E4D6C828}\mpengine.dll
2011-04-26 23:17 . 2011-03-03 15:40 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-26 23:17 . 2011-03-03 13:35 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-26 23:17 . 2011-03-12 21:55 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-04-23 11:28 . 2011-04-23 11:28 -------- d--h--w- c:\users\wolfgangk\AppData\Local\DDMSettings
2011-04-21 21:50 . 2011-04-21 21:50 -------- d-----w- c:\program files\iPod
2011-04-21 21:50 . 2011-04-21 21:51 -------- d-----w- c:\program files\iTunes
2011-04-21 21:44 . 2011-04-21 21:44 -------- d-----w- c:\program files\Bonjour
2011-04-12 18:41 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-04-12 18:41 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-04-12 18:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-04-12 18:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-04-12 18:34 . 2011-02-22 13:24 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-04-12 18:34 . 2011-02-22 13:24 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-04-12 18:34 . 2011-02-22 13:23 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-12 18:34 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-04-12 18:33 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-12 18:33 . 2011-02-18 14:03 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-12 18:33 . 2011-02-18 14:03 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-12 18:32 . 2011-03-02 15:44 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-04-12 18:32 . 2009-05-04 09:59 25088 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-04-12 18:32 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-04-12 18:31 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\system32\dnssd.dll
2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\system32\dns-sd.exe
2011-03-03 15:40 . 2011-04-26 23:17 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-26 23:17 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-26 23:17 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-26 23:17 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-02-22 14:13 . 2011-03-22 18:05 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-02-22 13:33 . 2011-03-22 18:05 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-02-22 13:33 . 2011-03-22 18:05 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-02-18 15:36 . 2011-02-18 15:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2011-02-18 15:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-04-29 17:21 . 2011-03-23 00:21 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ---ha-w- c:\users\wolfgangk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ---ha-w- c:\users\wolfgangk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ---ha-w- c:\users\wolfgangk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2010-10-06 23:36 94208 ---ha-w- c:\users\wolfgangk\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Remote Control Editor"="c:\program files\Common Files\TerraTec\Remote\TTTvRc.exe" [2010-06-09 1689088]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-01-12 405736]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-28 857648]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-29 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-26 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-26 129560]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-08 3444736]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-11-01 189736]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 405504]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\ssmmgr.exe" [2010-06-07 618496]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-09-21 47904]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-14 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\users\wolfgangk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\wolfgangk\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-1-27 23361424]
OpenOffice.org 2.2.lnk - c:\program files\OpenOffice.org 2.2\program\quickstart.exe [2007-2-2 393216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-1-16 50688]
GlobeTrotter Connect.lnk - c:\program files\Option\GlobeTrotter Connect\GlobeTrotter Connect.exe [2007-5-10 724992]
Privoxy.lnk.disabled [2008-7-23 977]
QuickSet.lnk - c:\windows\Installer\{7F0C4457-8E64-491B-8D7B-991504365D1E}\NewShortcut2_53A01CC614B04512A2E710D39BF83DC4.exe [2008-1-16 45056]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Eraser"=c:\programme2\Eraser\Eraser.exe -hide
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
"Vidalia"="c:\program files\Vidalia Bundle\Vidalia\vidalia.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
"iTunesHelper"="c:\programme2\Programme\iTunes\iTunesHelper.exe"
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 HssWd;Hotspot Shield Monitoring Service;c:\programme2\Setups2\Bwin\hotspot\Hotspot Shield\bin\hsswd.exe [2010-10-15 326704]
R3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2011-02-20 73728]
R3 GTMNDISIRPXP;GT M 3G+ IRP NDIS;c:\windows\system32\DRIVERS\Gtm51Irp.sys [2007-01-15 122240]
R3 GTUQBUS;GT UQ BUS;c:\windows\system32\DRIVERS\gtuqbus.sys [2007-01-15 36992]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 pnetmdm;PdaNet Modem;c:\windows\system32\DRIVERS\pnetmdm.sys [2006-09-28 9472]
R3 s816bus;Sony Ericsson Device 816 driver (WDM);c:\windows\system32\DRIVERS\s816bus.sys [2007-06-19 81832]
R3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s816mdfl.sys [2007-06-19 13864]
R3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s816mdm.sys [2007-06-19 107304]
R3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s816mgmt.sys [2007-06-19 99112]
R3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);c:\windows\system32\DRIVERS\s816nd5.sys [2007-06-19 21928]
R3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s816obex.sys [2007-06-19 97320]
R3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);c:\windows\system32\DRIVERS\s816unic.sys [2007-06-19 97704]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-10 691696]
S1 HMFAxCore56d706f6725c732df006697fd5ec3381;HMFAxCore56d706f6725c732df006697fd5ec3381;c:\windows\system32\drivers\HMFAxCore56d706f6725c732df006697fd5ec3381.sys [2010-11-09 15872]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2011-03-19 2964312]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 GtFlashSwitch;GtFlashSwitch;c:\program files\Common Files\GtFlashSwitch\GtFlashSwitch.exe [2007-02-09 176128]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2008-01-28 810320]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2009-07-29 5120]
S3 IT9135BDA;Cinergy T Stick Mini service;c:\windows\system32\Drivers\IT9135BDA.sys [2010-05-26 100600]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys [2010-02-11 114952]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.ask.com?o=14978&l=dis
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000
FF - ProfilePath - c:\users\wolfgangk\AppData\Roaming\Mozilla\Firefox\Profiles\3nfx0x5g.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-05-12 17:05
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,25,59,48,d2,fe,63,fd,48,82,b0,ad,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,25,59,48,d2,fe,63,fd,48,82,b0,ad,\
.
[HKEY_USERS\S-1-5-21-1596820056-2852605572-1602728704-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-05-12 17:21:15
ComboFix-quarantined-files.txt 2011-05-12 15:21
.
Vor Suchlauf: 18 Verzeichnis(se), 33.840.857.088 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 33.417.347.072 Bytes frei
.
- - End Of File - - C4A38525E777A8490222A096A56706A8
|
|
12.05.2011, 16:44
| #4 |
| /// Malware-holic | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm dann solltest du dir ne lizen kaufen. 1. ist die lebenslang gültig und du kannst die auf jedem pc in deinem haushalt einsetzen. 2. kannst du unter erzwungener programm start dafür sorgen, dass alle browser immer in der sandbox laufen. machst du, um auf das problem zurück zu kommen, onlinebanking einkäufe oder sonst was wichtiges? privat oder beruflich, mit dem pc?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
12.05.2011, 19:49
| #5 | |
| | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirmZitat:
Gute Idee wußte ich nicht dass das geht. Ja wird alles per Pc gemacht. oje ich ahne wohin das hinausläuft. (Info: Desktop ist wieder halbwegs hergestellt, allerdings hab ich dort eine desktop ini datei die vorher nicht da war. (diese desktop ini datei findet sich auch in etlichen weiteren Ordnern), auch kann ich auf einige dateien nicht zugreifen. z.B. kann ich auf den ordner eigene Bilder nicht zugreifen, weiters fehlen in der taskleiste links alle symbole.) |
|
12.05.2011, 20:00
| #6 |
| /// Malware-holic | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm 1. du ahnst richtig. sorry für die schlechten nachichten. 2. onlinebanking muss gesperrt werden, grund tdss rootkit. 3. sichere deine daten, bilder dokumente instalationsdateien etc. keine keygens nichts aus filesharing. 4. formatiere den pc instaliere windows. ich erkläre dir wies geht falls nötig. 5. danach sollten wir das system absichern, man kann da mit relativ einfachen mitteln sehr viel machen. 6. danach passwörter endern, und zwar alle.
__________________ --> Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm |
|
13.05.2011, 00:42
| #7 | |
| | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirmZitat:
wird wohl oder übel nichts anderes übrig bleiben , habe soetwas noch nie gemacht würde also andere Varianten vorziehen aber wenn es sein muss einmal ist immer das erste Mal. 2) alles klar wird erledigt 3) mit Installationsdateien meinst du wahrscheinlich die exe.datein der programme die ich gerne wieder oben hätte nachdem ich ihn neu aufgesetzt habe oder? Kann man eigentlich Lesenzeichen beim firefox auch sichern? 4)ja würde bei dem Schritt wohl etwas mehr Hilfe benötigen, da ich wie schon gesagt noch nie einen Pc neuaufgesetzt habe. 5) bin sehr interessiert mehr zu erfahren 6) wird gemacht 7) Danke nochmal für die schnelle Hilfe |
|
13.05.2011, 10:38
| #8 |
| /// Malware-holic | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm hi, spybot ist nicht nötig. erst wird der pc abgesichert, dann werden die daten gescant, dann zurück kopiert :-) nutze dieses tool und sichere dann das backup: http://filepony.de/download-mozbackup/ so haben wir alles an lesezeichen etc. mach erst mal die datensicherung. nutzt du: - windows cd. - recovery cd - recovery laufwerk?
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.05.2011, 18:21
| #9 | |
| | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirmZitat:
danke für den Tipp mit dem Mozbackup tool. Werde übers Wochenende versuchen alle relevanten Datein zu sichern und backups zu machen. Hm, kann ich nicht wirklich beantworten die Frage: Also habe folgende CDs zuhause: 1)Betriebssystem DVD zur erneuten Installation von Windows Vista Home Basic 32 BIT 2) Drivers and Utilities P/N UP 315 Rev. A05 October 2007 3) Drivers and Utilities for Reinstalling Dell Webcam Manager 4) Appplication for Reinstalling Dell MediaDirect 3.5 5) roxio creator & MyDVD 9.0 De Wenn ich den PC schon neuaufsetze, dann will ich gleich allen unnötigen Ballast weglassen, war nämlich schon etwas langsam in letzter Zeit. mfg Wolfgang |
|
13.05.2011, 18:44
| #10 |
| /// Malware-holic | Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm 1)Betriebssystem DVD zur erneuten Installation von Windows Vista Home Basic 32 BIT wird benötigt. 2) Drivers and Utilities P/N UP 315 Rev. A05 October 2007 wird benötigt 3) Drivers and Utilities for Reinstalling Dell Webcam Manager falls du ne webcam nutzt 4) Appplication for Reinstalling Dell MediaDirect 3.5 5) roxio creator & MyDVD 9.0 De ist denke ich beides unnötig. aber falls nötig kann man ja nach instalieren.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Zuerst unzählige Trojaner-Warnungen dann Festplatte nicht erkannt, dann schwarzer bildschirm |
| alternate, antivir, avgntflt.sys, avira, bho, bildschirm, bonjour, document, downloader, ebay, emsisoft, emsisoft anti-malware, error, excel.exe, festplatte, festplatte nicht erkannt, firefox, flash player, google, groupon, hijack.zones, hijackthis, home, hotspot, hotspot shield, iexplore.exe, install.exe, jdownloader, location, logfile, microsoft office word, oldtimer, plug-in, problem, remote control, rogue.installer.gen, safer networking, scan, sched.exe, schwarzer bildschirm, searchplugins, security, senden, shell32.dll, software, sptd.sys, start menu, sttray.exe, svchost.exe, torrent.exe, trojan.fakealert.sa, trojaner, vista |
Hybrid-Darstellung
