Trojaner-Board - c:\Users\Name\AppData\Roaming\acroiehelpe050.dll

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - c:\Users\Name\AppData\Roaming\acroiehelpe050.dll (https://www.trojaner-board.de/105492-c-users-name-appdata-roaming-acroiehelpe050-dll.html)

c:\Users\Name\AppData\Roaming\acroiehelpe050.dll

Guten Abend liebe Community!

So mal zur Sache :/
mein Internet Explorer hat mir ständig Meldungen geliefert den Adope PDF Link Helper zu aktivieren. Anfangs hab ich die Angelegenheit mit deaktivieren abgetan. Glaub 2Tage danach hats mich genervt immer die selbe Meldung.

Hab mir das angeschaut und unbekanntes Zertifikat bei dem Add-On gefunden..bei Adope ! Hat mich stutzig gemacht und dann Malwarebytes gestartet und plötzlich hat auch Antivir was gefunden. Mit Mwbytes Löschung durchgeführt.

Hab leider auch ausversehen mal aktivieren gedrückt und gleich wieder deaktiviert, aber wahrscheinlich hat das, die Sache beschleunigt

Hab dann bisschen gelesen und wieder was Neues gelernt mit der Umgehung der Firewall (hab Zonealarm) durch Browserports (habs zumindest so grob verstanden).

Hab das Problem mit dem acroiehelpe050.dll hier im Forum auch schon bei anderen gelesen, aber man soll ja nen eigenen Thema aufmachen, da jedes System anders ist.

Am liebsten würde ich den Laptop neu aufsetzen nur momentan schreib ich eine Arbeit die fast fertig (natürlich alles 3fach gesichter) und will sie einfach schnell fertig kriegen. Wenn ich dann mehr Luft hab installier ich alles neu.

Weiß nicht ob das Stimmt aber laut OTL ist die Maleware erst seit 23.11 drauf ? Stimmt das oder hab ich das falsch verstanden mit den Datum. Hab auf einem andern PC der sicher ist meine wichtigen Passwörter(Bank,..) geändert. Hab eigentlich keine Passwörter per Hand eingegeben, da ich einen Fingerscanner hab und den benutze. Nur weiß ich nicht wie gut die Datenbank gesichert ist !?

Hab die Programme OTL und Gmer durchgeführt und die Logs angehängt, jedoch hab ich im nachhinein gesehen, dass ich den Defogger vergessen hab. Ich poste mal die Logs und wenn ichs nochmal mit Defogger machen soll, schreibt es mir dann mach ich es.

Momentan benutze ich den IE nicht mehr sondern Firefox, der von der Adope-Angelegenheit unberührt sein müsste.

Vielen Dank schon mal :)

Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:

Zitat:

"Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
- da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
- also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
Charakteristische Merkmale/Profilinformationen:
- aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
Die Systemprüfung und Bereinigung:
- kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
Innerhalb der Betreuungszeit:
- ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
Die Reihenfolge:
- genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
Ansonsten unsere Forumsregeln:
- Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?

Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)

► Erster Teil des 3-teiligen Verfahren, werden wir dein System auf Viren untersuchen, bzw nach einem anderen Verursacher suchen:
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Logs von Malwarebytes und Gmer bitte nochmal posten da ich aus irgendeinem Grund die Zipdatei nicht aufmachen kann

2.
erneut einen Systemscan mit OTL

Doppelklick auf die OTL.exe
Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
Unter Extra Registry, wähle bitte Use SafeList
Klicke nun auf Run Scan links oben
Wenn der Scan beendet wurde werden 2 Logfiles erstellt - OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

3.
Ich würde gerne noch all deine installierten Programme sehen:
Lade dir das Tool CCleaner herunter
→ Download
installieren (Software-Lizenzvereinbarung lesen, falls angeboten wird "Füge CCleaner Yahoo! Toolbar hinzu" abwählen)→ starten→ Sprache → Deutsch auswählen
dann klick auf "Extra (um die installierten Programme auch anzuzeigen)→ weiter auf "Als Textdatei speichern..."
wird eine Textdatei (*.txt) erstellt, kopiere dazu den Inhalt und füge ihn da ein

Zitat:

Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles, die Du posten möchtest)[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]

gruß
kira

Hallo Kira :)
erstmal danke für die Antwort.

Wie sieht es den mit dem Defogger aus. Soll ich das noch ausführen oder erstmal so belassen ?

Zuerst die Malewarebytes logs

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8251
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

27.11.2011 05:40:45

mbam-log-2011-11-27 (05-40-45).txt
 

Art des Suchlaufs: Flash-Scan

Durchsuchte Objekte: 123428

Laufzeit: 1 Minute(n), 35 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 4

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 2
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_CLASSES_ROOT\CLSID\{C689C99E-3A8C-4c87-A79C-C80DC9C81632} (Trojan.Passwords) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Passwords) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Passwords) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C689C99E-3A8C-4C87-A79C-C80DC9C81632} (Trojan.Passwords) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Userinit (Malware.Gen) -> Value: Userinit -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\K\AppData\Roaming\appconf32.exe (Malware.Gen) -> Delete on reboot.

c:\Users\K\AppData\Roaming\acroiehelpe050.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8251
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

27.11.2011 07:18:08

mbam-log-2011-11-27 (07-18-08).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|)

Durchsuchte Objekte: 310004

Laufzeit: 1 Stunde(n), 6 Minute(n), 4 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 14
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

c:\Users\K\AppData\LocalLow\Sun\Java\deployment\cache\6.0\49\5eca5a71-50b60265 (Malware.Gen) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5048\components\AcroFF5.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5048\components\AcroFF6.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5048\components\AcroFF7.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5048\components\AcroFF8.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5049\components\acroff0495.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5049\components\acroff0496.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5049\components\acroff0497.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5050\components\acroff049.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5050\components\acroff0495.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5050\components\acroff0496.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5050\components\acroff0497.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

c:\Users\K\AppData\Roaming\5050\components\acroff0498.dll (Trojan.Passwords) -> Quarantined and deleted successfully.

Code:

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org
 

Datenbank Version: 8253
 

Windows 6.1.7601 Service Pack 1

Internet Explorer 9.0.8112.16421
 

27.11.2011 20:21:43

mbam-log-2011-11-27 (20-21-43).txt
 

Art des Suchlaufs: Quick-Scan

Durchsuchte Objekte: 162934

Laufzeit: 6 Minute(n), 29 Sekunde(n)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Gmer

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2011-11-27 17:01:58

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 FUJITSU_ rev.0040

Running: yqn8s9rs.exe; Driver: C:\Users\K\AppData\Local\Temp\awddqpow.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwAlpcConnectPort [0x90AD4BBA]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwAlpcCreatePort [0x90AD548A]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwConnectPort [0x90AD4610]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateFile [0x90ACDE42]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateKey [0x90AEF760]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreatePort [0x90AD511A]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwCreateWaitablePort [0x90AD5278]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteFile [0x90ACEB7E]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteKey [0x90AF1212]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwDeleteValueKey [0x90AF0B06]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKey [0x90AF1BE0]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKey2 [0x90AF1E1E]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwLoadKeyEx [0x90AF22D0]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwOpenFile [0x90ACE730]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRenameKey [0x90AF2CB8]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwReplaceKey [0x90AF259A]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRequestWaitReplyPort [0x90AD41A4]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwRestoreKey [0x90AF371E]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetInformationFile [0x90ACEF8A]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetSecurityObject [0x90AF3242]

SSDT            \SystemRoot\system32\DRIVERS\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)      ZwSetValueKey [0x90AF0226]
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKey + 13D1                                                                                       83251349 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              8328AD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

.text           ntkrnlpa.exe!KeRemoveQueueEx + 10FF                                                                                 83291DB4 8 Bytes  [BA, 4B, AD, 90, 8A, 54, AD, ...] {MOV EDX, 0x8a90ad4b; PUSH ESP; LODSD ; NOP }

.text           ntkrnlpa.exe!KeRemoveQueueEx + 1193                                                                                 83291E48 4 Bytes  [10, 46, AD, 90] {ADC [ESI-0x53], AL; NOP }

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11AF                                                                                 83291E64 4 Bytes  [42, DE, AC, 90]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11BF                                                                                 83291E74 4 Bytes  [60, F7, AE, 90]

.text           ntkrnlpa.exe!KeRemoveQueueEx + 11DB                                                                                 83291E90 4 Bytes  [1A, 51, AD, 90] {SBB DL, [ECX-0x53]; NOP }

.text           ...                                                                                                                 

.text           sptd.sys                                                                                                            8B6A5000 8 Bytes  [8E, AA, 62, 83, A0, 87, 62, ...]

.text           sptd.sys                                                                                                            8B6A5009 23 Bytes  [87, 62, 83, 34, 22, 63, 83, ...]

.text           sptd.sys                                                                                                            8B6A5024 4 Bytes  [44, 15, 7D, 8B]

.text           sptd.sys                                                                                                            8B6A502C 96 Bytes  [85, B4, 3D, 83, D8, BE, 24, ...]

.text           sptd.sys                                                                                                            8B6A508D 91 Bytes  [F5, 24, 83, 15, A5, 24, 83, ...]

.text           ...                                                                                                                 

.sptd2          C:\Windows\System32\Drivers\sptd.sys                                                                                entry point in ".sptd2" section [0x8B77F0AD]

?               C:\Windows\System32\Drivers\sptd.sys                                                                                Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.

PAGE            PCIIDEX.SYS!DllUnload                                                                                               8B890606 5 Bytes  JMP 8662F1C8 

.text           USBPORT.SYS!DllUnload                                                                                               903D2DB9 5 Bytes  JMP 8771D1C8 
 

---- User code sections - GMER 1.0.15 ----
 

.text           C:\Program Files\Pando Networks\Media Booster\PMB.exe[3496] kernel32.dll!SetUnhandledExceptionFilter                75BDF4FB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
 

---- Devices - GMER 1.0.15 ----
 

Device          \FileSystem\Ntfs \Ntfs                                                                                              866351E8
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                             Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

Device          \Driver\usbuhci \Device\USBPDO-0                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBPDO-1                                                                                    8771E1E8

Device          \Driver\usbehci \Device\USBPDO-2                                                                                    8754D430

Device          \Driver\usbuhci \Device\USBPDO-3                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBPDO-4                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBPDO-5                                                                                    8771E1E8

Device          \Driver\usbehci \Device\USBPDO-6                                                                                    8754D430
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\cdrom \Device\CdRom0                                                                                        872BE1E8

Device          \Driver\PCI_PNP8261 \Device\00000065                                                                                sptd.sys

Device          \Driver\PCI_PNP8261 \Device\00000065                                                                                sptd.sys

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0                                                                         866321E8

Device          \Driver\iaStor \Device\Ide\iaStor0                                                                                  [8B961360] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\atapi \Device\Ide\IdePort0                                                                                  866321E8

Device          \Driver\atapi \Device\Ide\IdePort1                                                                                  866321E8

Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-0                                                                       [8B961360] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}

Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-1                                                                       [8B961360] \SystemRoot\system32\DRIVERS\iaStor.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
 

Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                             873561E8

Device          \Driver\ACPI_HAL \Device\0000005c                                                                                   halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

Device          \Driver\usbuhci \Device\USBFDO-0                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBFDO-1                                                                                    8771E1E8

Device          \Driver\usbehci \Device\USBFDO-2                                                                                    8754D430

Device          \Driver\usbuhci \Device\USBFDO-3                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBFDO-4                                                                                    8771E1E8

Device          \Driver\usbuhci \Device\USBFDO-5                                                                                    8771E1E8

Device          \Driver\usbehci \Device\USBFDO-6                                                                                    8754D430

Device          \Driver\an47dg26 \Device\Scsi\an47dg261                                                                             8757B430
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                  771343423

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                  285507792

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                  1

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 D:\Program Files\TOOLS\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0xE7 0xA1 0xA3 0x65 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0x4A 0x42 0xA5 0x3D ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x37 0x34 0x2D 0x98 ...

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                      

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x54 0x8C 0x01 0xC2 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     D:\Program Files\TOOLS\DAEMON Tools Lite\

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0xE7 0xA1 0xA3 0x65 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0x4A 0x42 0xA5 0x3D ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x37 0x34 0x2D 0x98 ...

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)  

Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x54 0x8C 0x01 0xC2 ...
 

---- EOF - GMER 1.0.15 ----

OTL

Code:

OTL logfile created on: 28.11.2011 16:24:35 - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,97 Gb Available Physical Memory | 65,75% Memory free

3,49 Gb Paging File | 2,21 Gb Available in Paging File | 63,37% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,98 Gb Free Space | 69,70% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,81 Gb Free Space | 72,58% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 40,72 Gb Free Space | 80,77% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - D:\Eigene Dateien\Desktop\Troja\2 OTL\OTL.exe (OldTimer Tools)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)

PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - D:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - D:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)

PRC - D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)

PRC - D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

PRC - D:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

PRC - C:\Program Files\Synaptics\SynTP\SynToshiba.exe (Synaptics, Inc.)

PRC - D:\Program Files\Protector Suite QL\upeksvr.exe (UPEK Inc.)

PRC - D:\Program Files\Protector Suite QL\psqltray.exe (UPEK Inc.)

PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)

PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - D:\Program Files\Mozilla Firefox\mozjs.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()

MOD - C:\Program Files\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()

MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()

MOD - C:\Windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll ()

MOD - C:\Windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll ()

MOD - C:\Windows\System32\CmdLineExt03.dll ()

MOD - D:\Program Files\TOOLS\WinRAR\RarExt.dll ()

MOD - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

OTL Extra

Code:

OTL Extras logfile created on: 28.11.2011 16:24:35 - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,97 Gb Available Physical Memory | 65,75% Memory free

3,49 Gb Paging File | 2,21 Gb Available in Paging File | 63,37% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,98 Gb Free Space | 69,70% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,81 Gb Free Space | 72,58% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 40,72 Gb Free Space | 80,77% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "D:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- D:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "D:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM

"{086A7D8C-0A38-4C7F-819A-620275550D5C}" = Nero Burning ROM Help

"{0D3CECCA-A589-ECCA-EC0B-2F98F2789F60}" = simfy

"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help

"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24

"{2CD82D77-8D1E-44FC-9A90-BBA95AC8D6B7}" = Protector Suite QL 5.8

"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00

"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode

"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent

"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking

"{56ABA277-EE53-4478-A607-FA42208FF5A9}" = Menu Templates - Pack 1

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{57250E78-F6E2-4DCE-9A84-50B28A70AB84}" = Menu Templates - Pack 3

"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress

"{59FDFDFB-52FE-45B1-8A2A-A00079B07FF0}" = TOSHIBA Power Saver Driver

"{5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}" = Nero Vision Help

"{5E08ECD1-C98E-4711-BF65-8FD736B3F969}" = Nero RescueAgent Help

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{60C731FB-C951-41CE-AD41-8E54C8594609}" = Nero Disc Copy Gadget Help

"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights

"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help

"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed

"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2

"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.0.2

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager

"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer

"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9AB8E6CE-CE6D-43A0-B54E-422425524FF9}" = Menu Templates - Pack 2

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor

"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver

"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR

"{AD6BC5CC-2EF0-49C4-B33D-CDC8B2C4DC80}" = Nero Recode Help

"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290

"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles

"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 280.26

"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit

"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX

"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help

"{CE96F5A5-584D-4F8F-AA3E-9BAED413DB72}" = Nero CoverDesigner Help

"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba

"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit

"{E7712E53-7A7F-46EB-AA13-70D5987D30F2}" = Dragon NaturallySpeaking 10

"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer

"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities

"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.149

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget

"{f2c66e86-48c1-4f1a-8dd0-e0e3aae13905}" = Nero 9

"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter

"{F425DD1D-0097-41C3-B545-B79E3D51100E}" = Movie Templates - Pack 1

"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool

"7-Zip" = 7-Zip 9.20

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"ArcSoft PhotoImpression 3.0" = ArcSoft PhotoImpression 3.0

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"B1F862B039A73DE1E30D300EFF63E1E3A4993FB1" = Windows Driver Package - Sony Ericsson Mobile Communications (ggsemc) USB  (04/01/2009 2.2.0.5)

"BCM70010" = Broadcom High Definition Video Decoder

"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.2.0.1304

"CCleaner" = CCleaner

"Citavi" = Citavi 2.5

"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58

"DAEMON Tools Lite" = DAEMON Tools Lite

"DivX Setup.divx.com" = DivX-Setup

"Drakensang_is1" = Drakensang

"Elsword_DE_is1" = Elsword_DE

"ENTERPRISE" = Microsoft Office Enterprise 2007

"ESET Online Scanner" = ESET Online Scanner v3

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"Free Download Manager_is1" = Free Download Manager 3.0

"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70

"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver

"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2

"Mozilla Firefox 6.0.1 (x86 de)" = Mozilla Firefox 6.0.1 (x86 de)

"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"PDF Password Remover v3.0_is1" = PDF Password Remover v3.0

"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.2

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.3 for Windows

"Simfy" = simfy

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"TOSHIBA Software Modem" = TOSHIBA Software Modem

"Visual-XSel 11.0" = Visual-XSel 11.0

"VLC media player" = VLC media player 1.1.7

"Winamp" = Winamp

"WinRAR archiver" = WinRAR

"ZoneAlarm" = ZoneAlarm

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 25.11.2011 05:31:36 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7601.17567,

 Zeitstempel: 0x4d6727a7  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00045d14  ID des fehlerhaften

 Prozesses: 0x4078  Startzeit der fehlerhaften Anwendung: 0x01ccab550541f880  Pfad der

 fehlerhaften Anwendung: C:\Windows\explorer.exe  Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll

Berichtskennung:

 446b5f8c-1748-11e1-b672-00040ec3a437

 

Error - 25.11.2011 10:04:08 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 26.11.2011 16:22:22 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,

 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0dcef306  ID des fehlerhaften

 Prozesses: 0x205c  Startzeit der fehlerhaften Anwendung: 0x01ccac7919400286  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:

 unknown  Berichtskennung: 58885b76-186c-11e1-af10-00040ec3a437

 

Error - 26.11.2011 21:48:06 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,

 Zeitstempel: 0x4d76255d  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000455a8  ID des fehlerhaften

 Prozesses: 0x2648  Startzeit der fehlerhaften Anwendung: 0x01ccaca69b1bc943  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe  Pfad des

 fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: d927e8f8-1899-11e1-af10-00040ec3a437

 

Error - 27.11.2011 00:15:59 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc6b7  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000455a8  ID des fehlerhaften

 Prozesses: 0x2088  Startzeit der fehlerhaften Anwendung: 0x01ccacbb441fcafb  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\DllHost.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 82503b87-18ae-11e1-af10-00040ec3a437

 

Error - 27.11.2011 10:51:11 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 27.11.2011 10:51:46 | Computer Name = Katana | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\spybot

 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "d:\program

 files\TOOLS\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des

 "language"-Attributs im assemblyIdentity-Element ist ungültig.

 

Error - 27.11.2011 10:51:54 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony

 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 27.11.2011 15:26:01 | Computer Name = Katana | Source = VSS | ID = 8194

Description = 

 

Error - 27.11.2011 15:33:54 | Computer Name = Katana | Source = Application Hang | ID = 1002

Description = Programm NOTEPAD.EXE, Version 6.1.7600.16385 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: d48    Startzeit: 01ccad3b720d8d4d    Endzeit: 0    Anwendungspfad: C:\Windows\system32\NOTEPAD.EXE
 

Berichts-ID:

 bc17fe5b-192e-11e1-ad59-00040ec3a437  

 

[ Cisco AnyConnect Secure Mobility Client Events ]

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp

Line:

 1024 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363

 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could

 not contact target 

 

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 860 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:

 192 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:32 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: URL::URL File: .\Utility\URL.cpp Line: 38 Invoked Function:

 URL::setURL Return Code: -28508150 (0xFE4D000A) Description: URL_ERROR_BAD_URL parameter=

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp

Line:

 254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780

 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp

Line:

 1194 Invoked Function: CSocketTransport::postConnectProcessing Return Code: -31522780

 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp

Line:

 1024 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363

 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could

 not contact target 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 860 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:44 | Computer Name = Katana | Source = acvpnagent | ID = 67110873

Description = Termination reason code 7: The agent has been stopped.

 

Error - 19.05.2011 11:29:14 | Computer Name = Katana | Source = acvpninstall | ID = 67108866

Description = Function: CInstalledManifestInfo::UpdateInstalledFileData File: ..\..\Downloader\ManifestInfo.cpp

Line:

 1736 Invoked Function: DeleteFile Return Code: 2 (0x00000002) Description: Das System

 kann die angegebene Datei nicht finden.   

 

[ OSession Events ]

Error - 26.09.2011 17:40:13 | Computer Name = Katana | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 

Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session 

lasted 2125 seconds with 2040 seconds of active time.  This session ended with a

 crash.

 

Error - 04.11.2011 22:11:19 | Computer Name = Katana | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 353

 seconds with 300 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 27.11.2011 09:29:09 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:29:09 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:29:09 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:30:28 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host"

 abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:30:55 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:49:38 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 09:49:53 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 10:23:04 | Computer Name = Katana | Source = Service Control Manager | ID = 7001

Description = Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location

 Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:   %%1068

 

Error - 27.11.2011 10:25:35 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 27.11.2011 12:07:35 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

 

< End of report >

CClean

Code:

7-Zip 9.20                26.11.2011                

Adobe AIR        Adobe Systems Incorporated        11.10.2011                3.0.0.4080

Adobe Flash Player 10 ActiveX        Adobe Systems Incorporated        30.06.2011        6,00MB        10.3.181.26

Adobe Flash Player 10 Plugin        Adobe Systems Incorporated        02.03.2011        6,00MB        10.2.152.32

Adobe Reader X (10.1.0) - Deutsch        Adobe Systems Incorporated        15.06.2011        165,3MB        10.1.0

ALPS Touch Pad Driver        ALPS ELECTRIC CO., LTD        07.02.2011                7.0.301.4

ArcSoft PhotoImpression 3.0                08.02.2011                

Auslogics Disk Defrag        Auslogics Software Pty Ltd        07.02.2011        9,16MB        version 3.1

Avira AntiVir Personal - Free Antivirus        Avira GmbH        16.10.2011        67,7MB        10.2.0.704

Bluetooth Stack for Windows by Toshiba        TOSHIBA CORPORATION        07.02.2011        68,5MB        v8.00.02(T)

Broadcom High Definition Video Decoder        Broadcom Corporation        07.02.2011                

Bullzip PDF Printer 7.2.0.1304        Bullzip        07.07.2011        6,41MB        7.2.0.1304

Camera Assistant Software for Toshiba        Chicony Electronics Co.,Ltd.        07.02.2011                1.7.140.0517

CCleaner        Piriform        17.08.2011                3.09

Cisco Systems VPN Client 5.0.07.0290        Cisco Systems, Inc.        22.11.2011        11,6MB        5.0.6

Citavi 2.5        Academic Software Zurich        02.06.2011                2.5.2.0

ClipGrab 3.1.0.2        Philipp Schmieder Medien        26.09.2011        42,0MB        

CPUID CPU-Z 1.58                17.08.2011        2,85MB        

DAEMON Tools Lite        DT Soft Ltd        08.02.2011                4.40.2.0131

DHTML Editing Component        Microsoft Corporation        30.06.2011        0,54MB        6.02.0001

DivX-Setup        DivX, LLC        05.06.2011                2.5.0.11

Dragon NaturallySpeaking 10        Nuance Communications Inc.        08.05.2011        2.000MB        10.10.0

Drakensang        dtp        07.04.2011                

Dropbox        Dropbox, Inc.        26.11.2011                1.2.48

Elsword_DE                18.08.2011        1.278MB        

Emdedded IR Driver        Compal Electronics, Inc.        07.02.2011        0,88MB        0.0.0.6C

ESET Online Scanner v3                26.11.2011                

EVEREST Home Edition v2.20        Lavalys Inc        12.08.2011                2.20

Free Download Manager 3.0        FreeDownloadManager.ORG        08.02.2011                

GPL Ghostscript Lite 8.70                07.07.2011        12,8MB        

Intel(R) Matrix Storage Manager        Intel Corporation        08.02.2011                

Java(TM) 6 Update 24        Oracle        14.04.2011        96,9MB        6.0.240

Malwarebytes' Anti-Malware Version 1.51.2.1300        Malwarebytes Corporation        26.11.2011        13,8MB        1.51.2.1300

Microsoft .NET Framework 1.1                08.08.2011                

Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        08.02.2011        38,8MB        4.0.30319

Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        08.02.2011        2,94MB        4.0.30319

Microsoft IntelliPoint 8.2        Microsoft Corporation        10.08.2011                8.20.468.0

Microsoft Office Enterprise 2007        Microsoft Corporation        08.02.2011                12.0.6425.1000

Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        08.08.2011        2,38MB        8.0.56336

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        27.05.2011        0,23MB        9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        07.02.2011        0,58MB        9.0.30729.4148

Mozilla Firefox 6.0.1 (x86 de)        Mozilla        11.09.2011        35,4MB        6.0.1

Mozilla Firefox 8.0.1 (x86 de)        Mozilla        26.11.2011        53,9MB        8.0.1

MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        10.02.2011        35,00KB        4.20.9870.0

MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        10.02.2011        1,33MB        4.20.9876.0

Nero 9        Nero AG        09.02.2011                

NVIDIA 3D Vision Controller-Treiber 280.19        NVIDIA Corporation        17.08.2011                280.19

NVIDIA 3D Vision Treiber 280.26        NVIDIA Corporation        17.08.2011                280.26

NVIDIA Grafiktreiber 280.26        NVIDIA Corporation        17.08.2011                280.26

PDF Password Remover v3.0        VeryPDF.com Inc        16.02.2011                

PDF-Viewer        Tracker Software Products Ltd        09.03.2011        14,7MB        2.5.193.0

phonostar-Player Version 3.02.2                14.08.2011                

Protector Suite QL 5.8        UPEK Inc.        07.02.2011        56,0MB        5.8.0.4024

Realtek High Definition Audio Driver        Realtek Semiconductor Corp.        01.03.2011                6.0.1.6299

RedMon - Redirection Port Monitor                09.02.2011                

SecureW2 EAP Suite 1.1.3 for Windows                19.04.2011                

simfy        simfy GmbH        11.10.2011                1.5.2

Skype™ 5.3        Skype Technologies S.A.        06.08.2011        16,6MB        5.3.120

Sony Ericsson PC Companion 2.01.149        Sony Ericsson        12.05.2011        16,9MB        2.01.149

Sony Ericsson PC Suite 4.010.00        Sony Ericsson        12.05.2011                4.010.00

Spybot - Search & Destroy        Safer Networking Limited        25.02.2011                1.6.2

Synaptics Pointing Device Driver        Synaptics        08.02.2011                11.1.18.0

System Requirements Lab                29.05.2011                

Texas Instruments PCIxx21/x515/xx12 drivers.        Ihr Firmenname        08.02.2011        0,91MB        2.00.0001

TOSHIBA Flash Cards Support Utility        TOSHIBA        07.02.2011        20,00KB        1.48.0.3C

TOSHIBA SD Memory Utilities        TOSHIBA        07.02.2011        1,61MB        1.8.1.1

TOSHIBA Software Modem        Agere Systems        07.02.2011                2.1.77 (SM2177ALD03)

Turbo Lister 2        eBay Inc.        30.06.2011        77,3MB        2.00.0000

Visual C++ Runtime for Dragon NaturallySpeaking        Nuance Communications Inc.        08.05.2011        1,16MB        10.00.200.184

Visual-XSel 11.0                07.03.2011                

VLC media player 1.1.7        VideoLAN        08.02.2011                1.1.7

Winamp        Nullsoft, Inc        09.02.2011                5.601 

Windows Driver Package - Sony Ericsson Mobile Communications (ggsemc) USB  (04/01/2009 2.2.0.5)        Sony Ericsson Mobile Communications        14.04.2011                04/01/2009 2.2.0.5

WinRAR                09.02.2011                

ZoneAlarm        Check Point, Inc        09.03.2011                9.2.105.000

1.
ja, wegen DAEMON Tools das Tool Defogger ausführen

2.

Zitat:

Spybot

- würde ich nicht mehr empfehlen, da erfüllt nicht die neue Schutzanforderungen und Lösungen Schutz vor Malware bzw gegenüber ganz neuen Herausforderungen arbeitet nicht zufriedenstellend
meiner Meinung nach bietet nicht mehr ausreichenden Schutz gegen "moderne Malwarearten"...
► Falls Du doch es behalten möchtest und TeaTimer aktiviert:
Stelle bitte den TeaTimer ab:
Gehe bei Spybot-S&D in den Erweiterten Modus und wähle dort Werkzeuge -> Resident.
Deaktiviere hier den "Resident TeaTimer aktiv".
(Tea Timer versucht positive änderungen auch zu blockieren) - soll für immer deaktiviert bleiben!

3.
nicht vollständig gepostet, versuche bitte es nochmal:

Zitat:

OTL logfile created on: 28.11.2011 16:24:35 - Run 2

Hi :)

1) Ok, hab Defogger ausgeführt. Ergab folgenden Bericht:

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 15:07 on 29/11/2011 (K)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...

Unable to read sptd.sys

SPTD -> Disabled (Service running -> reboot required)
 
 

-=E.O.F=-

2) Wusst ich nicht danke. Hab Spybot deinstalliert.

3) Sorry, hab ich wohl versehentlich abgeschnitten.

OTL Logfile

Code:

OTL logfile created on: 28.11.2011 16:24:35 - Run 2

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,97 Gb Available Physical Memory | 65,75% Memory free

3,49 Gb Paging File | 2,21 Gb Available in Paging File | 63,37% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,98 Gb Free Space | 69,70% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,81 Gb Free Space | 72,58% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 40,72 Gb Free Space | 80,77% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - D:\Eigene Dateien\Desktop\Troja\2 OTL\OTL.exe (OldTimer Tools)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)

PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - D:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - D:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)

PRC - D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)

PRC - D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

PRC - D:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

PRC - C:\Program Files\Synaptics\SynTP\SynToshiba.exe (Synaptics, Inc.)

PRC - D:\Program Files\Protector Suite QL\upeksvr.exe (UPEK Inc.)

PRC - D:\Program Files\Protector Suite QL\psqltray.exe (UPEK Inc.)

PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)

PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - D:\Program Files\Mozilla Firefox\mozjs.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()

MOD - C:\Program Files\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll ()

MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()

MOD - C:\Windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll ()

MOD - C:\Windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll ()

MOD - C:\Windows\System32\CmdLineExt03.dll ()

MOD - D:\Program Files\TOOLS\WinRAR\RarExt.dll ()

MOD - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (MBAMService) -- D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (AntiVirService) -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- D:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)

SRV - (Sony Ericsson PCCompanion) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)

SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)

SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

SRV - (Microsoft Office Groove Audit Service) -- D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)

SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)

DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys ()

DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)

DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)

DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)

DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)

DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)

DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)

DRV - (cpuz135) -- C:\Windows\System32\drivers\cpuz135_x32.sys (CPUID)

DRV - (NETwLv32)     Intel(R) -- C:\Windows\System32\drivers\NETwLv32.sys (Intel Corporation)

DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)

DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)

DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)

DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)

DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)

DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)

DRV - (Serial) -- C:\Windows\system32\DRIVERS\serial.sys (Brother Industries Ltd.)

DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)

DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)

DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation)

DRV - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation)

DRV - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation)

DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation)

DRV - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation)

DRV - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation)

DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation)

DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)

DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)

DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)

DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)

DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)

DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)

DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)

DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)

DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)

DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)

DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)

DRV - (athrusb6) -- C:\Windows\System32\drivers\athru6.sys (Atheros Communications, Inc.)

DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)

DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)

DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)

DRV - (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\Windows\System32\drivers\ZD1211U.sys (ZyDAS Technology Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = D:\Eigene Dateien\Desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AA D1 A3 0F E7 C7 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: browserprotect@browserprotect.com:1.1.2

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\html5video [2011.02.28 23:22:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\wpa [2011.02.28 23:22:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\K\AppData\Roaming\5050 [2011.11.25 20:11:08 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

 

[2011.02.09 04:56:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (WOT) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2011.02.09 05:27:12 | 000,000,000 | ---D | M] (Premium Proxy Switcher) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\premiumproxyswitcher@freeproxylist.org

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\BROWSERPROTECT@BROWSERPROTECT.COM.XPI

 

O1 HOSTS File: ([2011.11.17 20:16:29 | 000,438,702 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1        www.007guard.com

O1 - Hosts: 127.0.0.1        007guard.com

O1 - Hosts: 127.0.0.1        008i.com

O1 - Hosts: 127.0.0.1        www.008k.com

O1 - Hosts: 127.0.0.1        008k.com

O1 - Hosts: 127.0.0.1        www.00hq.com

O1 - Hosts: 127.0.0.1        00hq.com

O1 - Hosts: 127.0.0.1        010402.com

O1 - Hosts: 127.0.0.1        www.032439.com

O1 - Hosts: 127.0.0.1        032439.com

O1 - Hosts: 127.0.0.1        www.0scan.com

O1 - Hosts: 127.0.0.1        0scan.com

O1 - Hosts: 127.0.0.1        1000gratisproben.com

O1 - Hosts: 127.0.0.1        www.1000gratisproben.com

O1 - Hosts: 127.0.0.1        1001namen.com

O1 - Hosts: 127.0.0.1        www.1001namen.com

O1 - Hosts: 127.0.0.1        100888290cs.com

O1 - Hosts: 127.0.0.1        www.100888290cs.com

O1 - Hosts: 127.0.0.1        www.100sexlinks.com

O1 - Hosts: 127.0.0.1        100sexlinks.com

O1 - Hosts: 127.0.0.1        10sek.com

O1 - Hosts: 127.0.0.1        www.10sek.com

O1 - Hosts: 127.0.0.1        www.1-2005-search.com

O1 - Hosts: 127.0.0.1        1-2005-search.com

O1 - Hosts: 127.0.0.1        123fporn.info

O1 - Hosts: 15087 more lines...

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll ()

O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PSQLLauncher] D:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)

O4 - HKLM..\Run: [ZoneAlarm Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)

O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\K\AppData\Local\Akamai\netsession_win.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1

O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()

O8 - Extra context menu item: Alles mit FDM herunterladen - D:\Program Files\Free Download Manager\dlall.htm ()

O8 - Extra context menu item: Auswahl mit FDM herunterladen - D:\Program Files\Free Download Manager\dlselected.htm ()

O8 - Extra context menu item: Datei mit FDM herunterladen - D:\Program Files\Free Download Manager\dllink.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Videos mit FDM herunterladen - D:\Program Files\Free Download Manager\dlfvideo.htm ()

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: hypovereinsbank.de ([my] https in Trusted sites)

O15 - HKCU\..Trusted Domains: tum.de ([www.elearning] https in Trusted sites)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.16.0.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0165495-4BE7-416D-9ED3-F06BE58221C1}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9D397C7-984B-44AA-9B9D-E18F058A9584}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\Windows\System32\vrlogon.dll (UPEK Inc.)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.27 21:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.11.27 17:14:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011.11.27 15:54:10 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Desktop\Troja

[2011.11.27 05:35:56 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Malwarebytes

[2011.11.27 05:35:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.27 05:35:26 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.11.25 20:11:08 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5050

[2011.11.25 20:11:05 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\f3Ìi

[2011.11.24 13:14:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5049

[2011.11.24 13:10:28 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\UAs

[2011.11.23 22:06:03 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5048

[2011.11.23 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\xmldm

[2011.11.23 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\kock

[2011.11.23 00:54:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Systems VPN Client

[2011.11.23 00:52:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Deterministic Networks

[2011.11.10 15:40:41 | 002,341,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011.11.04 02:58:38 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Kroll-Software

[2011.11.04 02:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InterReg

[2006.12.12 10:13:20 | 000,032,768 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\EBLib.dll

[2006.07.28 15:25:26 | 000,019,456 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\LPCFilter.sys

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.28 16:10:55 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.28 16:10:54 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.28 16:07:05 | 000,668,144 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.11.28 16:07:05 | 000,627,680 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.11.28 16:07:05 | 000,135,780 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.11.28 16:07:05 | 000,111,258 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.11.28 16:02:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.11.28 16:02:19 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.27 05:35:31 | 000,000,859 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.27 05:24:06 | 000,000,034 | ---- | M] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.27 01:55:07 | 000,000,925 | ---- | M] () -- D:\Eigene Dateien\Desktop\Dropbox.lnk

[2011.11.23 14:54:02 | 000,000,498 | RHS- | M] () -- C:\ProgramData\ntuser.pol

[2011.11.23 00:55:00 | 000,001,593 | ---- | M] () -- C:\Windows\VPNInstall.MIF

[2011.11.23 00:54:29 | 000,002,641 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.17 20:16:29 | 000,438,702 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2011.11.15 19:48:22 | 000,056,577 | ---- | M] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.11.10 19:30:06 | 000,415,688 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.11.04 21:55:58 | 301,380,617 | ---- | M] () -- C:\Windows\MEMORY.DMP

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.11.27 05:35:31 | 000,000,859 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.23 22:05:57 | 000,000,034 | ---- | C] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.23 00:54:29 | 000,002,641 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.23 00:52:37 | 000,001,593 | ---- | C] () -- C:\Windows\VPNInstall.MIF

[2011.11.15 19:47:37 | 000,056,577 | ---- | C] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.08.13 20:18:16 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll

[2011.08.13 20:18:16 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe

[2011.08.09 21:52:16 | 000,000,089 | ---- | C] () -- C:\Users\K\AppData\Local\fusioncache.dat

[2011.08.09 17:02:58 | 000,000,498 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.05.09 19:03:33 | 000,001,475 | ---- | C] () -- C:\Users\K\AppData\Roaming\SAS7_000.DAT

[2011.03.30 01:33:38 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2011.02.28 20:20:28 | 000,000,055 | ---- | C] () -- C:\Windows\wininit.ini

[2011.02.24 01:08:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.02.17 19:11:21 | 000,000,075 | ---- | C] () -- C:\Windows\winDecrypt.INI

[2011.02.10 17:31:09 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2011.02.10 17:31:09 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat

[2011.02.09 00:06:32 | 000,001,220 | ---- | C] () -- C:\Windows\photoimpression.ini

[2011.02.08 23:16:49 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini

[2011.02.08 23:16:49 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll

[2011.02.08 23:16:49 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini

[2011.02.08 23:16:49 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini

[2010.12.29 03:45:54 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010.03.23 13:26:48 | 000,201,512 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2009.07.14 09:47:43 | 000,668,144 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 09:47:43 | 000,135,780 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 05:33:53 | 000,415,688 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,627,680 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,111,258 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.04.30 23:31:10 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe

[2009.04.30 23:31:08 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvappbar.exe

[2009.04.30 23:31:06 | 001,724,416 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll

[2009.04.30 23:31:06 | 001,507,328 | ---- | C] () -- C:\Windows\System32\nview.dll

[2009.04.30 23:31:06 | 001,101,824 | ---- | C] () -- C:\Windows\System32\nvwimg.dll

[2009.04.30 23:31:06 | 000,466,944 | ---- | C] () -- C:\Windows\System32\nvshell.dll

[2009.04.30 21:02:00 | 001,579,630 | ---- | C] () -- C:\Windows\System32\nvdata.bin

[2007.07.02 08:16:20 | 000,028,672 | ---- | C] () -- C:\Windows\System32\TPeculiarity.dll

[2006.03.09 00:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.10.18 02:04:00 | 000,097,388 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:F35A93AD
 

< End of report >

1.
Hast Du zur Zone Vertrauenswürdige Sites absichtlich hinzugefügt?:

Zitat:

O15 - HKCU\..Trusted Domains: hypovereinsbank.de ([my] https in Trusted sites)
O15 - HKCU\..Trusted Domains: tum.de ([www.elearning] https in Trusted sites)

2.
Java aktualisieren
Deine Javaversion ist nicht aktuell.
Downloade nun die Offline-Version von Java Version 6 Update 29 von Oracle und installiere sie. Achte darauf, eventuell angebotene Toolbars nicht mitzuinstallieren, also während der Installation den Haken bei der Toolbar entfernen.

3.
MBR mit aswMBR von Avast prüfen

Lade aswMBR.exe von Avast herunter und speichere das Tool auf deinem Desktop (nicht woanders hin).
XP Benutzer: Doppelklick auf die aswMBR.exe, um das Tool zu starten.
Vista und Windows 7 Benutzer: Rechtsklick auf die aswMBR.exe und Als Administrator starten wählen.
Es wird sich ein Eingabe-Fenster mit einigen Angaben öffnen.

Klicke Scan, um den Suchlauf zu starten.

Wenn der Scan beendet ist, was mit Scan finished sucessfull! gemeldet wird, klicke Save log, um das Logfile zu speichern.
Poste mir den Inhalt von aswASW.log vom Desktop hier in den Thread.

4.

Zitat:

Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)

Fixen mit OTL

Starte die OTL.exe.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Kopiere folgendes Skript:

Code:

:OTL

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.

[2011.11.25 20:11:08 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5050

[2011.11.25 20:11:05 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\f3Ìi

[2011.11.24 13:14:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5049

[2011.11.24 13:10:28 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\UAs

[2011.11.23 22:06:03 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\5048

[2011.11.23 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\xmldm

[2011.11.23 22:05:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\kock

@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:F35A93AD
 

:Commands

[purity]

[emptytemp]

[resethosts]

und füge es hier ein: http://image.hijackthis.eu/upload/hjt1-021.jpg
Schließe alle Programme.
Klicke auf den Fix Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
OTL verlangt einen Neustart. Bitte zulassen.
Nach dem Neustart findest Du ein Textdokument.
Kopiere den Inhalt hier in Deinen Thread.

5.
reinige dein System mit Ccleaner:

"Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

6.
erneut einen Scan mit OTL:

Doppelklick auf die OTL.exe
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Oben findest Du ein Kästchen mit Ausgabe.
Wähle bitte Standard-Ausgabe
Unter Extra-Registrierung wähle bitte Benutze SafeList.
Mache Häckchen bei LOP- und Purity-Prüfung.
Klicke nun auf Scan links oben.
Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
Poste die Logfiles in Code-Tags hier in den Thread.

1)
Ja die hab ich als vertrauenswürdig hinzugefügt. Sind Uni-Seiten. Kann ich aber auch löschen.

2)
erledigt

3) Hab die Log unter D:\_OTL\MovedFiles gefunden mit den verschobenen Files. Soll ich die dann später per Hand löschen ?

Code:

 All processes killed

========== OTL ==========

HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.

C:\Users\K\AppData\Roaming\5050\components folder moved successfully.

C:\Users\K\AppData\Roaming\5050 folder moved successfully.

C:\Users\K\AppData\Roaming\f3Ìi folder moved successfully.

C:\Users\K\AppData\Roaming\5049\components folder moved successfully.

C:\Users\K\AppData\Roaming\5049 folder moved successfully.

C:\Users\K\AppData\Roaming\UAs folder moved successfully.

C:\Users\K\AppData\Roaming\5048\components folder moved successfully.

C:\Users\K\AppData\Roaming\5048 folder moved successfully.

C:\Users\K\AppData\Roaming\xmldm folder moved successfully.

C:\Users\K\AppData\Roaming\kock folder moved successfully.

ADS C:\ProgramData\TEMP:F35A93AD deleted successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Flash cache emptied: 56475 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: K

->Temp folder emptied: 1581070998 bytes

->Java cache emptied: 2094147 bytes

->FireFox cache emptied: 44218956 bytes

->Flash cache emptied: 57877 bytes

 

User: Public

 

User: Troy

->Temp folder emptied: 1333525 bytes

->FireFox cache emptied: 17275603 bytes

->Flash cache emptied: 56931 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 200704 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1849056 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 1.572,00 mb

 

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

OTL by OldTimer - Version 3.2.31.0 log created on 11302011_114025

4)
Hab den CCleaner geupdatet und erledigt
(Resultat siehe Anhang)

5)
OTL hat mir nur einen Bericht geliefert !?

Code:

OTL logfile created on: 30.11.2011 12:05:05 - Run 3

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 2,06 Gb Available Physical Memory | 68,64% Memory free

3,49 Gb Paging File | 2,30 Gb Available in Paging File | 66,01% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,83 Gb Free Space | 69,50% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,55 Gb Free Space | 71,82% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 42,01 Gb Free Space | 83,32% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - D:\Eigene Dateien\Desktop\Troja\2 OTL\OTL.exe (OldTimer Tools)

PRC - D:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)

PRC - D:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)

PRC - C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe (Check Point Software Technologies)

PRC - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

PRC - D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

PRC - C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)

PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

PRC - D:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

PRC - D:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)

PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

PRC - D:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

PRC - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

PRC - C:\Program Files\Synaptics\SynTP\SynToshiba.exe (Synaptics, Inc.)

PRC - D:\Program Files\Protector Suite QL\upeksvr.exe (UPEK Inc.)

PRC - D:\Program Files\Protector Suite QL\psqltray.exe (UPEK Inc.)

PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)

PRC - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

 

 
 ========== Modules (No Company Name) ==========

 

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll ()

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll ()

MOD - C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll ()

MOD - C:\Windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll ()

MOD - C:\Windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll ()

MOD - C:\Windows\System32\CmdLineExt03.dll ()

MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()

MOD - D:\Program Files\TOOLS\WinRAR\RarExt.dll ()

MOD - C:\Windows\System32\nvshell.dll ()

MOD - C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (vsmon) -- D:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe (Check Point Software Technologies LTD)

SRV - (IswSvc) -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe (Check Point Software Technologies)

SRV - (MBAMService) -- D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)

SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)

SRV - (AntiVirService) -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)

SRV - (AntiVirSchedulerService) -- D:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (Sony Ericsson PCCompanion) -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe (Avanquest Software)

SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)

SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)

SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)

SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)

SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)

SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (IAANTMON) Intel(R) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)

SRV - (Microsoft Office Groove Audit Service) -- D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe (Microsoft Corporation)

SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (ISWKL) -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys (Check Point Software Technologies)

DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)

DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)

DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)

DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys (Duplex Secure Ltd.)

DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)

DRV - (tosrfbd) -- C:\Windows\System32\drivers\tosrfbd.sys (TOSHIBA CORPORATION)

DRV - (Tosrfusb) -- C:\Windows\System32\drivers\tosrfusb.sys (TOSHIBA CORPORATION)

DRV - (Tosrfcom) -- C:\Windows\System32\drivers\tosrfcom.sys (TOSHIBA Corporation)

DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)

DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)

DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)

DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)

DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)

DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)

DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)

DRV - (tosrfbnp) -- C:\Windows\System32\drivers\tosrfbnp.sys (TOSHIBA Corporation)

DRV - (cpuz135) -- C:\Windows\System32\drivers\cpuz135_x32.sys (CPUID)

DRV - (NETwLv32)     Intel(R) -- C:\Windows\System32\drivers\NETwLv32.sys (Intel Corporation)

DRV - (Tosrfhid) -- C:\Windows\System32\drivers\Tosrfhid.sys (TOSHIBA Corporation.)

DRV - (tosrfec) -- C:\Windows\System32\drivers\tosrfec.sys (TOSHIBA Corporation)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (TosRfSnd) -- C:\Windows\System32\drivers\TosRfSnd.sys (TOSHIBA Corporation)

DRV - (CVPNDRVA) -- C:\Windows\System32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)

DRV - (tosrfnds) -- C:\Windows\System32\drivers\tosrfnds.sys (TOSHIBA Corporation.)

DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)

DRV - (Serial) -- C:\Windows\system32\DRIVERS\serial.sys (Brother Industries Ltd.)

DRV - (tosporte) -- C:\Windows\System32\drivers\tosporte.sys (TOSHIBA Corporation)

DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation)

DRV - (s1018mdm) -- C:\Windows\System32\drivers\s1018mdm.sys (MCCI Corporation)

DRV - (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM) -- C:\Windows\System32\drivers\s1018unic.sys (MCCI Corporation)

DRV - (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s1018mgmt.sys (MCCI Corporation)

DRV - (s1018obex) -- C:\Windows\System32\drivers\s1018obex.sys (MCCI Corporation)

DRV - (s1018bus) Sony Ericsson Device 1018 driver (WDM) -- C:\Windows\System32\drivers\s1018bus.sys (MCCI Corporation)

DRV - (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS) -- C:\Windows\System32\drivers\s1018nd5.sys (MCCI Corporation)

DRV - (s1018mdfl) -- C:\Windows\System32\drivers\s1018mdfl.sys (MCCI Corporation)

DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.)

DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)

DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)

DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)

DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)

DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)

DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)

DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)

DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)

DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)

DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)

DRV - (athrusb6) -- C:\Windows\System32\drivers\athru6.sys (Atheros Communications, Inc.)

DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)

DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)

DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.)

DRV - (FWLANUSB) -- C:\Windows\System32\drivers\fwlanusb.sys (AVM GmbH)

DRV - (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS) -- C:\Windows\System32\drivers\ZD1211U.sys (ZyDAS Technology Corporation)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = D:\Eigene Dateien\Desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AA D1 A3 0F E7 C7 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: browserprotect@browserprotect.com:1.1.2

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\html5video [2011.02.28 23:22:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\wpa [2011.02.28 23:22:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.11.29 15:00:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\K\AppData\Roaming\5050

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

 

[2011.02.09 04:56:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (WOT) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2011.02.09 05:27:12 | 000,000,000 | ---D | M] (Premium Proxy Switcher) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\premiumproxyswitcher@freeproxylist.org

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\BROWSERPROTECT@BROWSERPROTECT.COM.XPI

 

O1 HOSTS File: ([2011.11.30 11:40:43 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll ()

O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)

O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PSQLLauncher] D:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)

O4 - HKLM..\Run: [ZoneAlarm] D:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)

O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\K\AppData\Local\Akamai\netsession_win.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1

O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()

O8 - Extra context menu item: Alles mit FDM herunterladen - D:\Program Files\Free Download Manager\dlall.htm ()

O8 - Extra context menu item: Auswahl mit FDM herunterladen - D:\Program Files\Free Download Manager\dlselected.htm ()

O8 - Extra context menu item: Datei mit FDM herunterladen - D:\Program Files\Free Download Manager\dllink.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Videos mit FDM herunterladen - D:\Program Files\Free Download Manager\dlfvideo.htm ()

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: hypovereinsbank.de ([my] https in Trusted sites)

O15 - HKCU\..Trusted Domains: tum.de ([www.elearning] https in Trusted sites)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.16.0.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0165495-4BE7-416D-9ED3-F06BE58221C1}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9D397C7-984B-44AA-9B9D-E18F058A9584}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\Windows\System32\vrlogon.dll (UPEK Inc.)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.30 11:50:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.11.30 11:05:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011.11.30 11:02:12 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.11.30 11:02:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.11.30 11:02:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.11.29 15:01:26 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs

[2011.11.29 15:00:47 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Documents\ForceField Shared Files

[2011.11.29 15:00:41 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\CheckPoint

[2011.11.29 15:00:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point

[2011.11.29 14:52:29 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint

[2011.11.27 21:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.11.27 17:14:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011.11.27 15:54:10 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Desktop\Troja

[2011.11.27 05:35:56 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Malwarebytes

[2011.11.27 05:35:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.27 05:35:26 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.11.23 00:54:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Systems VPN Client

[2011.11.23 00:52:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Deterministic Networks

[2011.11.10 15:40:41 | 002,341,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011.11.04 02:58:38 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Kroll-Software

[2011.11.04 02:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InterReg

[2006.12.12 10:13:20 | 000,032,768 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\EBLib.dll

[2006.07.28 15:25:26 | 000,019,456 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\LPCFilter.sys

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.30 11:50:22 | 000,000,931 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.11.30 11:49:43 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.30 11:49:42 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.30 11:41:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.11.30 11:41:49 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.30 11:40:43 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2011.11.30 11:34:19 | 000,000,512 | ---- | M] () -- D:\Eigene Dateien\Desktop\MBR.dat

[2011.11.30 11:01:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll

[2011.11.30 11:01:56 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.11.30 11:01:56 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.11.30 11:01:56 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.11.29 23:08:49 | 000,668,144 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.11.29 23:08:49 | 000,627,680 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.11.29 23:08:49 | 000,135,780 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.11.29 23:08:49 | 000,111,258 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.11.29 15:08:34 | 000,000,020 | ---- | M] () -- C:\Users\K\defogger_reenable

[2011.11.29 15:01:35 | 000,415,915 | ---- | M] () -- C:\Windows\System32\drivers\vsconfig.xml

[2011.11.27 05:35:31 | 000,000,859 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.27 05:24:06 | 000,000,034 | ---- | M] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.27 01:55:07 | 000,000,925 | ---- | M] () -- D:\Eigene Dateien\Desktop\Dropbox.lnk

[2011.11.23 14:54:02 | 000,000,498 | RHS- | M] () -- C:\ProgramData\ntuser.pol

[2011.11.23 00:55:00 | 000,001,593 | ---- | M] () -- C:\Windows\VPNInstall.MIF

[2011.11.23 00:54:29 | 000,002,641 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.15 19:48:22 | 000,056,577 | ---- | M] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.11.10 19:30:06 | 000,415,688 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.11.30 11:50:22 | 000,000,931 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.11.30 11:34:19 | 000,000,512 | ---- | C] () -- D:\Eigene Dateien\Desktop\MBR.dat

[2011.11.29 15:07:59 | 000,000,020 | ---- | C] () -- C:\Users\K\defogger_reenable

[2011.11.29 15:01:05 | 000,415,915 | ---- | C] () -- C:\Windows\System32\drivers\vsconfig.xml

[2011.11.27 05:35:31 | 000,000,859 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.23 22:05:57 | 000,000,034 | ---- | C] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.23 00:54:29 | 000,002,641 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.23 00:52:37 | 000,001,593 | ---- | C] () -- C:\Windows\VPNInstall.MIF

[2011.11.15 19:47:37 | 000,056,577 | ---- | C] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.08.13 20:18:16 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll

[2011.08.13 20:18:16 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe

[2011.08.09 21:52:16 | 000,000,089 | ---- | C] () -- C:\Users\K\AppData\Local\fusioncache.dat

[2011.08.09 17:02:58 | 000,000,498 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.05.09 19:03:33 | 000,001,475 | ---- | C] () -- C:\Users\K\AppData\Roaming\SAS7_000.DAT

[2011.03.30 01:33:38 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2011.02.28 20:20:28 | 000,000,055 | ---- | C] () -- C:\Windows\wininit.ini

[2011.02.24 01:08:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.02.17 19:11:21 | 000,000,075 | ---- | C] () -- C:\Windows\winDecrypt.INI

[2011.02.10 17:31:09 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2011.02.10 17:31:09 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat

[2011.02.09 00:06:32 | 000,001,220 | ---- | C] () -- C:\Windows\photoimpression.ini

[2011.02.08 23:16:49 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini

[2011.02.08 23:16:49 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll

[2011.02.08 23:16:49 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini

[2011.02.08 23:16:49 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini

[2010.12.29 03:45:54 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010.03.23 13:26:48 | 000,201,512 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2009.07.14 09:47:43 | 000,668,144 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 09:47:43 | 000,135,780 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 05:33:53 | 000,415,688 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,627,680 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,111,258 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.04.30 23:31:10 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe

[2009.04.30 23:31:08 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvappbar.exe

[2009.04.30 23:31:06 | 001,724,416 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll

[2009.04.30 23:31:06 | 001,507,328 | ---- | C] () -- C:\Windows\System32\nview.dll

[2009.04.30 23:31:06 | 001,101,824 | ---- | C] () -- C:\Windows\System32\nvwimg.dll

[2009.04.30 23:31:06 | 000,466,944 | ---- | C] () -- C:\Windows\System32\nvshell.dll

[2009.04.30 21:02:00 | 001,579,630 | ---- | C] () -- C:\Windows\System32\nvdata.bin

[2007.07.02 08:16:20 | 000,028,672 | ---- | C] () -- C:\Windows\System32\TPeculiarity.dll

[2006.03.09 00:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.10.18 02:04:00 | 000,097,388 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin

 
 ========== LOP Check ==========

 

[2011.06.03 22:14:54 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Academic Software Zurich

[2011.08.26 14:59:35 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Audio Recorder for Free

[2011.02.21 03:00:56 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Audio Recorder for Free 2010

[2011.02.08 22:57:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Auslogics

[2011.11.29 15:00:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\CheckPoint

[2011.11.30 11:53:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\DAEMON Tools Lite

[2011.11.29 23:13:39 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Dropbox

[2011.02.09 13:00:55 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Fingerfox (SE)

[2011.11.30 11:53:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Free Download Manager

[2011.11.04 02:58:38 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Kroll-Software

[2011.05.09 17:41:10 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Nuance

[2011.07.08 03:07:29 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\PDF Writer

[2011.02.14 15:59:00 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\phonostar GmbH

[2011.10.12 19:31:40 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Simfy

[2011.08.02 22:15:35 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\TeamViewer

[2011.05.30 14:15:53 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\toshiba

[2011.10.25 12:35:39 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

Mein Fehler, hab bei der falschen Option savelist überprüft.

OTL

Code:

OTL logfile created on: 30.11.2011 16:17:13 - Run 4

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,98 Gb Available Physical Memory | 66,11% Memory free

3,49 Gb Paging File | 2,17 Gb Available in Paging File | 62,25% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,70 Gb Free Space | 69,32% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,55 Gb Free Space | 71,82% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 42,01 Gb Free Space | 83,32% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.11.27 19:54:33 | 000,924,632 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2011.11.27 15:56:19 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Eigene Dateien\Desktop\Troja\2 OTL\OTL.exe

PRC - [2011.11.09 20:05:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) -- D:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe

PRC - [2011.11.09 20:01:38 | 000,073,360 | ---- | M] (Check Point Software Technologies LTD) -- D:\Program Files\CheckPoint\ZoneAlarm\zatray.exe

PRC - [2011.11.03 15:44:28 | 000,497,280 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ISWSVC.exe

PRC - [2011.11.03 15:44:24 | 000,738,944 | ---- | M] (Check Point Software Technologies) -- C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe

PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe

PRC - [2011.08.03 12:50:00 | 000,812,648 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

PRC - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2011.07.03 20:35:20 | 000,269,480 | ---- | M] (Avira GmbH) -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011.05.01 21:09:14 | 000,136,360 | ---- | M] (Avira GmbH) -- D:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2011.01.10 14:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- D:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

PRC - [2010.01.14 21:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- D:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2009.06.04 19:03:32 | 000,186,904 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

PRC - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe

PRC - [2008.06.20 07:14:00 | 000,200,704 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynToshiba.exe

PRC - [2007.11.14 12:08:48 | 000,027,400 | ---- | M] (UPEK Inc.) -- D:\Program Files\Protector Suite QL\upeksvr.exe

PRC - [2007.11.14 11:43:58 | 000,054,024 | ---- | M] (UPEK Inc.) -- D:\Program Files\Protector Suite QL\psqltray.exe

PRC - [2007.09.19 13:06:02 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2006.11.06 17:14:44 | 000,034,352 | ---- | M] () -- C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2011.11.27 19:54:32 | 001,989,592 | ---- | M] () -- D:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2011.10.12 14:56:09 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll

MOD - [2011.10.12 14:55:38 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll

MOD - [2011.10.12 14:55:32 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll

MOD - [2011.10.12 14:55:22 | 007,963,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll

MOD - [2011.10.12 14:55:11 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll

MOD - [2011.08.03 02:31:28 | 000,255,592 | ---- | M] () -- C:\Program Files\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll

MOD - [2011.06.03 22:05:57 | 008,007,680 | ---- | M] () -- C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll

MOD - [2011.06.03 22:05:56 | 000,126,976 | ---- | M] () -- C:\Windows\assembly\GAC\Interop.SHDocVw\1.1.0.0__4b827ebe229d539f\Interop.SHDocVw.dll

MOD - [2011.06.03 22:05:49 | 000,281,088 | ---- | M] () -- C:\Windows\assembly\GAC_32\Asz.Citavi.IEPicker\1.0.0.0__f59eabe05cc67589\Asz.Citavi.IEPicker.dll

MOD - [2011.03.30 01:33:38 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll

MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- D:\Program Files\TOOLS\WinRAR\RarExt.dll

MOD - [2006.11.06 17:14:44 | 000,034,352 | ---- | M] () -- C:\Program Files\TOSHIBA\Utilities\KeNotify.exe

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.11.09 20:05:42 | 002,420,616 | ---- | M] (Check Point Software Technologies LTD) [Auto | Running] -- D:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe -- (vsmon)

SRV - [2011.11.03 15:44:28 | 000,497,280 | ---- | M] (Check Point Software Technologies) [Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe -- (IswSvc)

SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2011.08.03 02:31:42 | 000,379,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2011.07.03 20:35:20 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- D:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011.05.01 21:09:14 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- D:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2011.02.10 14:29:24 | 000,150,528 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)

SRV - [2010.04.12 10:46:00 | 000,152,944 | ---- | M] (TOSHIBA CORPORATION) [On_Demand | Stopped] -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)

SRV - [2010.03.23 13:19:32 | 001,528,616 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe -- (CVPND)

SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)

SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009.06.04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)

SRV - [2008.10.25 11:44:08 | 000,065,888 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)

SRV - [2007.09.19 13:06:02 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.11.03 15:44:20 | 000,027,016 | ---- | M] (Check Point Software Technologies) [Kernel | Auto | Running] -- C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys -- (ISWKL)

DRV - [2011.08.31 17:00:50 | 000,022,216 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2011.08.03 12:50:00 | 010,304,104 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2011.07.03 20:35:20 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2011.07.03 20:35:20 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2011.05.07 17:51:28 | 000,455,256 | ---- | M] (Check Point Software Technologies LTD) [Kernel | System | Running] -- C:\Windows\System32\drivers\vsdatant.sys -- (Vsdatant)

DRV - [2011.04.15 14:42:49 | 000,025,512 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggsemc.sys -- (ggsemc)

DRV - [2011.04.15 14:42:49 | 000,013,224 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ggflt.sys -- (ggflt)

DRV - [2011.02.09 13:20:50 | 000,431,672 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)

DRV - [2011.02.09 03:45:48 | 000,290,304 | ---- | M] (Texas Instruments) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tifm21.sys -- (tifm21)

DRV - [2010.12.12 00:08:40 | 000,234,800 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)

DRV - [2010.12.02 19:29:00 | 000,056,760 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)

DRV - [2010.11.29 11:47:00 | 000,070,448 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)

DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus)

DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt)

DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc)

DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)

DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap)

DRV - [2010.11.11 10:26:00 | 000,042,672 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)

DRV - [2010.11.09 14:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)

DRV - [2010.10.07 13:11:37 | 006,639,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETwLv32.sys -- (NETwLv32)     Intel(R)

DRV - [2010.08.30 10:48:00 | 000,080,064 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)

DRV - [2010.06.18 16:44:00 | 000,015,160 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec)

DRV - [2010.06.17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010.04.26 11:48:00 | 000,053,760 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)

DRV - [2010.03.23 13:15:36 | 000,308,859 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\CVPNDRVA.sys -- (CVPNDRVA)

DRV - [2009.07.24 11:31:00 | 000,021,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)

DRV - [2009.07.14 01:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)

DRV - [2009.07.14 00:45:33 | 000,083,456 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\serial.sys -- (Serial)

DRV - [2009.06.17 11:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)

DRV - [2009.05.28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5v32.sys -- (netw5v32) Intel(R)

DRV - [2009.03.25 16:48:00 | 000,114,728 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdm.sys -- (s1018mdm)

DRV - [2009.03.25 16:48:00 | 000,109,864 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018unic.sys -- (s1018unic) Sony Ericsson Device 1018 USB Ethernet Emulation (WDM)

DRV - [2009.03.25 16:48:00 | 000,106,208 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mgmt.sys -- (s1018mgmt) Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM)

DRV - [2009.03.25 16:48:00 | 000,104,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018obex.sys -- (s1018obex)

DRV - [2009.03.25 16:48:00 | 000,086,824 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018bus.sys -- (s1018bus) Sony Ericsson Device 1018 driver (WDM)

DRV - [2009.03.25 16:48:00 | 000,026,024 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018nd5.sys -- (s1018nd5) Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS)

DRV - [2009.03.25 16:48:00 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s1018mdfl.sys -- (s1018mdfl)

DRV - [2008.11.16 18:39:44 | 000,131,984 | ---- | M] (Deterministic Networks, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dne2000.sys -- (DNE)

DRV - [2008.05.16 11:33:14 | 000,115,752 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016unic.sys -- (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM)

DRV - [2008.05.16 11:33:14 | 000,025,512 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016nd5.sys -- (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS)

DRV - [2008.05.16 11:33:14 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdfl.sys -- (s0016mdfl)

DRV - [2008.05.16 11:33:12 | 000,120,744 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mdm.sys -- (s0016mdm)

DRV - [2008.05.16 11:33:12 | 000,114,216 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016mgmt.sys -- (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM)

DRV - [2008.05.16 11:33:12 | 000,110,632 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016obex.sys -- (s0016obex)

DRV - [2008.05.16 11:33:12 | 000,089,256 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\s0016bus.sys -- (s0016bus) Sony Ericsson Device 0016 driver (WDM)

DRV - [2008.01.09 10:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\seehcri.sys -- (seehcri)

DRV - [2007.11.09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS -- (TVALZ)

DRV - [2007.09.19 13:05:58 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2007.08.01 18:05:58 | 000,871,936 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\athru6.sys -- (athrusb6)

DRV - [2007.04.17 19:49:46 | 000,140,800 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService)

DRV - [2007.04.16 10:19:10 | 000,011,776 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR)

DRV - [2007.01.18 20:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CVirtA.sys -- (CVirtA)

DRV - [2005.10.18 02:04:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)

DRV - [2004.07.05 15:38:06 | 000,233,472 | ---- | M] (ZyDAS Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZD1211U.sys -- (ZD1211U(ZyDAS)) ZyDAS ZD1211 IEEE 802.11b+g Wireless LAN Driver (USB)(ZyDAS)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default Download Directory = D:\Eigene Dateien\Desktop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = AA D1 A3 0F E7 C7 CB 01  [binary data]

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6

FF - prefs.js..extensions.enabledItems: browserprotect@browserprotect.com:1.1.2

FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@checkpoint.com/FFApi: C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\npFFApi.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files\TOOLS\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\html5video [2011.02.28 23:22:50 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: D:\Program Files\TOOLS\DivX\DivX Plus Web Player\firefox\wpa [2011.02.28 23:22:51 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\TrustChecker [2011.11.29 15:00:39 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\K\AppData\Roaming\5050

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2011.11.27 19:54:33 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2011.11.27 20:36:42 | 000,000,000 | ---D | M]

 

[2011.02.09 04:56:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions

[2011.11.27 22:21:17 | 000,000,000 | ---D | M] (WOT) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

[2011.02.09 05:27:12 | 000,000,000 | ---D | M] (Premium Proxy Switcher) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\3x9i81qz.default\extensions\premiumproxyswitcher@freeproxylist.org

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

() (No name found) -- C:\USERS\K\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3X9I81QZ.DEFAULT\EXTENSIONS\BROWSERPROTECT@BROWSERPROTECT.COM.XPI

 

O1 HOSTS File: ([2011.11.30 11:40:43 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - D:\Program Files\TOOLS\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O2 - BHO: (ZoneAlarm Security Engine Registrar) - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O2 - BHO: (FDMIECookiesBHO Class) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Program Files\Free Download Manager\iefdm2.dll ()

O3 - HKLM\..\Toolbar: (ZoneAlarm Security Engine) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\Trustchecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)

O4 - HKLM..\Run: [avgnt] D:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)

O4 - HKLM..\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Check Point Software Technologies)

O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)

O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] D:\Program Files\TOOLS\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [PSQLLauncher] D:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)

O4 - HKLM..\Run: [ZoneAlarm] D:\Program Files\CheckPoint\ZoneAlarm\zatray.exe (Check Point Software Technologies LTD)

O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\K\AppData\Local\Akamai\netsession_win.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1

O8 - Extra context menu item: &Citavi Picker... - C:\Program Files\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html ()

O8 - Extra context menu item: Alles mit FDM herunterladen - D:\Program Files\Free Download Manager\dlall.htm ()

O8 - Extra context menu item: Auswahl mit FDM herunterladen - D:\Program Files\Free Download Manager\dlselected.htm ()

O8 - Extra context menu item: Datei mit FDM herunterladen - D:\Program Files\Free Download Manager\dllink.htm ()

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O8 - Extra context menu item: Videos mit FDM herunterladen - D:\Program Files\Free Download Manager\dlfvideo.htm ()

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O13 - gopher Prefix: missing

O15 - HKCU\..Trusted Domains: hypovereinsbank.de ([my] https in Trusted sites)

O15 - HKCU\..Trusted Domains: tum.de ([www.elearning] https in Trusted sites)

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class)

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)

O16 - DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.4.16.0.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0165495-4BE7-416D-9ED3-F06BE58221C1}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D9D397C7-984B-44AA-9B9D-E18F058A9584}: DhcpNameServer = 192.168.178.1

O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) -C:\Windows\System32\vrlogon.dll (UPEK Inc.)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - Winlogon\Notify\psfus: DllName - (C:\Windows\system32\psqlpwd.dll) - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.11.30 11:50:21 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2011.11.30 11:05:32 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2011.11.30 11:02:12 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.11.30 11:02:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.11.30 11:02:12 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.11.29 15:01:26 | 000,000,000 | ---D | C] -- C:\Windows\Internet Logs

[2011.11.29 15:00:47 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Documents\ForceField Shared Files

[2011.11.29 15:00:41 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\CheckPoint

[2011.11.29 15:00:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Check Point

[2011.11.29 14:52:29 | 000,000,000 | ---D | C] -- C:\Program Files\CheckPoint

[2011.11.27 21:49:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip

[2011.11.27 17:14:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET

[2011.11.27 15:54:10 | 000,000,000 | ---D | C] -- D:\Eigene Dateien\Desktop\Troja

[2011.11.27 05:35:56 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Malwarebytes

[2011.11.27 05:35:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.11.27 05:35:26 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.11.23 00:54:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco Systems VPN Client

[2011.11.23 00:52:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Deterministic Networks

[2011.11.10 15:40:41 | 002,341,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys

[2011.11.04 02:58:38 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Kroll-Software

[2011.11.04 02:58:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InterReg

[2006.12.12 10:13:20 | 000,032,768 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\EBLib.dll

[2006.07.28 15:25:26 | 000,019,456 | ---- | C] (COMPAL ELECTRONIC INC.) -- C:\ProgramData\LPCFilter.sys

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.11.30 15:45:33 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.11.30 15:45:33 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.11.30 15:37:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.11.30 15:37:17 | 2414,682,112 | -HS- | M] () -- C:\hiberfil.sys

[2011.11.30 11:50:22 | 000,000,931 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.11.30 11:40:43 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2011.11.30 11:34:19 | 000,000,512 | ---- | M] () -- D:\Eigene Dateien\Desktop\MBR.dat

[2011.11.30 11:01:56 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll

[2011.11.30 11:01:56 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe

[2011.11.30 11:01:56 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe

[2011.11.30 11:01:56 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe

[2011.11.29 23:08:49 | 000,668,144 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.11.29 23:08:49 | 000,627,680 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.11.29 23:08:49 | 000,135,780 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.11.29 23:08:49 | 000,111,258 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.11.29 15:08:34 | 000,000,020 | ---- | M] () -- C:\Users\K\defogger_reenable

[2011.11.29 15:01:35 | 000,415,915 | ---- | M] () -- C:\Windows\System32\drivers\vsconfig.xml

[2011.11.27 05:35:31 | 000,000,859 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.27 05:24:06 | 000,000,034 | ---- | M] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.27 01:55:07 | 000,000,925 | ---- | M] () -- D:\Eigene Dateien\Desktop\Dropbox.lnk

[2011.11.23 14:54:02 | 000,000,498 | RHS- | M] () -- C:\ProgramData\ntuser.pol

[2011.11.23 00:55:00 | 000,001,593 | ---- | M] () -- C:\Windows\VPNInstall.MIF

[2011.11.23 00:54:29 | 000,002,641 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.15 19:48:22 | 000,056,577 | ---- | M] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.11.10 19:30:06 | 000,415,688 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[4 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]

[1 C:\Users\K\AppData\Roaming\*.tmp files -> C:\Users\K\AppData\Roaming\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.11.30 11:50:22 | 000,000,931 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.11.30 11:34:19 | 000,000,512 | ---- | C] () -- D:\Eigene Dateien\Desktop\MBR.dat

[2011.11.29 15:07:59 | 000,000,020 | ---- | C] () -- C:\Users\K\defogger_reenable

[2011.11.29 15:01:05 | 000,415,915 | ---- | C] () -- C:\Windows\System32\drivers\vsconfig.xml

[2011.11.27 05:35:31 | 000,000,859 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.11.23 22:05:57 | 000,000,034 | ---- | C] () -- C:\Users\K\AppData\Roaming\blckdom.res

[2011.11.23 00:54:29 | 000,002,641 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk

[2011.11.23 00:52:37 | 000,001,593 | ---- | C] () -- C:\Windows\VPNInstall.MIF

[2011.11.15 19:47:37 | 000,056,577 | ---- | C] () -- D:\Eigene Dateien\Desktop\MHI.pdf

[2011.08.13 20:18:16 | 000,028,672 | ---- | C] () -- C:\Windows\System32\InsDrvZD.dll

[2011.08.13 20:18:16 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ZyDelReg.exe

[2011.08.09 21:52:16 | 000,000,089 | ---- | C] () -- C:\Users\K\AppData\Local\fusioncache.dat

[2011.08.09 17:02:58 | 000,000,498 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2011.08.03 02:31:54 | 000,311,912 | ---- | C] () -- C:\Windows\System32\nvStreaming.exe

[2011.05.09 19:03:33 | 000,001,475 | ---- | C] () -- C:\Users\K\AppData\Roaming\SAS7_000.DAT

[2011.03.30 01:33:38 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll

[2011.02.28 20:20:28 | 000,000,055 | ---- | C] () -- C:\Windows\wininit.ini

[2011.02.24 01:08:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe

[2011.02.17 19:11:21 | 000,000,075 | ---- | C] () -- C:\Windows\winDecrypt.INI

[2011.02.10 17:31:09 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll

[2011.02.10 17:31:09 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ3.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ2.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ1.dat

[2011.02.09 02:22:51 | 000,000,176 | ---- | C] () -- C:\Windows\System32\drivers\RTHDAEQ0.dat

[2011.02.09 00:06:32 | 000,001,220 | ---- | C] () -- C:\Windows\photoimpression.ini

[2011.02.08 23:16:49 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini

[2011.02.08 23:16:49 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll

[2011.02.08 23:16:49 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini

[2011.02.08 23:16:49 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini

[2010.12.29 03:45:54 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010.03.23 13:26:48 | 000,201,512 | ---- | C] () -- C:\Windows\System32\vpnapi.dll

[2009.07.14 09:47:43 | 000,668,144 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2009.07.14 09:47:43 | 000,135,780 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2009.07.14 05:33:53 | 000,415,688 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2009.07.14 03:05:48 | 000,627,680 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2009.07.14 03:05:48 | 000,111,258 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2009.04.30 23:31:10 | 001,657,376 | ---- | C] () -- C:\Windows\System32\nwiz.exe

[2009.04.30 23:31:08 | 000,449,056 | ---- | C] () -- C:\Windows\System32\nvappbar.exe

[2009.04.30 23:31:06 | 001,724,416 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll

[2009.04.30 23:31:06 | 001,507,328 | ---- | C] () -- C:\Windows\System32\nview.dll

[2009.04.30 23:31:06 | 001,101,824 | ---- | C] () -- C:\Windows\System32\nvwimg.dll

[2009.04.30 23:31:06 | 000,466,944 | ---- | C] () -- C:\Windows\System32\nvshell.dll

[2009.04.30 21:02:00 | 001,579,630 | ---- | C] () -- C:\Windows\System32\nvdata.bin

[2007.07.02 08:16:20 | 000,028,672 | ---- | C] () -- C:\Windows\System32\TPeculiarity.dll

[2006.03.09 00:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.10.18 02:04:00 | 000,097,388 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin

 
 ========== LOP Check ==========

 

[2011.06.03 22:14:54 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Academic Software Zurich

[2011.08.26 14:59:35 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Audio Recorder for Free

[2011.02.21 03:00:56 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Audio Recorder for Free 2010

[2011.02.08 22:57:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Auslogics

[2011.11.29 15:00:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\CheckPoint

[2011.11.30 11:53:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\DAEMON Tools Lite

[2011.11.29 23:13:39 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Dropbox

[2011.02.09 13:00:55 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Fingerfox (SE)

[2011.11.30 11:53:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Free Download Manager

[2011.11.04 02:58:38 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Kroll-Software

[2011.05.09 17:41:10 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Nuance

[2011.07.08 03:07:29 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\PDF Writer

[2011.02.14 15:59:00 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\phonostar GmbH

[2011.10.12 19:31:40 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Simfy

[2011.08.02 22:15:35 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\TeamViewer

[2011.05.30 14:15:53 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\toshiba

[2011.10.25 12:35:39 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 
 

< End of report >

OTL Extra

Code:

OTL Extras logfile created on: 30.11.2011 16:17:13 - Run 4

OTL by OldTimer - Version 3.2.31.0     Folder = D:\Eigene Dateien\Desktop\Troja\2 OTL

 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

3,00 Gb Total Physical Memory | 1,98 Gb Available Physical Memory | 66,11% Memory free

3,49 Gb Paging File | 2,17 Gb Available in Paging File | 62,25% Paging File free

Paging file location(s): c:\pagefile.sys 500 6000 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 74,58 Gb Total Space | 51,70 Gb Free Space | 69,32% Space Free | Partition Type: NTFS

Drive D: | 34,18 Gb Total Space | 24,55 Gb Free Space | 71,82% Space Free | Partition Type: NTFS

Drive E: | 40,29 Gb Total Space | 29,88 Gb Free Space | 74,15% Space Free | Partition Type: NTFS

Drive F: | 48,83 Gb Total Space | 48,71 Gb Free Space | 99,77% Space Free | Partition Type: NTFS

Drive G: | 49,80 Gb Total Space | 40,08 Gb Free Space | 80,48% Space Free | Partition Type: NTFS

Drive H: | 50,42 Gb Total Space | 42,01 Gb Free Space | 83,32% Space Free | Partition Type: NTFS

 

Computer Name: KATANA | User Name: K | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- D:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "D:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [AddToPlaylistVLC] -- "D:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- D:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Directory [PlayWithVLC] -- "D:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()

Directory [Winamp.Bookmark] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)

Directory [Winamp.Enqueue] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)

Directory [Winamp.Play] -- "D:\Program Files\TOOLS\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 0

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM

"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime

"{086A7D8C-0A38-4C7F-819A-620275550D5C}" = Nero Burning ROM Help

"{0D3CECCA-A589-ECCA-EC0B-2F98F2789F60}" = simfy

"{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{20400DBD-E6DB-45B8-9B6B-1DD7033818EC}" = Nero InfoTool Help

"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29

"{2B120B1D-1908-4FB3-8C9D-72128A74E80A}" = ZoneAlarm Security

"{2CD82D77-8D1E-44FC-9A90-BBA95AC8D6B7}" = Protector Suite QL 5.8

"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component

"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00

"{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode

"{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent

"{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking

"{56ABA277-EE53-4478-A607-FA42208FF5A9}" = Menu Templates - Pack 1

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{57250E78-F6E2-4DCE-9A84-50B28A70AB84}" = Menu Templates - Pack 3

"{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress

"{59FDFDFB-52FE-45B1-8A2A-A00079B07FF0}" = TOSHIBA Power Saver Driver

"{5D9BE3C1-8BA4-4E7E-82FD-9F74FA6815D1}" = Nero Vision Help

"{5E08ECD1-C98E-4711-BF65-8FD736B3F969}" = Nero RescueAgent Help

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{60C731FB-C951-41CE-AD41-8E54C8594609}" = Nero Disc Copy Gadget Help

"{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights

"{83202942-84B3-4C50-8622-B8C0AA2D2885}" = Nero Express Help

"{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed

"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2

"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.0.2

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager

"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer

"{942E5031-2BD6-4C1B-918C-C8A1CBAE7B8C}" = Microsoft IntelliPoint 8.2

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9AB8E6CE-CE6D-43A0-B54E-422425524FF9}" = Menu Templates - Pack 2

"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver

"{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor

"{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1" = PDF-Viewer

"{A386CC19-1E79-4D4C-A54B-C8747871E4AD}" = ZoneAlarm Firewall

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver

"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress

"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.0) - Deutsch

"{ACEB2BAF-96DF-48FD-ADD5-43842D4C443D}" = Adobe AIR

"{AD6BC5CC-2EF0-49C4-B33D-CDC8B2C4DC80}" = Nero Recode Help

"{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}" = Cisco Systems VPN Client 5.0.07.0290

"{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles

"{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 280.26

"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19

"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application

"{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit

"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX

"{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CC019E3F-59D2-4486-8D4B-878105B62A71}" = Nero DiscSpeed Help

"{CE96F5A5-584D-4F8F-AA3E-9BAED413DB72}" = Nero CoverDesigner Help

"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba

"{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM

"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3

"{DB780B85-B4B5-4864-A49C-9B706B169C93}" = TIPCI

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit

"{E7712E53-7A7F-46EB-AA13-70D5987D30F2}" = Dragon NaturallySpeaking 10

"{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer

"{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities

"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony Ericsson PC Companion 2.01.149

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F1861F30-3419-44DB-B2A1-C274825698B3}" = Nero Disc Copy Gadget

"{f2c66e86-48c1-4f1a-8dd0-e0e3aae13905}" = Nero 9

"{F4041DCE-3FE1-4E18-8A9E-9DE65231EE36}" = Nero ControlCenter

"{F425DD1D-0097-41C3-B545-B79E3D51100E}" = Movie Templates - Pack 1

"{F6BDD7C5-89ED-4569-9318-469AA9732572}" = Nero BurnRights Help

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool

"7-Zip" = 7-Zip 9.20

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"ArcSoft PhotoImpression 3.0" = ArcSoft PhotoImpression 3.0

"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus

"B1F862B039A73DE1E30D300EFF63E1E3A4993FB1" = Windows Driver Package - Sony Ericsson Mobile Communications (ggsemc) USB  (04/01/2009 2.2.0.5)

"BCM70010" = Broadcom High Definition Video Decoder

"Bullzip PDF Printer_is1" = Bullzip PDF Printer 7.2.0.1304

"CCleaner" = CCleaner

"Citavi" = Citavi 2.5

"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58

"DAEMON Tools Lite" = DAEMON Tools Lite

"DivX Setup.divx.com" = DivX-Setup

"Drakensang_is1" = Drakensang

"Elsword_DE_is1" = Elsword_DE

"ENTERPRISE" = Microsoft Office Enterprise 2007

"ESET Online Scanner" = ESET Online Scanner v3

"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20

"Free Download Manager_is1" = Free Download Manager 3.0

"GPL Ghostscript Lite_is1" = GPL Ghostscript Lite 8.70

"InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility

"InstallShield_{A6D4234C-CB02-4048-AC3E-AD09404FA35A}" = Emdedded IR Driver

"InstallShield_{DB780B85-B4B5-4864-A49C-9B706B169C93}" = Texas Instruments PCIxx21/x515/xx12 drivers.

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300

"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2

"Mozilla Firefox 6.0.1 (x86 de)" = Mozilla Firefox 6.0.1 (x86 de)

"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver

"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver

"PDF Password Remover v3.0_is1" = PDF Password Remover v3.0

"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.02.2

"Redirection Port Monitor" = RedMon - Redirection Port Monitor

"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.3 for Windows

"Simfy" = simfy

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"SystemRequirementsLab" = System Requirements Lab

"TOSHIBA Software Modem" = TOSHIBA Software Modem

"Visual-XSel 11.0" = Visual-XSel 11.0

"VLC media player" = VLC media player 1.1.7

"Winamp" = Winamp

"WinRAR archiver" = WinRAR

"ZoneAlarm Free" = ZoneAlarm Free

"ZoneAlarm Toolbar" = ZoneAlarm Toolbar

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Dropbox" = Dropbox

"Mozilla Firefox 8.0.1 (x86 de)" = Mozilla Firefox 8.0.1 (x86 de)

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 25.11.2011 10:04:08 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 26.11.2011 16:22:22 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc100  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,

 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0dcef306  ID des fehlerhaften

 Prozesses: 0x205c  Startzeit der fehlerhaften Anwendung: 0x01ccac7919400286  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\svchost.exe  Pfad des fehlerhaften Moduls:

 unknown  Berichtskennung: 58885b76-186c-11e1-af10-00040ec3a437

 

Error - 26.11.2011 21:48:06 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,

 Zeitstempel: 0x4d76255d  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000455a8  ID des fehlerhaften

 Prozesses: 0x2648  Startzeit der fehlerhaften Anwendung: 0x01ccaca69b1bc943  Pfad der

 fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe  Pfad des

 fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: d927e8f8-1899-11e1-af10-00040ec3a437

 

Error - 27.11.2011 00:15:59 | Computer Name = Katana | Source = Application Error | ID = 1000

Description = Name der fehlerhaften Anwendung: DllHost.exe, Version: 6.1.7600.16385,

 Zeitstempel: 0x4a5bc6b7  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17514,

 Zeitstempel: 0x4ce7b96e  Ausnahmecode: 0xc0000005  Fehleroffset: 0x000455a8  ID des fehlerhaften

 Prozesses: 0x2088  Startzeit der fehlerhaften Anwendung: 0x01ccacbb441fcafb  Pfad der

 fehlerhaften Anwendung: C:\Windows\system32\DllHost.exe  Pfad des fehlerhaften Moduls:

 C:\Windows\SYSTEM32\ntdll.dll  Berichtskennung: 82503b87-18ae-11e1-af10-00040ec3a437

 

Error - 27.11.2011 10:51:11 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\sony

 ericsson\sony ericsson pc suite\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 27.11.2011 10:51:46 | Computer Name = Katana | Source = SideBySide | ID = 16842815

Description = Fehler beim Generieren des Aktivierungskontextes für "d:\program files\TOOLS\spybot

 - search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "d:\program

 files\TOOLS\spybot - search & destroy\DelZip179.dll" in Zeile 8.  Der Wert "*" des

 "language"-Attributs im assemblyIdentity-Element ist ungültig.

 

Error - 27.11.2011 10:51:54 | Computer Name = Katana | Source = SideBySide | ID = 16842785

Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\sony

 ericsson\sony ericsson pc companion\Drivers\DPInst64.exe".  Die abhängige Assemblierung

 "Microsoft.Windows.Common-Controls,language="&#x2a;",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""

 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm

 "sxstrace.exe".

 

Error - 27.11.2011 15:26:01 | Computer Name = Katana | Source = VSS | ID = 8194

Description = 

 

Error - 27.11.2011 15:33:54 | Computer Name = Katana | Source = Application Hang | ID = 1002

Description = Programm NOTEPAD.EXE, Version 6.1.7600.16385 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: d48    Startzeit: 01ccad3b720d8d4d    Endzeit: 0    Anwendungspfad: C:\Windows\system32\NOTEPAD.EXE
 

Berichts-ID:

 bc17fe5b-192e-11e1-ad59-00040ec3a437  

 

Error - 29.11.2011 11:48:09 | Computer Name = Katana | Source = Application Hang | ID = 1002

Description = Programm OUTLOOK.EXE, Version 12.0.6423.1000 kann nicht mehr unter

 Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf 

in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem

 zu suchen.    Prozess-ID: 1360    Startzeit: 01ccaeade2e27d5c    Endzeit: 0    Anwendungspfad: 

D:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE    Berichts-ID:   

 

[ Cisco AnyConnect Secure Mobility Client Events ]

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp

Line:

 1024 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363

 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could

 not contact target 

 

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 860 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:12 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:

 192 Invoked Function: CNetEnvironment::testNetwork Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:32 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: URL::URL File: .\Utility\URL.cpp Line: 38 Invoked Function:

 URL::setURL Return Code: -28508150 (0xFE4D000A) Description: URL_ERROR_BAD_URL parameter=

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CHttpProbeAsync::OnOpenRequestComplete File: .\IP\HttpProbeAsync.cpp

Line:

 254 Invoked Function: CHttpSessionAsync::OnOpenRequestComplete Return Code: -31522780

 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CSocketTransport::OnTimerExpired File: .\IPC\SocketTransport.cpp

Line:

 1194 Invoked Function: CSocketTransport::postConnectProcessing Return Code: -31522780

 (0xFE1F0024) Description: SOCKETTRANSPORT_ERROR_CONNECT_TIMEOUT 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::TestAccessToSG File: .\NetEnvironment.cpp

Line:

 1024 Invoked Function: CNetEnvironment::analyzeHttpResponse Return Code: -28901363

 (0xFE47000D) Description: NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could

 not contact target 

 

Error - 19.05.2011 11:28:40 | Computer Name = Katana | Source = acvpnagent | ID = 67108866

Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:

 860 Invoked Function: CNetEnvironment::IsSGAccessible Return Code: -28901363 (0xFE47000D)

Description:

 NETENVIRONMENT_ERROR_PROBE_INCOMPLETE:Network Probe could not contact target 

 

Error - 19.05.2011 11:28:44 | Computer Name = Katana | Source = acvpnagent | ID = 67110873

Description = Termination reason code 7: The agent has been stopped.

 

Error - 19.05.2011 11:29:14 | Computer Name = Katana | Source = acvpninstall | ID = 67108866

Description = Function: CInstalledManifestInfo::UpdateInstalledFileData File: ..\..\Downloader\ManifestInfo.cpp

Line:

 1736 Invoked Function: DeleteFile Return Code: 2 (0x00000002) Description: Das System

 kann die angegebene Datei nicht finden.   

 

[ OSession Events ]

Error - 26.09.2011 17:40:13 | Computer Name = Katana | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application 

Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session 

lasted 2125 seconds with 2040 seconds of active time.  This session ended with a

 crash.

 

Error - 04.11.2011 22:11:19 | Computer Name = Katana | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 353

 seconds with 300 seconds of active time.  This session ended with a crash.

 

[ System Events ]

Error - 27.11.2011 10:25:35 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 27.11.2011 12:07:35 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 29.11.2011 09:58:51 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 29.11.2011 10:01:12 | Computer Name = Katana | Source = Service Control Manager | ID = 7030

Description = Der Dienst "TrueVector Internet Monitor" ist als interaktiver Dienst

 gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste

 nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

 

Error - 29.11.2011 10:11:22 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 30.11.2011 05:50:45 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 30.11.2011 06:40:25 | Computer Name = Katana | Source = Service Control Manager | ID = 7034

Description = Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies

 ist bereits 1 Mal passiert.

 

Error - 30.11.2011 06:43:32 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 30.11.2011 08:37:16 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

Error - 30.11.2011 10:39:04 | Computer Name = Katana | Source = DCOM | ID = 10016

Description = 

 

 

< End of report >

hi...

Punkt 3. hast Du gemacht?:-> http://www.trojaner-board.de/105492-...tml#post727419

Ach verdammt, ja hab ich gemacht aber nicht gepostet :stirn: :headbang:

Vom 30.11

Code:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software

Run date: 2011-11-30 11:06:48

-----------------------------

11:06:48.531    OS Version: Windows 6.1.7601 Service Pack 1

11:06:48.531    Number of processors: 2 586 0xF0B

11:06:48.533    ComputerName: KATANA  UserName: K

11:06:50.854    Initialize success

11:08:18.062    AVAST engine defs: 11113000

11:11:10.521    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

11:11:10.527    Disk 0 Vendor: FUJITSU_ 0040 Size: 152627MB BusType: 3

11:11:10.534    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1

11:11:10.541    Disk 1 Vendor: TOSHIBA_ DL03 Size: 152627MB BusType: 3

11:11:10.553    Disk 0 MBR read successfully

11:11:10.561    Disk 0 MBR scan

11:11:10.581    Disk 0 Windows 7 default MBR code

11:11:10.589    Disk 0 scanning sectors +312576000

11:11:10.684    Disk 0 scanning C:\Windows\system32\drivers

11:11:28.514    Service scanning

11:11:30.149    Modules scanning

11:11:45.202    Disk 0 trace - called modules:

11:11:45.236    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 

11:11:45.246    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87102030]

11:11:45.256    3 CLASSPNP.SYS[8bdab59e] -> nt!IofCallDriver -> [0x866aa838]

11:11:45.265    5 ACPI.sys[8b6883d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x862c7028]

11:11:46.218    AVAST engine scan C:\Windows

11:11:49.157    AVAST engine scan C:\Windows\system32

11:14:33.496    AVAST engine scan C:\Windows\system32\drivers

11:14:49.913    AVAST engine scan C:\Users\K

11:16:47.209    File: C:\Users\K\AppData\Roaming\5049\components\AcroFF0498.dll  **INFECTED** Win32:Spyware-gen [Spy]

11:17:37.482    AVAST engine scan C:\ProgramData

11:19:03.692    Scan finished successfully

11:34:19.537    Disk 0 MBR has been saved successfully to "D:\Eigene Dateien\Desktop\MBR.dat"

11:34:19.545    The log file has been saved successfully to "D:\Eigene Dateien\Desktop\aswMBR_30.11.txt"

Habs sicherheitshalber nochmal durchlaufen lassen, da der gestrige Tag echt schlimm war :glaskugel2: und ich nicht noch mehr Fehler machen will.

Code:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software

Run date: 2011-12-02 00:03:20

-----------------------------

00:03:20.569    OS Version: Windows 6.1.7601 Service Pack 1

00:03:20.569    Number of processors: 2 586 0xF0B

00:03:20.569    ComputerName: KATANA  UserName: K

00:03:21.567    Initialize success

00:03:25.982    AVAST engine defs: 11120101

00:03:53.033    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0

00:03:53.048    Disk 0 Vendor: FUJITSU_ 0040 Size: 152627MB BusType: 3

00:03:53.048    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IAAStorageDevice-1

00:03:53.048    Disk 1 Vendor: TOSHIBA_ DL03 Size: 152627MB BusType: 3

00:03:53.064    Disk 0 MBR read successfully

00:03:53.064    Disk 0 MBR scan

00:03:53.079    Disk 0 Windows 7 default MBR code

00:03:53.095    Disk 0 scanning sectors +312576000

00:03:53.204    Disk 0 scanning C:\Windows\system32\drivers

00:04:09.257    Service scanning

00:04:10.754    Modules scanning

00:04:27.790    Disk 0 trace - called modules:

00:04:27.805    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys 

00:04:27.821    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87104030]

00:04:27.821    3 CLASSPNP.SYS[8bd8059e] -> nt!IofCallDriver -> [0x866a9f08]

00:04:27.836    5 ACPI.sys[8b6913d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x862c7028]

00:04:28.835    AVAST engine scan C:\Windows

00:04:32.329    AVAST engine scan C:\Windows\system32

00:07:04.445    AVAST engine scan C:\Windows\system32\drivers

00:07:19.967    AVAST engine scan C:\Users\K

00:09:17.544    AVAST engine scan C:\ProgramData

00:10:21.473    Scan finished successfully

00:16:38.105    Disk 0 MBR has been saved successfully to "D:\Eigene Dateien\Desktop\MBR.dat"

00:16:38.120    The log file has been saved successfully to "D:\Eigene Dateien\Desktop\aswMBR.txt"

Nochmals Sorry :/

1.
alte Version, kann deinstalliert werden:

Zitat:

Mozilla Firefox 6.0.1

2.
reinige dein System mit Ccleaner:

"Cleaner"→ "Analysieren"→ Klick auf den Button "Start CCleaner"
"Registry""Fehler suchen"→ "Fehler beheben"→ "Alle beheben"
Starte dein System neu auf

lade Dir SUPERAntiSpyware FREE Edition herunter.
installiere das Programm und update online.
starte SUPERAntiSpyware und klicke auf "Ihren Computer durchsuchen"
setze ein Häkchen bei "Kompletter Scan" und klicke auf "Weiter"
anschließend alle gefundenen Schadprogramme werden aufgelistet, bei alle Funde Häkchen setzen und mit "OK" bestätigen
auf "Weiter" klicken dann "OK" und auf "Fertig stellen"
um die Ergebnisse anzuzeigen: auf "Präferenzen" dann auf den "Statistiken und Protokolle" klicken
drücke auf "Protokoll anzeigen" - anschließend diesen Bericht bitte speichern und hier posten

4.
Auch auf USB-Sticks, selbstgebrannten Datenträgern, externen Festplatten und anderen Datenträgern können Viren transportiert werden. Man muss daher durch regelmäßige Prüfungen auf Schäden, die durch Malware ("Worm.Win32.Autorun") verursacht worden sein können, überwacht werden. Hierfür sind ser gut geegnet und empfohlen, die auf dem Speichermedium gesicherten Daten, mit Hilfe des kostenlosen Online Scanners zu prüfen.
Schließe jetzt alle externe Datenträgeran (USB Sticks etc) Deinen Rechner an, dabei die Hochstell-Taste [Shift-Taste] gedrückt halten, damit die Autorun-Funktion nicht ausgeführt wird. (So verhindest Du die Ausführung der AUTORUN-Funktion) - Man kann die AUTORUN-Funktion aber auch generell abschalten.►Anleitung

-> Führe dann einen Komplett-Systemcheck mit Eset Online Scanner (NOD32)Kostenlose Online Scanner durch
Achtung!: >>Du sollst nicht die Antivirus-Sicherheitssoftware installieren, sondern dein System nur online scannen<<

► berichte erneut über den Zustand des Computers. Ob noch Probleme auftreten, wenn ja, welche?

1)
Auf 8.0.1 aktualisiert

2)
Eredigt

3)

Code:

SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 12/02/2011 at 02:20 PM
 

Application Version : 5.0.1136
 

Core Rules Database Version : 8008

Trace Rules Database Version: 5820
 

Scan type       : Complete Scan

Total Scan Time : 01:56:42
 

Operating System Information

Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)

UAC Off - Limited User
 

Memory items scanned      : 694

Memory threats detected   : 0

Registry items scanned    : 41830

Registry threats detected : 0

File items scanned        : 127091

File threats detected     : 118
 

Adware.Tracking Cookie

        C:\USERS\K\AppData\Roaming\Microsoft\Windows\Cookies\Low\G63B3DML.txt [ Cookie:k@www.google.com/accounts ]

        C:\USERS\K\AppData\Roaming\Microsoft\Windows\Cookies\Low\509XL6R5.txt [ Cookie:k@google.com/accounts/ ]

        .doubleclick.net [ C:\USERS\TROY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\USERS\TROY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ads2.zeusclicks.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        rts.pgmediaserve.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .partypoker.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.star-advertising.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .sexad.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .c.atdmt.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .kaspersky.122.2o7.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .server.cpmstar.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .apmebf.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .game-advertising-online.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .invitemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .lucidmedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .atdmt.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .statcounter.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.zanox.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .webmasterplan.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .zanox.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.usenext.de [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adbrite.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad.yieldmanager.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .yieldmanager.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .casalemedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .media6degrees.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .fastclick.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .tracking.quisma.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .ru4.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad4.adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad2.adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .serving-sys.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .doubleclick.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .revsci.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adxvalue.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ad3.adfarm1.adition.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        adx.chip.de [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .hentaimedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .smartadserver.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .xiti.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .traffichaus.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .girlsteachsex.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .adxpansion.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .exoclick.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        trackfox2.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        www.sexyspiele.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .sexyspiele.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .sexyspiele.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .sexyspiele.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        galleries.drawn-sex.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        galleries.drawn-sex.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        adultcartoonporno.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        adultcartoonporno.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        toonsexgalleries.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        toonsexgalleries.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        toonsexgalleries.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        toonsexgalleries.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        toonsexgalleries.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .enoratraffic.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ads.trafficjunky.net [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        pornografish.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        .exoclick.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]

        ads.crakmedia.com [ C:\SANDBOX\TROY\DEFAULTBOX\USER\CURRENT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9I3KVB3A.DEFAULT\COOKIES.SQLITE ]
 

Trojan.Agent/Gen-Autoit

        D:\PROGRAM FILES\TOOLS\SONY ERICSSON\SONY ERICSSON PC SUITE\PC SUITE LOG.EXE

4)
Folgt

Eset hat nix gefunden (siehe Anhang)

Ansonsten hab ich bis jetzt keine weiteren Meldungen.

Wie sieht es den aus wenn ich irgendwann mein System platt mache und neu aufspiele mit der Gefahr versteckte Trojaner zu übernehmen. Es geht dabei nur um Daten aus Word und Excel die ich sichern will, können die Trojaner enthalten ?
Wenn du noch paar Tips wie der, den ich hier irgendwo gelesen hab mit die Daten mit nem ander Betriebsystem sichen hast, wäre ich dankbar :) .

Und noch eine Frage wie habt ihr euch das ganze Wissen angeeignet über die entfernung von Trojaner, würde da gerne auch bisschen kompetenter werden.

Zitat:

Zitat von Pepe88 (Beitrag 728949)

Wenn du noch paar Tips wie der, den ich hier irgendwo gelesen hab mit die Daten mit nem ander Betriebsystem sichen hast, wäre ich dankbar :) .

➊
Datensicherung:
► NUR Daten sichern, die nicht ausführbaren Dateien enthalten - Dateiendungen - Dies ist eine Liste von Dateiendungen, die Dateien mit ausführbarem Code bezeichnen können.
- Vorsicht mit den schon vorhandenen Dateien auf die extern gespeicherten Daten und auch jetzt mit dem Virus infizierte Dateien eine Datensicherung anzufertigen
- Am besten alles was dir sehr wichtig, separat (extern) sichern - nicht mischen eventuell früher geschicherten Daten, also vor dem Befall!
- Eventuell gecrackte Software nicht sichern und dann auf neu aufgesetztem System wieder drauf installieren!

- Vor zurückspielen - bevor du mit deinem PC direkt ins Netz gehst...:
- die Autoplay-Funktion für alle Laufwerke deaktivieren/ausschalten -> Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten

Die auf eine externe Festplatte gesicherten Daten, gründlich zu scannen von einem suaberen System aus, am besten mit mehreren Scannern-> Kostenlose Online Scanner - Anleitung

Zitat:

Zitat von Pepe88 (Beitrag 728949)

Und noch eine Frage wie habt ihr euch das ganze Wissen angeeignet über die entfernung von Trojaner, würde da gerne auch bisschen kompetenter werden.

-> http://www.trojaner-board.de/88896-ausbildung-trojaner-board.html

Wenn Du keine Probleme mehr hast, können wir damit dann Deinen Thread schließen?

1.
Programme deinstallieren/entfernen, die wir verwendet haben und nicht brauchst, bis auf:

Code:

CCleaner

- Zeitweise laufen lassen:-> Anleitung

2.
Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
Speichere es auf Deinem Desktop.
Doppelklick auf OTL.exe um das Programm auszuführen.
Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
Klicke auf den Button "Bereinigung"
OTL fragt eventuell nach einem Neustart.
Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

3.
Wenn alles gut verlaufen und dein System läuft stabil,mache folgendes:
Alle Systemwiederherstellungspunkte löschen, auch den Letzten

4.
Ich würde Dir vorsichtshalber raten, dein Passwort zu ändern
z.B. Login-, Mail- oder Website-Passwörter
Tipps:
Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
auch noch hier unter: Sicheres Kennwort (Password)

Lesestoff Nr.1:

Wie erstelle ich ein eingeschränktes Benutzerkonto?
Software immer auf dem neuesten Stand halten!:
ALLE auf dem System installierten Programme und Treiber, sollten regelmäßig upgedatet werden um Sicherheitslücken zu vermeiden und um das reibungslose Arbeitsabläufe zu erreichen!
Ein sicherer Browser als IE z.B. *Ein Wechsel des Standardbrowsers zu...von SETI@home* - Firefox - FirefoxWiki/Einstellungen - Erweiterungen für Firefox - Standardbrowser
Sichere eMail Clients z.B. Thunderbird-->Erweiterungen für Mozilla Thunderbird
- Unbekannten E-Mail-Anhang NICHT öffnen!
Sichere Paswort - Die sichere Passwort-Wahl - (sollte man eigentlich regelmäßigen Abständen ca. alle 3-5 Monate ändern)
auch noch hier unter: Sicheres Kennwort (Password)
Die fünf häufigsten Passwort-Fehler[/b[

"Never accept software from strangers" - Installiere grundsätzlich immer nur Programme, die Du auch wirklich benötigst und von denen Du überzeugt bist, dass sie seriös sind.
Du hast die Wahl!, welche zusätzlichen Komponenten noch installiert werden sollen? -> Bei der Installation immer mitlesen, Sponsoren und Partnerprogramme, Toolbars oder eventuell noch andere extra angebotene Programme möglichst abwählen!
Sponsor-Programm, Toolbars möglist abwählen (so wird oft Art von Adware/Spyware mitinstalliert)

NICHT irgendwelche Programme aus dem Netz laden, wenn nicht zu 100% fest steht, dass es sich dabei um saubere Software handelt. Nette Versprechen der Hersteller garantieren noch lange keine einwandfreie Funktionsweise, also vorher blättere die Seiten bei GOOGLE, da kannst Du Dir wertvolle Informationen holen!!!

Programme und Treiber:
Nur vom Hersteller!

Onlinebanking:
Gib deine Passwörter niemals preis!
Seriöse Bankinstitute, E- Mail- Provider oder Online- Shops versenden grundsätzlich keine E- Mails, in denen Kunden aufgefordert werden, vertrauliche Daten wie Passwörter, Verfügernummer, PINs oder TANs preiszugeben. Bei dieser Art von E- Mails handelt es sich immer um Betrugsversuche, weshalb entsprechende Anfragen nicht beantwortet werden sollten. Sobald der Verdacht auf Betrug entsteht, melde deinen Verdacht der jeweiligen Bank- Hotline.

Comnputer, anderen (Gästen/Freunden) zur Nutzung überlassen überlassen - Nutze nur vertrauenswürdige Computer!
Vergewissere dich, dass nur Personen deines Vertrauens deinen Computer nutzen oder verwalten und wickel niemals Bankgeschäfte über nicht vertrauenswürdige Computer - beispielsweise aus einem Internetcafé während des Urlaubs - ab

Vorsicht bei der Nutzung fremder Computer und anschliessbare Externe Speichermedien wie Festplatte, USB Sticks, Speicherkarten usw![/color] - IT-Betrüger machen keinen Urlaub!/bsi-fuer-buerger.de - auch zeitweise anschließen und scannen lassen (sehe unter `kostenlose Online-Viren-Scanner`)
Webseiten ohne Gültiges Impressum nicht besuchen
Lizenzkosten sparen? - Vorsicht bei Dateien/Programmen aus nicht vertrauenswürdigen Quellen! - "full Keygen, Crack, Serial, Warez, keygenerators" etc.
Sind immer verseucht mit diverse Malware/Schadprogramme/Code, es gibt keine seite wo Viren frei ist. (Man sollte nicht absitlich der Teufel holen;)) Eine weitere höchst unsichere Quelle ist das File-Sharing der sog. (Musik-)Tauschbörsen.
► Ausserdem machst Du dich damit strafbar!
Nur eine Firewall sowie ein Antiviren Programm verwenden, welche sich immer auf dem aktuellsten Stand befinden sollten!
Das Installieren von `zuviel` Software beeinträchtigt die Systemleistung und Sicherheit, verlangsamt den Start-Vorgang enorm und belastet den Arbeitsspeicher (weil laufen ja die Programme nebeneinander gleichzeitig, die viel Performance fressen, aber wenig Qualität bringen). Im Laufe der Zeit wird der rechner durch zu viel unnötigen Ballast immer langsamer, und unsicherer. Um so mehr Programme installiert sind, um so häufiger treten Probleme auf, die dann unter Umständen nur schwer lösen können. Dazu kommt noch, das einige Programme große Sicherheitsrisiken mit sich bringen;)
Virenscanner
BSI für Bürger
SETI@home - [Sicherheit] Sicherheitskonzept
Entwicklung schädlicher Websites/viruslist.com
Brennpunkt: Bilder und Töne
Gefährliche Bilder, schräge Töne/BSI

** Der gesunde Menschenverstand, Windows und Internet-Software sicher konfigurieren ist der beste Weg zur Sicherheit im Webverkehr ist !!

Zitat:

Da der Bestand der Datenbank wird täglich ergänzt und erweitert bzw werden mit der aktuellen Virendefinition die Informationen über den betroffenen Virus aufgenommen, empfehle ich dir mindestens einmal pro Woche (später genügt es sicherlich einmal im Monat) dein System Online Scannen lassen (immer mit einen anderen Scanner), um eine zweite Meinung einzuholen - Die auf dem Speichermedium gesicherten Daten sollten auch mit einbezogen werden!
(benutzen meist ActiveX und/oder Java): Kostenlose Online Scanner -

Lesestoff Nr.2:
► Kann sich auf Dauer eine Menge Datenmüll ansammeln, sich Fehlermeldungen häufen, der PC ist wahrscheinlich nicht mehr so schnell, wie früher:

Löschen der temporären Dateien in Windows
Verlauf, Cache und Cookies: Spuren beseitigen nach dem Surfen
hier nachlesen und hier microsoft.com
Wenn dein System reibungslos läuft, kannst zeitweise die alte Wiederherstellungspunkte entfernen: -> Alle Systemwiederherstellungspunkte bis auf den Letzten löschen
Oft den PC zu optimieren nütz wenig, der braucht jetzt eine Radikalkur (nach ca. 3-4 jahren, aber hängt von der Häufigkeit der Nutzung bzw Belastung ab): Anleitung: Neuaufsetzen des Systems + Absicherung
Staub, Fingerabdrücke, Handschweiß – PC und Peripherie sehen mit der Zeit ganz schön eklig aus, ausserdem laut, reagiert langsam und wird schnell heiß:
-> verschmutzte PCs sauber machen
-> Frühjahrsputz für den PC: Tipps zur Reinigung und Entrümpelung

wünsch Dir alles Gute:)

Wenn Du uns unterstützen möchtest→ Spendekonto

gruß
kira

ok hab die restlich Sachen noch erledigt.

Vielen vielen Dank für die Tipps und die Betreuung !!!

Ich wünsche dir und dem Team frohe Weihnachten und einen guten Rutsch ;)