Danke für Deine Antwort...nun, ich habe jetzt den Bericht des Avira-Scans in OTL kopiert und durchlaufen lassen. (War das richtig, oder sollte ich es mit dem Code aus Deiner Antwort machen?)OTL Logfile: Code:
OTL logfile created on: 28.06.2012 18:00:08 - Run 4
OTL by OldTimer - Version 3.2.51.0 Folder = C:\Users\Doppelleben\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 1,16 Gb Available Physical Memory | 58,31% Memory free
3,98 Gb Paging File | 2,63 Gb Available in Paging File | 66,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 26,04 Gb Free Space | 26,66% Space Free | Partition Type: NTFS
Drive D: | 42,35 Gb Total Space | 30,94 Gb Free Space | 73,07% Space Free | Partition Type: NTFS
Computer Name: Name-NB | User Name: Doppelleben | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.06.22 14:10:43 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
PRC - [2012.05.26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Doppelleben\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Doppelleben\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011.09.08 09:15:22 | 000,670,792 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
PRC - [2011.07.29 10:22:21 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.07.29 10:22:05 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011.07.29 10:22:03 | 000,340,136 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2011.07.29 10:22:02 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.07.29 10:22:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.07.29 10:22:01 | 000,567,464 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.10.25 15:13:42 | 000,821,144 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
========== Modules (No Company Name) ==========
MOD - [2012.03.16 20:30:35 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.10.25 15:15:46 | 000,019,968 | ---- | M] () -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.06.23 06:14:29 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.18 07:20:32 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.09.08 09:15:22 | 000,670,792 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
SRV - [2011.07.29 10:22:21 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.07.29 10:22:05 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2011.07.29 10:22:03 | 000,340,136 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2011.07.29 10:22:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.29 10:22:01 | 000,567,464 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.09.08 08:42:38 | 000,032,768 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dsNcAdpt.sys -- (dsNcAdpt)
DRV:64bit: - [2011.08.20 06:52:46 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.07.29 10:22:30 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.29 10:22:29 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.07.29 10:22:28 | 000,131,336 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot)
DRV:64bit: - [2011.07.29 10:22:28 | 000,101,984 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim)
DRV:64bit: - [2011.03.21 13:22:06 | 000,452,200 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.09.23 19:23:02 | 006,180,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008.05.06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007.08.03 05:35:54 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A0 F0 3E 15 7F 43 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/"
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011.09.13 14:41:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.06.27 11:23:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 07:20:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.16 19:25:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 07:20:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Extensions
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.06.22 06:59:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Firefox\Profiles\zlhea29q.default\extensions
[2011.04.29 09:19:41 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Firefox\Profiles\zlhea29q.default\extensions\engine@conduit.com
[2012.03.20 07:05:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.04.13 22:24:38 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.10 21:20:14 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\DOPPELLEBEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZLHEA29Q.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.18 07:20:34 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.01.10 14:20:25 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 14:20:25 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.10 14:20:25 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 14:20:25 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 14:20:25 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 14:20:25 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\gcswf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\PFiles\Plugins\np-mswmp.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
O1 HOSTS File: ([2012.06.23 14:22:04 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Doppelleben\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Doppelleben\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://ssl.cms.hu-berlin.de/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D2656B2-96A0-4F00-8DA2-450C4C414309}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f35a4036-d39f-11e0-877c-001bfb85d721}\Shell - "" = AutoRun
O33 - MountPoints2\{f35a4036-d39f-11e0-877c-001bfb85d721}\Shell\AutoRun\command - "" = "G:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.06.28 15:39:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.28 15:38:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.28 15:38:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.28 15:38:04 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Doppelleben\Desktop\mbam-setup-1.61.0.1400(1).exe
[2012.06.28 15:23:26 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Roaming\Malwarebytes
[2012.06.28 15:23:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.27 11:31:49 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2012.06.27 11:23:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
[2012.06.27 11:16:02 | 002,585,872 | ---- | C] (Microsoft Corporation) -- C:\Users\Doppelleben\WindowsInstaller-KB893803-v2-x86.exe
[2012.06.27 11:16:02 | 000,337,360 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Doppelleben\setup.exe
[2012.06.27 11:08:13 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\Akamai
[2012.06.22 16:24:29 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\CrashDumps
[2012.06.22 14:10:42 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
[2012.06.22 14:05:18 | 002,128,472 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Doppelleben\Desktop\TDSSKiller.exe
[2012.06.22 07:00:58 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\NPE
[2012.06.22 07:00:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.06.22 06:30:22 | 002,844,736 | ---- | C] (Symantec Corporation) -- C:\Users\Doppelleben\Desktop\NPE.exe
[2012.06.21 21:25:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.06.10 20:28:13 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\Macromedia
[1 C:\Users\Doppelleben\Desktop\*.tmp files -> C:\Users\Doppelleben\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.06.28 17:14:01 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.28 15:41:58 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 15:41:58 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 15:39:00 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.28 15:38:10 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Doppelleben\Desktop\mbam-setup-1.61.0.1400(1).exe
[2012.06.28 15:34:25 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.06.28 15:33:16 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\ljgcylopp.job
[2012.06.28 15:33:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.28 15:33:04 | 000,328,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.28 15:32:45 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.27 11:23:49 | 000,002,038 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.06.27 11:22:48 | 005,634,323 | ---- | M] () -- C:\Users\Doppelleben\Desktop\00034529.pdf
[2012.06.22 16:11:09 | 000,729,880 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.22 16:11:09 | 000,618,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.22 16:11:09 | 000,107,650 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.22 14:10:43 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
[2012.06.22 06:30:39 | 002,844,736 | ---- | M] (Symantec Corporation) -- C:\Users\Doppelleben\Desktop\NPE.exe
[2012.06.21 15:39:34 | 000,022,269 | ---- | M] () -- C:\Users\Doppelleben\Desktop\Stellenausschreibung_14_12-1.pdf
[2012.06.20 21:11:20 | 002,128,472 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Doppelleben\Desktop\TDSSKiller.exe
[2012.06.18 21:14:30 | 000,114,688 | RHS- | M] () -- C:\Windows\SysWow64\usbceipj.dll
[2012.06.10 20:08:14 | 000,001,071 | ---- | M] () -- C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[1 C:\Users\Doppelleben\Desktop\*.tmp files -> C:\Users\Doppelleben\Desktop\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.06.28 15:39:00 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.27 11:23:49 | 000,002,465 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
[2012.06.27 11:23:49 | 000,002,453 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
[2012.06.27 11:23:49 | 000,002,038 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.06.27 11:22:41 | 005,634,323 | ---- | C] () -- C:\Users\Doppelleben\Desktop\00034529.pdf
[2012.06.27 11:16:02 | 000,074,752 | ---- | C] () -- C:\Users\Doppelleben\1036.mst
[2012.06.27 11:16:01 | 000,076,288 | ---- | C] () -- C:\Users\Doppelleben\1031.mst
[2012.06.27 11:16:01 | 000,003,584 | ---- | C] () -- C:\Users\Doppelleben\1033.mst
[2012.06.27 11:16:00 | 008,297,472 | ---- | C] () -- C:\Users\Doppelleben\AcroPro.msi
[2012.06.27 11:16:00 | 000,001,772 | ---- | C] () -- C:\Users\Doppelleben\ABCPY.INI
[2012.06.27 11:14:57 | 481,143,404 | ---- | C] () -- C:\Users\Doppelleben\Data1.cab
[2012.06.21 15:39:34 | 000,022,269 | ---- | C] () -- C:\Users\Doppelleben\Desktop\Stellenausschreibung_14_12-1.pdf
[2012.06.18 21:14:31 | 000,000,328 | ---- | C] () -- C:\Windows\tasks\ljgcylopp.job
[2012.06.18 21:14:30 | 000,114,688 | RHS- | C] () -- C:\Windows\SysWow64\usbceipj.dll
[2011.07.19 08:40:41 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.07.19 08:40:40 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.07.19 08:40:35 | 000,644,608 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.07.19 08:40:35 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.07.19 08:40:34 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.01.26 14:59:35 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.24 14:11:50 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
========== LOP Check ==========
[2011.03.22 21:17:35 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DAEMON Tools Lite
[2012.06.28 18:06:23 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Dropbox
[2012.05.14 22:02:19 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DVDVideoSoft
[2012.05.14 22:11:19 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.24 21:47:34 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\foobar2000
[2012.06.22 16:22:22 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\FreePDF
[2011.04.29 09:20:57 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\GetRightToGo
[2011.11.01 00:35:35 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\GlarySoft
[2011.11.21 14:11:09 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Juniper Networks
[2012.03.16 20:32:58 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\OpenOffice.org
[2011.04.29 09:19:59 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Softi Software
[2012.02.16 17:20:29 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Swiss Academic Software
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Thunderbird
[2012.06.28 15:34:25 | 000,000,338 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012.06.28 15:33:16 | 000,000,328 | ---- | M] () -- C:\Windows\Tasks\ljgcylopp.job
[2012.04.01 11:10:26 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< >
< >
< Premium Security Suite >
< Erstellungsdatum der Reportdatei: Donnerstag, 21. Juni 2012 16:35 >
< >
< Es wird nach 3858835 Virenstämmen gesucht. >
< >
< Das Programm läuft als uneingeschränkte Vollversion. >
< Online-Dienste stehen zur Verfügung. >
< >
< Lizenznehmer : Name >
< Seriennummer : Nummer >
< Plattform : Windows 7 x64 >
< Windowsversion : (Service Pack 1) [6.1.7601] >
< Boot Modus : Normal gebootet >
< Benutzername : SYSTEM >
< Computername : CHRISTINE-NB >
< >
< Versionsinformationen: >
< BUILD.DAT : 10.2.0.675 43331 Bytes 25.01.2012 12:49:00 >
< AVSCAN.EXE : 10.3.0.7 484008 Bytes 29.07.2011 08:22:04 >
< AVSCAN.DLL : 10.0.5.0 57192 Bytes 29.07.2011 08:22:04 >
< LUKE.DLL : 10.3.0.5 45416 Bytes 29.07.2011 08:22:20 >
< LUKERES.DLL : 10.0.0.0 13672 Bytes 29.07.2011 08:22:20 >
< AVSCPLR.DLL : 10.3.0.7 119656 Bytes 29.07.2011 08:22:31 >
< AVREG.DLL : 10.3.0.9 88833 Bytes 29.07.2011 08:22:31 >
< VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 08:21:36 >
< VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 08:21:42 >
< VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 00:24:06 >
< VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 15:33:07 >
< VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 16:11:12 >
< VBASE005.VDF : 7.11.29.136 2166272 Bytes 10.05.2012 14:29:23 >
< VBASE006.VDF : 7.11.29.137 2048 Bytes 10.05.2012 14:29:23 >
< VBASE007.VDF : 7.11.29.138 2048 Bytes 10.05.2012 14:29:23 >
< VBASE008.VDF : 7.11.29.139 2048 Bytes 10.05.2012 14:29:23 >
< VBASE009.VDF : 7.11.29.140 2048 Bytes 10.05.2012 14:29:23 >
< VBASE010.VDF : 7.11.29.141 2048 Bytes 10.05.2012 14:29:23 >
< VBASE011.VDF : 7.11.29.142 2048 Bytes 10.05.2012 14:29:23 >
< VBASE012.VDF : 7.11.29.143 2048 Bytes 10.05.2012 14:29:24 >
< VBASE013.VDF : 7.11.29.144 2048 Bytes 10.05.2012 14:29:24 >
< VBASE014.VDF : 7.11.30.3 198144 Bytes 14.05.2012 14:16:38 >
< VBASE015.VDF : 7.11.30.69 186368 Bytes 17.05.2012 10:06:06 >
< VBASE016.VDF : 7.11.30.143 223744 Bytes 21.05.2012 18:15:07 >
< VBASE017.VDF : 7.11.30.207 287744 Bytes 23.05.2012 17:09:58 >
< VBASE018.VDF : 7.11.31.57 188416 Bytes 28.05.2012 20:55:29 >
< VBASE019.VDF : 7.11.31.111 214528 Bytes 30.05.2012 12:55:19 >
< VBASE020.VDF : 7.11.31.151 116736 Bytes 31.05.2012 18:17:57 >
< VBASE021.VDF : 7.11.31.205 134144 Bytes 03.06.2012 14:16:50 >
< VBASE022.VDF : 7.11.32.9 169472 Bytes 05.06.2012 19:01:09 >
< VBASE023.VDF : 7.11.32.85 155648 Bytes 08.06.2012 04:21:13 >
< VBASE024.VDF : 7.11.32.133 127488 Bytes 11.06.2012 19:10:05 >
< VBASE025.VDF : 7.11.32.171 182784 Bytes 12.06.2012 19:58:00 >
< VBASE026.VDF : 7.11.32.251 119296 Bytes 14.06.2012 03:45:58 >
< VBASE027.VDF : 7.11.33.83 159232 Bytes 18.06.2012 18:40:18 >
< VBASE028.VDF : 7.11.33.84 2048 Bytes 18.06.2012 18:40:18 >
< VBASE029.VDF : 7.11.33.85 2048 Bytes 18.06.2012 18:40:18 >
< VBASE030.VDF : 7.11.33.86 2048 Bytes 18.06.2012 18:40:18 >
< VBASE031.VDF : 7.11.33.160 154112 Bytes 21.06.2012 13:23:35 >
< Engineversion : 8.2.10.96 >
< AEVDF.DLL : 8.1.2.8 106867 Bytes 01.06.2012 19:22:25 >
< AESCRIPT.DLL : 8.1.4.28 455035 Bytes 21.06.2012 13:23:39 >
< AESCN.DLL : 8.1.8.2 131444 Bytes 26.01.2012 22:59:04 >
< AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 14:40:39 >
< AERDL.DLL : 8.1.9.15 639348 Bytes 08.09.2011 22:17:56 >
< AEPACK.DLL : 8.2.16.22 807288 Bytes 21.06.2012 13:23:39 >
< AEOFFICE.DLL : 8.1.2.38 201083 Bytes 21.06.2012 13:23:38 >
< AEHEUR.DLL : 8.1.4.52 4923767 Bytes 21.06.2012 13:23:38 >
< AEHELP.DLL : 8.1.21.0 254326 Bytes 11.05.2012 04:45:57 >
< AEGEN.DLL : 8.1.5.30 422261 Bytes 14.06.2012 14:40:34 >
< AEEXP.DLL : 8.1.0.54 82293 Bytes 21.06.2012 13:23:39 >
< AEEMU.DLL : 8.1.3.0 393589 Bytes 29.07.2011 08:21:53 >
< AECORE.DLL : 8.1.25.10 201080 Bytes 31.05.2012 15:16:43 >
< AEBB.DLL : 8.1.1.0 53618 Bytes 29.07.2011 08:21:52 >
< AVWINLL.DLL : 10.0.0.0 19304 Bytes 29.07.2011 08:21:22 >
< AVPREF.DLL : 10.0.3.2 44904 Bytes 29.07.2011 08:22:04 >
< AVREP.DLL : 10.0.0.10 174120 Bytes 29.07.2011 08:22:31 >
< AVARKT.DLL : 10.0.26.1 255336 Bytes 29.07.2011 08:21:58 >
< AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 29.07.2011 08:21:59 >
< SQLITE3.DLL : 3.6.19.0 355688 Bytes 29.07.2011 08:22:22 >
< AVSMTP.DLL : 10.0.0.17 63848 Bytes 29.07.2011 08:22:05 >
< NETNT.DLL : 10.0.0.0 11624 Bytes 29.07.2011 08:22:20 >
< RCIMAGE.DLL : 10.0.0.33 2901352 Bytes 29.07.2011 08:21:23 >
< RCTEXT.DLL : 10.0.63.0 98664 Bytes 29.07.2011 08:21:23 >
< >
< Konfiguration für den aktuellen Suchlauf: >
< Job Name..............................: Vollständige Systemprüfung >
< Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp >
< Protokollierung.......................: standard >
< Primäre Aktion........................: interaktiv >
< Sekundäre Aktion......................: ignorieren >
< Durchsuche Masterbootsektoren.........: ein >
< Durchsuche Bootsektoren...............: ein >
< Bootsektoren..........................: C:, D:, >
< Durchsuche aktive Programme...........: ein >
< Laufende Programme erweitert..........: ein >
< Durchsuche Registrierung..............: ein >
< Suche nach Rootkits...................: ein >
< Integritätsprüfung von Systemdateien..: aus >
< Datei Suchmodus.......................: Alle Dateien >
< Durchsuche Archive....................: ein >
< Rekursionstiefe einschränken..........: 20 >
< Archiv Smart Extensions...............: ein >
< Makrovirenheuristik...................: ein >
< Dateiheuristik........................: erweitert >
< >
< Beginn des Suchlaufs: Donnerstag, 21. Juni 2012 16:35 >
< >
< Der Suchlauf nach versteckten Objekten wird begonnen. >
< >
< Der Suchlauf über gestartete Prozesse wird begonnen: >
< Durchsuche Prozess 'avscan.exe' - '76' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'avscan.exe' - '30' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'avcenter.exe' - '94' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'AcroRd32.exe' - '66' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'AcroRd32.exe' - '66' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'thunderbird.exe' - '98' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'firefox.exe' - '132' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'soffice.bin' - '93' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'iTunesHelper.exe' - '69' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Windows\system32\dnssd.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'avgnt.exe' - '73' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'soffice.exe' - '20' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'Dropbox.exe' - '74' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'AVWEBGRD.EXE' - '48' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'avmailc.exe' - '53' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'dsNcService.exe' - '40' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'AppleMobileDeviceService.exe' - '64' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Windows\system32\dnssd.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'avguard.exe' - '86' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< Durchsuche Prozess 'avfwsvc.exe' - '57' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'armsvc.exe' - '25' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'sched.exe' - '50' Modul(e) wurden durchsucht >
< Durchsuche Prozess 'rundll32.exe' - '62' Modul(e) wurden durchsucht >
< Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll> >
< [WARNUNG] Die Datei konnte nicht geöffnet werden! >
< >
< Der Suchlauf über die Masterbootsektoren wird begonnen: >
< Masterbootsektor HD0 >
< [INFO] Es wurde kein Virus gefunden! >
< >
< Der Suchlauf über die Bootsektoren wird begonnen: >
< Bootsektor 'C:\' >
< [INFO] Es wurde kein Virus gefunden! >
< Bootsektor 'D:\' >
< [INFO] Es wurde kein Virus gefunden! >
< >
< Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen: >
< Die Registry wurde durchsucht ( '932' Dateien ). >
< >
< >
< Der Suchlauf über die ausgewählten Dateien wird begonnen: >
< >
< Beginne mit der Suche in 'C:\' <Niemandsrose> >
< C:\$Recycle.Bin\S-1-5-21-1701055086-3456072316-3754927457-1001\$RY3XBMT.zip >
< [0] Archivtyp: ZIP >
< --> google_analytical_evaluation.exe >
< [FUND] Ist das Trojanische Pferd TR/Pirminay.sax >
Invalid Switch: Pirminay.sax
< Beginne mit der Suche in 'D:\' <Sprachgitter> >
< >
< Beginne mit der Desinfektion: >
< C:\$Recycle.Bin\S-1-5-21-1701055086-3456072316-3754927457-1001\$RY3XBMT.zip >
< [FUND] Ist das Trojanische Pferd TR/Pirminay.sax >
Invalid Switch: Pirminay.sax
< [HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5688c4c6.qua' verschoben! >
< >
< >
< Ende des Suchlaufs: Donnerstag, 21. Juni 2012 20:38 >
< Benötigte Zeit: 1:18:54 Stunde(n) >
< >
< Der Suchlauf wurde vollständig durchgeführt. >
< >
< 34551 Verzeichnisse wurden überprüft >
< 609938 Dateien wurden geprüft >
< 1 Viren bzw. unerwünschte Programme wurden gefunden >
< 0 Dateien wurden als verdächtig eingestuft >
< 0 Dateien wurden gelöscht >
< 0 Viren bzw. unerwünschte Programme wurden repariert >
< 1 Dateien wurden in die Quarantäne verschoben >
< 0 Dateien wurden umbenannt >
< 7 Dateien konnten nicht durchsucht werden >
< 609930 Dateien ohne Befall >
< 5426 Archive wurden durchsucht >
< 7 Warnungen >
< 1 Hinweise >
< 426925 Objekte wurden beim Rootkitscan durchsucht >
< 0 Versteckte Objekte wurden gefunden >
< >
< End of report >
--- --- ---
Ich glaube, ich habe Deine Nachricht falsch verstanden, entschuldige. Hier der Bericht des Antivir-Scans:
Premium Security Suite
Erstellungsdatum der Reportdatei: Donnerstag, 21. Juni 2012 16:35
Es wird nach 3858835 Virenstämmen gesucht.
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Name
Seriennummer : Nummer
Plattform : Windows 7 x64
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : SYSTEM
Computername : Name-NB
Versionsinformationen:
BUILD.DAT : 10.2.0.675 43331 Bytes 25.01.2012 12:49:00
AVSCAN.EXE : 10.3.0.7 484008 Bytes 29.07.2011 08:22:04
AVSCAN.DLL : 10.0.5.0 57192 Bytes 29.07.2011 08:22:04
LUKE.DLL : 10.3.0.5 45416 Bytes 29.07.2011 08:22:20
LUKERES.DLL : 10.0.0.0 13672 Bytes 29.07.2011 08:22:20
AVSCPLR.DLL : 10.3.0.7 119656 Bytes 29.07.2011 08:22:31
AVREG.DLL : 10.3.0.9 88833 Bytes 29.07.2011 08:22:31
VBASE000.VDF : 7.10.0.0 19875328 Bytes 06.11.2009 08:21:36
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14.12.2010 08:21:42
VBASE002.VDF : 7.11.19.170 14374912 Bytes 20.12.2011 00:24:06
VBASE003.VDF : 7.11.21.238 4472832 Bytes 01.02.2012 15:33:07
VBASE004.VDF : 7.11.26.44 4329472 Bytes 28.03.2012 16:11:12
VBASE005.VDF : 7.11.29.136 2166272 Bytes 10.05.2012 14:29:23
VBASE006.VDF : 7.11.29.137 2048 Bytes 10.05.2012 14:29:23
VBASE007.VDF : 7.11.29.138 2048 Bytes 10.05.2012 14:29:23
VBASE008.VDF : 7.11.29.139 2048 Bytes 10.05.2012 14:29:23
VBASE009.VDF : 7.11.29.140 2048 Bytes 10.05.2012 14:29:23
VBASE010.VDF : 7.11.29.141 2048 Bytes 10.05.2012 14:29:23
VBASE011.VDF : 7.11.29.142 2048 Bytes 10.05.2012 14:29:23
VBASE012.VDF : 7.11.29.143 2048 Bytes 10.05.2012 14:29:24
VBASE013.VDF : 7.11.29.144 2048 Bytes 10.05.2012 14:29:24
VBASE014.VDF : 7.11.30.3 198144 Bytes 14.05.2012 14:16:38
VBASE015.VDF : 7.11.30.69 186368 Bytes 17.05.2012 10:06:06
VBASE016.VDF : 7.11.30.143 223744 Bytes 21.05.2012 18:15:07
VBASE017.VDF : 7.11.30.207 287744 Bytes 23.05.2012 17:09:58
VBASE018.VDF : 7.11.31.57 188416 Bytes 28.05.2012 20:55:29
VBASE019.VDF : 7.11.31.111 214528 Bytes 30.05.2012 12:55:19
VBASE020.VDF : 7.11.31.151 116736 Bytes 31.05.2012 18:17:57
VBASE021.VDF : 7.11.31.205 134144 Bytes 03.06.2012 14:16:50
VBASE022.VDF : 7.11.32.9 169472 Bytes 05.06.2012 19:01:09
VBASE023.VDF : 7.11.32.85 155648 Bytes 08.06.2012 04:21:13
VBASE024.VDF : 7.11.32.133 127488 Bytes 11.06.2012 19:10:05
VBASE025.VDF : 7.11.32.171 182784 Bytes 12.06.2012 19:58:00
VBASE026.VDF : 7.11.32.251 119296 Bytes 14.06.2012 03:45:58
VBASE027.VDF : 7.11.33.83 159232 Bytes 18.06.2012 18:40:18
VBASE028.VDF : 7.11.33.84 2048 Bytes 18.06.2012 18:40:18
VBASE029.VDF : 7.11.33.85 2048 Bytes 18.06.2012 18:40:18
VBASE030.VDF : 7.11.33.86 2048 Bytes 18.06.2012 18:40:18
VBASE031.VDF : 7.11.33.160 154112 Bytes 21.06.2012 13:23:35
Engineversion : 8.2.10.96
AEVDF.DLL : 8.1.2.8 106867 Bytes 01.06.2012 19:22:25
AESCRIPT.DLL : 8.1.4.28 455035 Bytes 21.06.2012 13:23:39
AESCN.DLL : 8.1.8.2 131444 Bytes 26.01.2012 22:59:04
AESBX.DLL : 8.2.5.12 606578 Bytes 14.06.2012 14:40:39
AERDL.DLL : 8.1.9.15 639348 Bytes 08.09.2011 22:17:56
AEPACK.DLL : 8.2.16.22 807288 Bytes 21.06.2012 13:23:39
AEOFFICE.DLL : 8.1.2.38 201083 Bytes 21.06.2012 13:23:38
AEHEUR.DLL : 8.1.4.52 4923767 Bytes 21.06.2012 13:23:38
AEHELP.DLL : 8.1.21.0 254326 Bytes 11.05.2012 04:45:57
AEGEN.DLL : 8.1.5.30 422261 Bytes 14.06.2012 14:40:34
AEEXP.DLL : 8.1.0.54 82293 Bytes 21.06.2012 13:23:39
AEEMU.DLL : 8.1.3.0 393589 Bytes 29.07.2011 08:21:53
AECORE.DLL : 8.1.25.10 201080 Bytes 31.05.2012 15:16:43
AEBB.DLL : 8.1.1.0 53618 Bytes 29.07.2011 08:21:52
AVWINLL.DLL : 10.0.0.0 19304 Bytes 29.07.2011 08:21:22
AVPREF.DLL : 10.0.3.2 44904 Bytes 29.07.2011 08:22:04
AVREP.DLL : 10.0.0.10 174120 Bytes 29.07.2011 08:22:31
AVARKT.DLL : 10.0.26.1 255336 Bytes 29.07.2011 08:21:58
AVEVTLOG.DLL : 10.0.0.9 203112 Bytes 29.07.2011 08:21:59
SQLITE3.DLL : 3.6.19.0 355688 Bytes 29.07.2011 08:22:22
AVSMTP.DLL : 10.0.0.17 63848 Bytes 29.07.2011 08:22:05
NETNT.DLL : 10.0.0.0 11624 Bytes 29.07.2011 08:22:20
RCIMAGE.DLL : 10.0.0.33 2901352 Bytes 29.07.2011 08:21:23
RCTEXT.DLL : 10.0.63.0 98664 Bytes 29.07.2011 08:21:23
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:,
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Donnerstag, 21. Juni 2012 16:35
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'AcroRd32.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'thunderbird.exe' - '98' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'firefox.exe' - '132' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.bin' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '69' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Windows\system32\dnssd.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'avgnt.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'hpwuschd2.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'soffice.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dropbox.exe' - '74' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'AVWEBGRD.EXE' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmailc.exe' - '53' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'dsNcService.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '64' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Windows\system32\dnssd.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'avguard.exe' - '86' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Durchsuche Prozess 'avfwsvc.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '62' Modul(e) wurden durchsucht
Modul ist OK -> <C:\Program Files (x86)\Bonjour\mdnsNSP.dll>
[WARNUNG] Die Datei konnte nicht geöffnet werden!
Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
[INFO] Es wurde kein Virus gefunden!
Bootsektor 'D:\'
[INFO] Es wurde kein Virus gefunden!
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '932' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\' <Niemandsrose>
C:\$Recycle.Bin\S-1-5-21-1701055086-3456072316-3754927457-1001\$RY3XBMT.zip
[0] Archivtyp: ZIP
--> google_analytical_evaluation.exe
[FUND] Ist das Trojanische Pferd TR/Pirminay.sax
Beginne mit der Suche in 'D:\' <Sprachgitter>
Beginne mit der Desinfektion:
C:\$Recycle.Bin\S-1-5-21-1701055086-3456072316-3754927457-1001\$RY3XBMT.zip
[FUND] Ist das Trojanische Pferd TR/Pirminay.sax
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5688c4c6.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 21. Juni 2012 20:38
Benötigte Zeit: 1:18:54 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
34551 Verzeichnisse wurden überprüft
609938 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
7 Dateien konnten nicht durchsucht werden
609930 Dateien ohne Befall
5426 Archive wurden durchsucht
7 Warnungen
1 Hinweise
426925 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden Hier das Ergebnis des OTL-Scans mit dem Code Deiner Antwortmail:OTL Logfile: Code:
OTL logfile created on: 28.06.2012 20:58:32 - Run 5
OTL by OldTimer - Version 3.2.51.0 Folder = C:\Users\Doppelleben\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,99 Gb Total Physical Memory | 1,25 Gb Available Physical Memory | 62,83% Memory free
3,98 Gb Paging File | 2,63 Gb Available in Paging File | 65,98% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 26,00 Gb Free Space | 26,63% Space Free | Partition Type: NTFS
Drive D: | 42,35 Gb Total Space | 30,94 Gb Free Space | 73,07% Space Free | Partition Type: NTFS
Computer Name: CHRISTINE-NB | User Name: Doppelleben | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.06.22 14:10:43 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
PRC - [2012.05.26 06:32:24 | 004,327,744 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Doppelleben\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Doppelleben\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011.09.08 09:15:22 | 000,670,792 | ---- | M] (Juniper Networks) -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe
PRC - [2011.07.29 10:22:21 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2011.07.29 10:22:05 | 000,428,200 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
PRC - [2011.07.29 10:22:03 | 000,340,136 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2011.07.29 10:22:02 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.07.29 10:22:02 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.07.29 10:22:01 | 000,567,464 | ---- | M] (Avira GmbH) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.01.17 19:50:34 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2011.01.17 19:50:34 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2010.10.25 15:13:42 | 000,821,144 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
========== Modules (No Company Name) ==========
MOD - [2012.03.16 20:30:35 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2011.06.24 22:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 22:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2010.10.25 15:15:46 | 000,019,968 | ---- | M] () -- C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\AcroTray.DEU
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2012.03.26 18:49:56 | 000,291,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2012.03.26 18:49:56 | 000,012,600 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.06.23 06:14:29 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.06.18 07:20:32 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.07 19:12:14 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.09.08 09:15:22 | 000,670,792 | ---- | M] (Juniper Networks) [Auto | Running] -- C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe -- (dsNcService)
SRV - [2011.07.29 10:22:21 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.07.29 10:22:05 | 000,428,200 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService)
SRV - [2011.07.29 10:22:03 | 000,340,136 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2011.07.29 10:22:02 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.07.29 10:22:01 | 000,567,464 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService)
SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.03.20 20:44:12 | 000,098,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.15 12:01:50 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.09.08 08:42:38 | 000,032,768 | ---- | M] (Juniper Networks) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dsNcAdpt.sys -- (dsNcAdpt)
DRV:64bit: - [2011.08.20 06:52:46 | 000,270,912 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2011.07.29 10:22:30 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011.07.29 10:22:29 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.07.29 10:22:28 | 000,131,336 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avfwot.sys -- (avfwot)
DRV:64bit: - [2011.07.29 10:22:28 | 000,101,984 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\avfwim.sys -- (avfwim)
DRV:64bit: - [2011.03.21 13:22:06 | 000,452,200 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.09.23 19:23:02 | 006,180,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 23:01:11 | 001,485,312 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTDPV6.SYS -- (SrvHsfV92)
DRV:64bit: - [2009.06.10 23:01:11 | 000,740,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTCNXT6.SYS -- (SrvHsfWinac)
DRV:64bit: - [2009.06.10 23:01:11 | 000,292,864 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VSTAZL6.SYS -- (SrvHsfHDA)
DRV:64bit: - [2009.06.10 22:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2008.05.06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007.08.03 05:35:54 | 000,011,392 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A0 F0 3E 15 7F 43 CB 01 [binary data]
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)"
FF - prefs.js..browser.startup.homepage: "hxxp://www.spiegel.de/"
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011.09.13 14:41:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\web2pdfextension@web2pdf.adobedotcom: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012.06.27 11:23:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 07:20:34 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.16 19:25:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.06.18 07:20:34 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Extensions
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.06.22 06:59:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Firefox\Profiles\zlhea29q.default\extensions
[2011.04.29 09:19:41 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Doppelleben\AppData\Roaming\Mozilla\Firefox\Profiles\zlhea29q.default\extensions\engine@conduit.com
[2012.03.20 07:05:27 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.04.13 22:24:38 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.06.10 21:20:14 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\DOPPELLEBEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZLHEA29Q.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012.06.18 07:20:34 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.01.10 14:20:25 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.01.10 14:20:25 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.01.10 14:20:25 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.01.10 14:20:25 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.01.10 14:20:25 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.01.10 14:20:25 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\gears.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Chrome\Application\11.0.696.65\gcswf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\PFiles\Plugins\np-mswmp.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.220.4 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U22 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Doppelleben\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
O1 HOSTS File: ([2012.06.23 14:22:04 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Doppelleben\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - Startup: C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Doppelleben\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O8 - Extra context menu item: &Citavi Picker... - C:\ProgramData\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://ssl.cms.hu-berlin.de/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D2656B2-96A0-4F00-8DA2-450C4C414309}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{f35a4036-d39f-11e0-877c-001bfb85d721}\Shell - "" = AutoRun
O33 - MountPoints2\{f35a4036-d39f-11e0-877c-001bfb85d721}\Shell\AutoRun\command - "" = "G:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: FreePDF Assistant - hkey= - key= - File not found
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2012.06.28 15:39:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.28 15:38:58 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.06.28 15:38:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.06.28 15:38:04 | 010,063,000 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Doppelleben\Desktop\mbam-setup-1.61.0.1400(1).exe
[2012.06.28 15:23:26 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Roaming\Malwarebytes
[2012.06.28 15:23:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.27 11:31:49 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2012.06.27 11:23:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
[2012.06.27 11:16:02 | 002,585,872 | ---- | C] (Microsoft Corporation) -- C:\Users\Doppelleben\WindowsInstaller-KB893803-v2-x86.exe
[2012.06.27 11:16:02 | 000,337,360 | ---- | C] (Adobe Systems Incorporated) -- C:\Users\Doppelleben\setup.exe
[2012.06.27 11:08:13 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\Akamai
[2012.06.22 16:24:29 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\CrashDumps
[2012.06.22 14:10:42 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
[2012.06.22 14:05:18 | 002,128,472 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Doppelleben\Desktop\TDSSKiller.exe
[2012.06.22 07:00:58 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\NPE
[2012.06.22 07:00:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Norton
[2012.06.22 06:30:22 | 002,844,736 | ---- | C] (Symantec Corporation) -- C:\Users\Doppelleben\Desktop\NPE.exe
[2012.06.21 21:25:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.06.10 20:28:13 | 000,000,000 | ---D | C] -- C:\Users\Doppelleben\AppData\Local\Macromedia
[1 C:\Users\Doppelleben\Desktop\*.tmp files -> C:\Users\Doppelleben\Desktop\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.06.28 20:14:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.28 15:41:58 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 15:41:58 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.28 15:39:00 | 000,001,125 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.28 15:38:10 | 010,063,000 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Doppelleben\Desktop\mbam-setup-1.61.0.1400(1).exe
[2012.06.28 15:34:25 | 000,000,338 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2012.06.28 15:33:16 | 000,000,328 | ---- | M] () -- C:\Windows\tasks\ljgcylopp.job
[2012.06.28 15:33:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.28 15:33:04 | 000,328,856 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.06.28 15:32:45 | 1603,084,288 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.27 11:23:49 | 000,002,038 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.06.27 11:22:48 | 005,634,323 | ---- | M] () -- C:\Users\Doppelleben\Desktop\00034529.pdf
[2012.06.22 16:11:09 | 000,729,880 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.22 16:11:09 | 000,618,370 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.22 16:11:09 | 000,107,650 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.06.22 14:10:43 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Doppelleben\Desktop\OTL.exe
[2012.06.22 06:30:39 | 002,844,736 | ---- | M] (Symantec Corporation) -- C:\Users\Doppelleben\Desktop\NPE.exe
[2012.06.21 15:39:34 | 000,022,269 | ---- | M] () -- C:\Users\Doppelleben\Desktop\Stellenausschreibung_14_12-1.pdf
[2012.06.20 21:11:20 | 002,128,472 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Doppelleben\Desktop\TDSSKiller.exe
[2012.06.18 21:14:30 | 000,114,688 | RHS- | M] () -- C:\Windows\SysWow64\usbceipj.dll
[2012.06.10 20:08:14 | 000,001,071 | ---- | M] () -- C:\Users\Doppelleben\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[1 C:\Users\Doppelleben\Desktop\*.tmp files -> C:\Users\Doppelleben\Desktop\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.06.28 15:39:00 | 000,001,125 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.27 11:23:49 | 000,002,465 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
[2012.06.27 11:23:49 | 000,002,453 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
[2012.06.27 11:23:49 | 000,002,038 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
[2012.06.27 11:22:41 | 005,634,323 | ---- | C] () -- C:\Users\Doppelleben\Desktop\00034529.pdf
[2012.06.27 11:16:02 | 000,074,752 | ---- | C] () -- C:\Users\Doppelleben\1036.mst
[2012.06.27 11:16:01 | 000,076,288 | ---- | C] () -- C:\Users\Doppelleben\1031.mst
[2012.06.27 11:16:01 | 000,003,584 | ---- | C] () -- C:\Users\Doppelleben\1033.mst
[2012.06.27 11:16:00 | 008,297,472 | ---- | C] () -- C:\Users\Doppelleben\AcroPro.msi
[2012.06.27 11:16:00 | 000,001,772 | ---- | C] () -- C:\Users\Doppelleben\ABCPY.INI
[2012.06.27 11:14:57 | 481,143,404 | ---- | C] () -- C:\Users\Doppelleben\Data1.cab
[2012.06.21 15:39:34 | 000,022,269 | ---- | C] () -- C:\Users\Doppelleben\Desktop\Stellenausschreibung_14_12-1.pdf
[2012.06.18 21:14:31 | 000,000,328 | ---- | C] () -- C:\Windows\tasks\ljgcylopp.job
[2012.06.18 21:14:30 | 000,114,688 | RHS- | C] () -- C:\Windows\SysWow64\usbceipj.dll
[2011.07.19 08:40:41 | 000,175,616 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2011.07.19 08:40:40 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2011.07.19 08:40:35 | 000,644,608 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2011.07.19 08:40:35 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2011.07.19 08:40:34 | 000,073,216 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2011.01.26 14:59:35 | 000,735,726 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.24 14:11:50 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
========== LOP Check ==========
[2011.03.22 21:17:35 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DAEMON Tools Lite
[2012.06.28 21:06:37 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Dropbox
[2012.05.14 22:02:19 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DVDVideoSoft
[2012.05.14 22:11:19 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.24 21:47:34 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\foobar2000
[2012.06.22 16:22:22 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\FreePDF
[2011.04.29 09:20:57 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\GetRightToGo
[2011.11.01 00:35:35 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\GlarySoft
[2011.11.21 14:11:09 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Juniper Networks
[2012.03.16 20:32:58 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\OpenOffice.org
[2011.04.29 09:19:59 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Softi Software
[2012.02.16 17:20:29 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Swiss Academic Software
[2011.06.06 17:22:49 | 000,000,000 | ---D | M] -- C:\Users\Doppelleben\AppData\Roaming\Thunderbird
[2012.06.28 15:34:25 | 000,000,338 | ---- | M] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012.06.28 15:33:16 | 000,000,328 | ---- | M] () -- C:\Windows\Tasks\ljgcylopp.job
[2012.04.01 11:10:26 | 000,032,620 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2011.08.01 12:35:56 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.06.28 16:59:28 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.08.24 13:52:21 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2010.09.10 00:57:54 | 000,000,000 | ---D | M] -- C:\PFiles
[2012.06.21 16:39:13 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.06.28 15:38:58 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.06.28 15:23:15 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.08.24 13:12:41 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.06.28 21:00:53 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.04 09:51:28 | 000,000,000 | ---D | M] -- C:\Update
[2011.07.10 17:14:10 | 000,000,000 | R--D | M] -- C:\Users
[2012.06.22 14:05:28 | 000,000,000 | ---D | M] -- C:\Windows
< %PROGRAMFILES%\*.exe >
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< MD5 for: AGP440.SYS >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
< MD5 for: ATAPI.SYS >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
< MD5 for: EXPLORER.EXE >
[2011.02.26 08:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011.02.26 07:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2009.10.31 07:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011.02.26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\explorer.exe
[2011.02.25 08:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011.02.26 08:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2009.08.03 08:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\SysWOW64\explorer.exe
[2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2009.10.31 08:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2009.08.03 07:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010.11.20 15:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009.10.31 08:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2009.08.03 07:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2009.10.31 08:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011.02.26 08:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2009.08.03 08:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
< MD5 for: IASTORV.SYS >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
< MD5 for: SCECLI.DLL >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
< MD5 for: USER32.DLL >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
< MD5 for: USERINIT.EXE >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
< MD5 for: WINLOGON.EXE >
[2012.04.04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\system32\*.dll /lockedfiles >
[2012.06.18 21:14:30 | 000,114,688 | RHS- | M] () Unable to obtain MD5 -- C:\Windows\system32\usbceipj.dll
< %USERPROFILE%\*.* >
[2010.10.26 00:47:38 | 000,076,288 | ---- | M] () -- C:\Users\Doppelleben\1031.mst
[2010.10.26 00:47:38 | 000,003,584 | ---- | M] () -- C:\Users\Doppelleben\1033.mst
[2010.10.26 00:47:38 | 000,074,752 | ---- | M] () -- C:\Users\Doppelleben\1036.mst
[2010.10.26 00:13:40 | 000,001,772 | ---- | M] () -- C:\Users\Doppelleben\ABCPY.INI
[2010.10.26 00:48:00 | 008,297,472 | ---- | M] () -- C:\Users\Doppelleben\AcroPro.msi
[2010.10.26 00:47:20 | 481,143,404 | ---- | M] () -- C:\Users\Doppelleben\Data1.cab
[2012.06.28 21:14:41 | 003,407,872 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat
[2012.06.28 21:14:41 | 000,262,144 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat.LOG1
[2010.08.24 13:12:56 | 000,000,000 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat.LOG2
[2010.08.24 13:41:41 | 000,065,536 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2010.08.24 13:41:41 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2010.08.24 13:41:41 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011.05.09 17:53:05 | 000,065,536 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{88b78d96-7980-11e0-95bf-001bfb85d721}.TM.blf
[2011.05.09 17:53:05 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{88b78d96-7980-11e0-95bf-001bfb85d721}.TMContainer00000000000000000001.regtrans-ms
[2011.05.09 17:53:05 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{88b78d96-7980-11e0-95bf-001bfb85d721}.TMContainer00000000000000000002.regtrans-ms
[2011.03.30 11:16:28 | 000,065,536 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{8c1e0a2d-5aa7-11e0-92fe-001bfb85d721}.TM.blf
[2011.03.30 11:16:28 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{8c1e0a2d-5aa7-11e0-92fe-001bfb85d721}.TMContainer00000000000000000001.regtrans-ms
[2011.03.30 11:16:28 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.dat{8c1e0a2d-5aa7-11e0-92fe-001bfb85d721}.TMContainer00000000000000000002.regtrans-ms
[2010.11.13 11:47:05 | 000,065,536 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{da6723bd-ef0a-11df-ba12-001bfb85d721}.TM.blf
[2010.11.13 11:47:05 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{da6723bd-ef0a-11df-ba12-001bfb85d721}.TMContainer00000000000000000001.regtrans-ms
[2010.11.13 11:47:05 | 000,524,288 | -HS- | M] () -- C:\Users\Doppelleben\NTUSER.DAT{da6723bd-ef0a-11df-ba12-001bfb85d721}.TMContainer00000000000000000002.regtrans-ms
[2010.08.24 13:12:56 | 000,000,020 | -HS- | M] () -- C:\Users\Doppelleben\ntuser.ini
[2010.10.26 00:48:06 | 000,337,360 | ---- | M] (Adobe Systems Incorporated) -- C:\Users\Doppelleben\setup.exe
[2010.10.26 00:13:42 | 002,585,872 | ---- | M] (Microsoft Corporation) -- C:\Users\Doppelleben\WindowsInstaller-KB893803-v2-x86.exe
< %USERPROFILE%\Local Settings\Temp\*.exe >
[2006.10.28 14:17:11 | 000,145,184 | R--- | M] (Microsoft Corporation) -- C:\Users\Doppelleben\Local Settings\Temp\ose00000.exe
[6 C:\Users\Doppelleben\Local Settings\Temp\*.tmp files -> C:\Users\Doppelleben\Local Settings\Temp\*.tmp -> ]
< %USERPROFILE%\Local Settings\Temp\*.dll >
[2009.07.14 03:15:21 | 000,462,848 | ---- | M] (Microsoft Corporation) -- C:\Users\Doppelleben\Local Settings\Temp\FirewallAPI.dll
[6 C:\Users\Doppelleben\Local Settings\Temp\*.tmp files -> C:\Users\Doppelleben\Local Settings\Temp\*.tmp -> ]
< %USERPROFILE%\Application Data\*.exe >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
< End of report >
--- --- --- |
