Hi,
auf dem besagten Rechner wurde der Virus erfolgreich mit einem Wiederherstellungspunkt bearbeitet. Ob das jetzt optimal ist, ist nicht mein Bier, da es nicht mein Rechner ist.
Nun habe ich das Ding selbst auf dem Rechner.
Und der OTL-Scan liefert auch an diesem Rechner wieder eine Fehlermeldung.
"Win32 Error. Code 23.
Datenfehler (CRC-Prüfung)"
ich weiß nicht genau, was mit einem Script ausführen bedeuten soll. Eigentlich bin ich exakt nach der Anleitung vorgegangen.
sry für Doppelpost, ich finde aber keine Bearbeiten-Option.
OTL liefert trotz der Fehlermeldung eine OTL.txt Code:
OTL logfile created on: 10.08.2012 11:00:26 - Run 1
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Users\Steffen\Desktop
64bit-Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,31 Gb Available Physical Memory | 57,88% Memory free
8,19 Gb Paging File | 6,20 Gb Available in Paging File | 75,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 20,60 Gb Free Space | 21,09% Space Free | Partition Type: NTFS
Drive D: | 234,37 Gb Total Space | 155,78 Gb Free Space | 66,47% Space Free | Partition Type: NTFS
Drive E: | 540,89 Gb Total Space | 7,40 Gb Free Space | 1,37% Space Free | Partition Type: NTFS
Drive L: | 3,75 Gb Total Space | 2,98 Gb Free Space | 79,27% Space Free | Partition Type: FAT32
Computer Name: STEFFEN-PC | User Name: Steffen | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012.08.09 18:13:36 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\Steffen\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.05.14 23:03:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.14 23:03:18 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
PRC - [2012.05.14 23:03:18 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
PRC - [2012.05.14 23:03:17 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.14 23:03:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
PRC - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe
PRC - [2011.10.05 07:32:35 | 000,272,896 | ---- | M] (TrekStor) -- C:\Users\Steffen\AppData\Roaming\Imbenu\bosez.exe
PRC - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.05.20 10:04:14 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
PRC - [2010.05.05 20:56:42 | 000,025,600 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe
PRC - [2010.05.05 20:51:56 | 001,212,928 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe
PRC - [2010.05.03 19:57:07 | 000,075,064 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2009.03.20 02:03:00 | 001,904,640 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
PRC - [2009.03.20 02:03:00 | 000,368,640 | ---- | M] (AVM Berlin) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe
PRC - [2008.12.02 21:34:40 | 000,070,144 | ---- | M] (AlcaTech) -- C:\Windows\SysWOW64\mmrtkrnl.exe
PRC - [2008.09.05 19:18:40 | 002,177,576 | ---- | M] (Gainward Co.) -- C:\Program Files (x86)\EXPERTool\TBPANEL.exe
PRC - [2008.07.23 18:04:20 | 005,625,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
PRC - [2008.07.14 10:14:38 | 000,615,936 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\aaCenter.exe
PRC - [2008.03.03 23:54:30 | 000,196,608 | ---- | M] () -- C:\Programme\Mouse\Amoumain.exe
PRC - [2007.07.23 16:43:42 | 000,057,344 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe
PRC - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe
PRC - [2007.02.01 11:13:06 | 000,094,208 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files (x86)\Creative\ShareDLL\CADI\NotiMan.exe
PRC - [2006.12.06 19:10:16 | 000,180,224 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
PRC - [2006.11.17 17:42:46 | 000,053,341 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Shared Files\CTSched.exe
PRC - [2005.10.21 19:12:22 | 000,040,960 | ---- | M] (Creative Technology Ltd) -- C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Entertainment Center\EAXLoadr.exe
========== Modules (No Company Name) ==========
MOD - [2012.08.09 15:14:30 | 000,217,600 | ---- | M] () -- C:\Users\Steffen\AppData\Local\Temp\soap0_wsdl.exe
MOD - [2011.07.29 01:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 01:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
MOD - [2010.12.22 10:01:20 | 000,186,880 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL
MOD - [2009.12.29 16:52:38 | 000,073,728 | ---- | M] () -- C:\Windows\SysWOW64\CmdRtr.DLL
MOD - [2008.07.23 18:04:20 | 005,625,344 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\FourEngine.exe
MOD - [2008.07.14 10:14:38 | 000,615,936 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\aaCenter.exe
MOD - [2008.03.03 23:54:30 | 000,196,608 | ---- | M] () -- C:\Programme\Mouse\Amoumain.exe
MOD - [2008.01.17 10:46:20 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\cpuutil.dll
MOD - [2006.01.10 10:50:20 | 000,024,576 | R--- | M] () -- C:\Windows\SysWOW64\AsIO.dll
MOD - [2005.06.22 11:39:56 | 000,204,851 | ---- | M] () -- C:\Program Files (x86)\ASUS\AASP\1.00.67\PowerDll.dll
MOD - [2005.05.11 17:39:32 | 000,565,248 | ---- | M] () -- C:\Program Files (x86)\ASUS\EPU-4 Engine\pngio.dll
MOD - [1998.10.31 11:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files (x86)\EXPERTool\TBManage.dll
========== Win32 Services (SafeList) ==========
SRV - [2012.08.02 20:59:56 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.07.18 21:29:24 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.14 23:03:22 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.14 23:03:18 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2012.05.14 23:03:18 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService)
SRV - [2012.05.14 23:03:17 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.03.01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.02.29 14:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.02.29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.26 16:08:56 | 003,665,752 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe -- (Radio.fx)
SRV - [2011.11.08 12:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Running] -- C:\Program Files (x86)\StarMoney 7.0\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate)
SRV - [2011.10.13 18:08:33 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service)
SRV - [2011.03.03 11:05:16 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service)
SRV - [2010.05.20 10:04:14 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService)
SRV - [2010.05.03 19:57:07 | 000,075,064 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.11 13:42:32 | 000,172,328 | ---- | M] (TeamViewer GmbH) [Disabled | Stopped] -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2009.12.08 20:58:27 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.12.07 07:13:14 | 000,397,312 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerScheduleService.exe -- (AVerScheduleService)
SRV - [2009.10.31 00:48:42 | 000,348,160 | ---- | M] (AVerMedia) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\AVerMedia\Service\AVerRemote.exe -- (AVerRemote)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.03.20 02:03:00 | 000,368,640 | ---- | M] (AVM Berlin) [Auto | Running] -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2008.11.28 00:24:28 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe -- (Creative ALchemy AL1 Licensing Service)
SRV - [2008.11.03 17:15:34 | 000,098,488 | ---- | M] (SiSoftware) [Disabled | Stopped] -- C:\Programme\SiSoftware Sandra Lite 2009.SP1\RpcAgentSrv.exe -- (SandraAgentSrv)
SRV - [2008.07.27 20:03:13 | 000,069,632 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007.03.06 11:35:02 | 000,198,168 | ---- | M] (InterVideo Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe -- (Capture Device Service)
SRV - [2006.12.14 18:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2005.11.17 16:18:52 | 001,527,900 | ---- | M] (MAGIX®) [Disabled | Stopped] -- C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
SRV - [2005.01.25 16:27:32 | 000,024,576 | ---- | M] (IBM) [Disabled | Stopped] -- C:\IFOR\WIN\BIN\i4lmd.exe -- (IBM LUM LMD)
SRV - [2004.07.23 16:11:08 | 000,024,576 | ---- | M] (IBM) [Disabled | Stopped] -- C:\IFOR\WIN\BIN\i4gdb.exe -- (IBM LUM CR)
SRV - [2004.07.23 16:11:06 | 000,024,576 | ---- | M] (IBM) [On_Demand | Stopped] -- C:\IFOR\WIN\BIN\i4llmd.exe -- (IBM LUM NDL)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2012.05.14 23:03:22 | 000,132,832 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.14 23:03:22 | 000,098,848 | ---- | M] () [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011.12.15 16:07:21 | 000,027,760 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.12.09 15:27:31 | 000,047,208 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tbhsd.sys -- (tbhsd)
DRV:64bit: - [2011.09.17 03:00:30 | 000,034,944 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SAlpham64.sys -- (SAlphamHid)
DRV:64bit: - [2010.10.01 09:36:33 | 000,828,912 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2010.09.30 23:25:10 | 000,040,104 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2010.09.16 08:08:50 | 001,077,416 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\mod77-64.sys -- (mod7764)
DRV:64bit: - [2010.09.14 15:16:15 | 000,125,888 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\AnyDVD.sys -- (AnyDVD)
DRV:64bit: - [2010.08.31 14:37:42 | 000,116,096 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\avmaura.sys -- (avmaura)
DRV:64bit: - [2010.07.13 11:53:56 | 000,576,480 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\cydtv.sys -- (CYDTV_SRV)
DRV:64bit: - [2010.05.05 22:30:52 | 001,561,688 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k)
DRV:64bit: - [2010.05.05 22:30:42 | 000,118,360 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia)
DRV:64bit: - [2010.05.05 22:30:34 | 000,213,080 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k)
DRV:64bit: - [2010.05.05 22:30:26 | 000,015,960 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k)
DRV:64bit: - [2010.05.05 22:30:18 | 000,179,288 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv)
DRV:64bit: - [2010.05.05 22:30:10 | 000,684,376 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k)
DRV:64bit: - [2010.05.05 22:30:02 | 000,580,696 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k)
DRV:64bit: - [2010.05.05 22:29:52 | 001,417,304 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX.SYS)
DRV:64bit: - [2010.05.05 22:29:52 | 001,417,304 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.SYS -- (CTEXFIFX)
DRV:64bit: - [2010.05.05 22:29:42 | 000,094,808 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT.SYS)
DRV:64bit: - [2010.05.05 22:29:42 | 000,094,808 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.SYS -- (CTHWIUT)
DRV:64bit: - [2010.05.05 22:29:34 | 000,202,840 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT.SYS)
DRV:64bit: - [2010.05.05 22:29:34 | 000,202,840 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.SYS -- (CT20XUT)
DRV:64bit: - [2009.11.24 03:38:00 | 000,016,008 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 03:37:50 | 000,022,408 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.11.09 19:12:42 | 000,035,112 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\teamviewervpn.sys -- (teamviewervpn)
DRV:64bit: - [2009.10.15 10:39:14 | 000,024,848 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\drivers\LUMDriver.sys -- (LUMDriver)
DRV:64bit: - [2009.09.11 12:49:18 | 000,076,552 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmXlCore.sys -- (WmXlCore)
DRV:64bit: - [2009.09.11 12:49:08 | 000,015,880 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmVirHid.sys -- (WmVirHid)
DRV:64bit: - [2009.09.11 12:48:46 | 000,041,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WmFilter.sys -- (WmFilter)
DRV:64bit: - [2009.09.11 12:48:36 | 000,026,248 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WmBEnum.sys -- (WmBEnum)
DRV:64bit: - [2009.09.11 07:47:24 | 000,615,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SkyNET_AMD64.SYS -- (SKYNET)
DRV:64bit: - [2009.08.05 07:18:34 | 000,057,856 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\L1E60x64.sys -- (L1E)
DRV:64bit: - [2009.07.31 12:40:32 | 000,025,600 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\XENfiltv.sys -- (XENfiltv)
DRV:64bit: - [2009.03.20 02:03:00 | 000,552,704 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\fwlanusbn.sys -- (fwlanusbn)
DRV:64bit: - [2009.03.20 02:03:00 | 000,014,120 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\avmeject.sys -- (avmeject)
DRV:64bit: - [2009.03.20 00:06:51 | 000,026,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2009.03.20 00:06:51 | 000,013,352 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ggflt.sys -- (ggflt)
DRV:64bit: - [2009.01.05 08:47:54 | 000,518,272 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\AVerAF15DMBTH64.sys -- (AVerAF15DMBTH64)
DRV:64bit: - [2008.02.13 17:20:16 | 000,017,920 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Amusbx64.sys -- (Amusbprt)
DRV:64bit: - [2008.01.21 04:51:07 | 000,016,384 | ---- | M] () [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008.01.21 04:47:28 | 000,046,080 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2007.10.16 21:02:22 | 000,167,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TTCinTun.sys -- (PTDVB)
DRV:64bit: - [2007.10.16 21:02:16 | 000,087,584 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TTCinCap.sys -- (Cap7146_DVB)
DRV:64bit: - [2007.10.15 12:39:18 | 000,021,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Amps2x64.sys -- (Amps2prt)
DRV:64bit: - [2007.10.15 12:37:22 | 000,012,288 | ---- | M] () [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\Amfltx64.sys -- (Amfilter)
DRV:64bit: - [2007.07.23 07:57:04 | 000,052,992 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Alpham164.sys -- (Alpham1)
DRV:64bit: - [2007.04.24 12:33:30 | 000,123,656 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125obex.sys -- (s125obex)
DRV:64bit: - [2007.04.24 12:33:28 | 000,126,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mgmt.sys -- (s125mgmt)
DRV:64bit: - [2007.04.24 12:33:26 | 000,144,648 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdm.sys -- (s125mdm)
DRV:64bit: - [2007.04.24 12:33:24 | 000,019,720 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125mdfl.sys -- (s125mdfl)
DRV:64bit: - [2007.04.24 12:33:14 | 000,108,296 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\s125bus.sys -- (s125bus)
DRV:64bit: - [2007.03.20 09:51:04 | 000,021,760 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\Alpham264.sys -- (Alpham2)
DRV:64bit: - [2006.11.02 01:23:00 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2010.09.14 15:16:15 | 000,125,888 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2008.10.31 17:28:26 | 000,022,944 | ---- | M] (SiSoftware) [Kernel | On_Demand | Stopped] -- C:\Programme\SiSoftware Sandra Lite 2009.SP1\WNt500x64\sandra.sys -- (SANDRA)
DRV - [2007.03.16 11:11:20 | 000,015,648 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)
DRV - [2006.05.05 20:21:00 | 000,004,608 | ---- | M] (NVIDIA Corporation.) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\nvport.sys -- (nvport)
DRV - [2006.03.29 09:49:26 | 000,009,856 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\pfc.sys -- (pfc)
DRV - [2004.12.23 05:47:10 | 000,027,392 | R--- | M] (Ulead Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\ULCDRHlp.sys -- (ULCDRHlp)
DRV - [2004.07.23 16:20:44 | 000,015,348 | ---- | M] (IBM) [Kernel | System | Running] -- C:\Windows\SysWOW64\drivers\LUMDriver.sys -- (LUMDriver)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1561552
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {AC854C16-CA1E-43f1-8513-0D2F36C726ED}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{AC854C16-CA1E-43f1-8513-0D2F36C726ED}: "URL" = hxxp://www.tryff.com/search/?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&rls=2j9e1fh7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box
========== FireFox ==========
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.2
FF - prefs.js..extensions.enabledItems: {c95a4e8e-816d-4655-8c79-d736da1adb6d}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {888d99e7-e8b5-46a3-851e-1ec45da1e644}:4.0.3
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 9
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {c666c018-6409-4479-afa3-68e4129e7eff}:1.0.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://www.tryff.com/search/?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&rls=2j9e1fh7&q="
FF - prefs.js..network.proxy.autoconfig_url: "hxxp://www.bib.hochschule-bonn-rhein-sieg.de/bibmedia/Downloads/bibliothek/proxy_pac-p-6656.pac"
FF - prefs.js..network.proxy.type: 2
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=14: C:\Program Files (x86)\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=8: C:\Program Files (x86)\Google\Update\1.2.183.29\npGoogleOneClick8.dll File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Steffen\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll File not found
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.07 22:53:22 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 21:29:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.25 13:53:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 0.9\extensions\\Components: C:\Program Files (x86)\Mozilla Sunbird\components [2010.04.29 21:39:46 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 0.9\extensions\\Plugins: C:\Program Files (x86)\Mozilla Sunbird\plugins [2012.02.25 13:53:04 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.06.25 13:50:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2010.12.12 22:15:24 | 000,000,000 | ---D | M]
[2010.09.08 14:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Extensions
[2010.09.08 14:51:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.08.06 19:59:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions
[2009.11.04 15:30:39 | 000,000,000 | ---D | M] (El-Bilder-Mod) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170633FE}
[2012.07.15 13:37:51 | 000,000,000 | ---D | M] (Hotspot Shield Community Toolbar) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\{c95a4e8e-816d-4655-8c79-d736da1adb6d}
[2009.11.19 08:48:53 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\firefox@tvunetworks.com
[2012.05.18 10:16:05 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Steffen\AppData\Roaming\mozilla\Firefox\Profiles\qmz057n6.default\extensions\ich@maltegoetz.de
[2009.10.02 11:05:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Steffen\AppData\Roaming\mozilla\Sunbird\Profiles\enaexsu9.default\extensions
[2012.08.06 19:59:06 | 000,000,853 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\11-suche.xml
[2012.08.06 19:59:06 | 000,002,209 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\englische-ergebnisse.xml
[2012.08.06 19:59:06 | 000,010,506 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\gmx-suche.xml
[2012.08.06 19:59:06 | 000,002,368 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\lastminute.xml
[2010.07.01 21:26:33 | 000,001,115 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\rapidshare-filefinder.xml
[2010.07.01 21:26:39 | 000,001,679 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\thepiratebayorg.xml
[2012.08.06 19:59:06 | 000,005,489 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\webde-suche.xml
[2010.07.01 21:26:10 | 000,004,140 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\qmz057n6.default\searchplugins\youtube.xml
[2012.03.17 21:33:57 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.04.16 18:23:06 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.12.07 22:53:22 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011.12.23 23:04:11 | 000,013,268 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\{C666C018-6409-4479-AFA3-68E4129E7EFF}.XPI
[2012.02.12 23:22:56 | 000,709,293 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
[2012.08.06 19:59:01 | 000,525,702 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2011.08.26 18:10:03 | 000,011,510 | ---- | M] () (No name found) -- C:\USERS\STEFFEN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\QMZ057N6.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2012.07.18 21:29:25 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.01 17:45:05 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2009.04.08 04:06:28 | 000,122,880 | ---- | M] (AB) -- C:\Program Files (x86)\mozilla firefox\plugins\NPOP7PlugIn.dll
[2012.02.12 01:35:48 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.12 01:35:48 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.12 01:35:48 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.12 01:35:48 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.12 01:35:48 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.12 01:35:48 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - Extension: No name found = C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: No name found = C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
O1 HOSTS File: ([2010.04.09 13:30:50 | 000,387,129 | R--- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 13351 more lines...
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:64bit: - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (TerraTec Home Cinema) - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\PROGRA~2\TerraTec\TERRAT~1\THCDES~1.DLL (TerraTec Electronic GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Windows\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [WheelMouse] C:\Programme\Mouse\Amoumain.exe ()
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin)
O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Module Loader] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [RCSystem] C:\Program Files (x86)\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Realtime Audio Engine] C:\Windows\SysWow64\mmrtkrnl.exe (AlcaTech)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [VolPanel] C:\Program Files (x86)\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [CreativeTaskScheduler] C:\Program Files (x86)\Creative\Shared Files\CTSched.exe (Creative Technology Ltd)
O4 - HKCU..\Run: [GAINWARD] C:\Program Files (x86)\EXPERTool\TBPanel.exe (Gainward Co.)
O4 - HKCU..\Run: [ICQ] C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKCU..\Run: [Utboke] C:\Users\Steffen\AppData\Roaming\Imbenu\bosez.exe (TrekStor)
O4 - HKLM..\RunServicesOnce: [capscanuninstall] "C:\Windows\command.com" /c del "C:\Users\Steffen\AppData\Local\Temp\uninstal.exe" File not found
O4 - Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O4 - Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Steffen\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O8:64bit: - Extra context menu item: &Download with BitKinex - C:\Program Files (x86)\BitKinex\ieext_cp.htm File not found
O8:64bit: - Extra context menu item: &Register in BitKinex - C:\Program Files (x86)\BitKinex\ieext_reg.htm File not found
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8:64bit: - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Download with BitKinex - C:\Program Files (x86)\BitKinex\ieext_cp.htm File not found
O8 - Extra context menu item: &Register in BitKinex - C:\Program Files (x86)\BitKinex\ieext_reg.htm File not found
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~3\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~3\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~3\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O9 - Extra 'Tools' menuitem : PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Program Files (x86)\PPLive\PPLive.exe ()
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range37 ([*] in Lokales Intranet)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{06D9105A-E318-482C-ADAC-6251240B2CB2}: DhcpNameServer = 0.0.0.0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{33F342AA-A31A-4140-AF45-B7E735F62911}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\grooveLocalGWS - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (acaptuser64.dll) - C:\Windows\SysNative\acaptuser64.dll ()
O20 - AppInit_DLLs: (acaptuser32.dll) - C:\Windows\SysWow64\acaptuser32.dll (Adobe Systems Incorporated)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe ()
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{53be69d7-c093-11dd-b040-00235401f696}\Shell - "" = AutoRun
O33 - MountPoints2\{53be69d7-c093-11dd-b040-00235401f696}\Shell\AutoRun\command - "" = M:\setup.exe
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell - "" = Autorun
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL O:\resycled\boot.com h:
O33 - MountPoints2\{a5ab8927-d73a-11dd-83e6-00235401f696}\Shell\Open\command - "" = O:\resycled\boot.com h:
O33 - MountPoints2\{b9f18b6c-43ce-11de-8f7f-00235401f696}\Shell - "" = AutoRun
O33 - MountPoints2\{b9f18b6c-43ce-11de-8f7f-00235401f696}\Shell\AutoRun\command - "" = L:\pushinst.exe
O33 - MountPoints2\{d3670a46-83f6-11de-b5e1-001c4afd1b7c}\Shell\AutoRun\command - "" = O:\InstallTomTomHOME.exe
O33 - MountPoints2\L\Shell\AutoRun\command - "" = novir/novir32.exe
O33 - MountPoints2\L\Shell\explore\command - "" = novir/novir32.exe
O33 - MountPoints2\L\Shell\open\command - "" = .\novir/novir32.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
========== Files/Folders - Created Within 30 Days ==========
[2012.08.09 18:23:47 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
[2012.08.09 15:16:04 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Kepaza
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Imbenu
[2012.08.08 22:17:25 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Caezi
[2012.08.02 19:19:26 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
[2012.07.29 11:18:46 | 000,000,000 | ---D | C] -- E:\Eigene Dateien\Dokumente\DVDFab
[2012.07.29 11:18:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8 Qt
[2012.07.29 11:18:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDFab 8 Qt
[2012.07.17 14:49:02 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\xm1
[2012.07.17 14:28:23 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\MiKTeX
[2012.07.17 14:28:20 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Local\MiKTeX
[2012.07.17 14:10:09 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Texmaker
[2012.07.17 14:10:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Texmaker
[2012.07.17 14:10:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Texmaker
[2012.07.17 14:08:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiKTeX 2.9
[2012.07.17 14:06:59 | 000,000,000 | ---D | C] -- C:\ProgramData\MiKTeX
[2012.07.17 14:02:37 | 000,000,000 | ---D | C] -- C:\Program Files\MiKTeX 2.9
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Ovovx
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Fyxial
[2012.07.15 17:34:16 | 000,000,000 | ---D | C] -- C:\Users\Steffen\AppData\Roaming\Atedu
[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Steffen\AppData\Roaming\*.tmp files -> C:\Users\Steffen\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.08.10 10:59:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.10 10:30:00 | 000,001,034 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012.08.10 10:22:03 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.10 10:22:00 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 10:22:00 | 000,003,712 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 10:21:55 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.10 10:21:52 | 4294,041,600 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.10 10:19:43 | 004,503,728 | ---- | M] () -- C:\ProgramData\ldsw_0paos.pad
[2012.08.10 10:07:00 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.10 09:57:30 | 001,445,310 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.08.10 09:57:30 | 000,628,504 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.08.10 09:57:30 | 000,595,798 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.08.10 09:57:30 | 000,126,248 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.08.10 09:57:30 | 000,103,872 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.08.10 09:56:04 | 000,001,356 | ---- | M] () -- C:\Users\Steffen\AppData\Local\d3d9caps.dat
[2012.08.10 09:47:43 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.10 09:47:43 | 000,061,616 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.10 09:47:43 | 000,000,788 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000005-00000000-00000002-00001102-00000005-002C1102}.rfx
[2012.08.09 18:13:36 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Steffen\Desktop\OTL.exe
[2012.08.09 15:21:37 | 000,001,460 | ---- | M] () -- C:\Users\Steffen\AppData\Local\d3d9caps64.dat
[2012.08.09 15:14:32 | 000,001,734 | ---- | M] () -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.08.09 15:05:51 | 000,000,859 | ---- | M] () -- C:\Windows\client.config.ini
[2012.08.09 13:04:10 | 000,151,552 | ---- | M] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.08.09 10:29:27 | 000,000,422 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{D3333D40-CCC0-4022-82C5-88EBDCAB575C}.job
[2012.08.02 20:59:56 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.02 20:59:56 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.02 19:19:26 | 000,000,318 | ---- | M] () -- C:\Users\Steffen\Desktop\Curse Client.appref-ms
[2012.07.29 11:12:58 | 000,000,125 | -HS- | M] () -- C:\ProgramData\.zreglib
[2012.07.17 14:10:09 | 000,000,838 | ---- | M] () -- C:\Users\Steffen\Desktop\Texmaker.lnk
[2012.07.15 18:31:32 | 001,913,550 | ---- | M] () -- C:\Users\Steffen\Desktop\2003-07-02--17-07-20.JPG
[6 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Steffen\AppData\Roaming\*.tmp files -> C:\Users\Steffen\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.08.09 15:30:01 | 4294,041,600 | -HS- | C] () -- C:\hiberfil.sys
[2012.08.09 15:14:32 | 004,503,728 | ---- | C] () -- C:\ProgramData\ldsw_0paos.pad
[2012.08.09 15:14:32 | 000,001,734 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
[2012.07.17 14:10:09 | 000,000,838 | ---- | C] () -- C:\Users\Steffen\Desktop\Texmaker.lnk
[2012.07.15 18:31:28 | 001,913,550 | ---- | C] () -- C:\Users\Steffen\Desktop\2003-07-02--17-07-20.JPG
[2012.06.23 18:26:37 | 000,017,408 | ---- | C] () -- C:\Users\Steffen\AppData\Local\WebpageIcons.db
[2012.03.14 12:07:45 | 000,000,856 | ---- | C] () -- C:\Users\Steffen\.recently-used.xbel
[2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2011.12.04 11:25:45 | 000,000,411 | ---- | C] () -- C:\Windows\cdplayer.ini
[2011.11.19 11:49:45 | 000,000,090 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\blckdom.res
[2011.09.29 20:34:35 | 000,000,399 | ---- | C] () -- C:\Users\Steffen\SaveInterface.bat
[2011.09.29 20:32:20 | 000,000,749 | ---- | C] () -- C:\Users\Steffen\SaveInterface.bat - Verknüpfung.lnk
[2011.09.26 19:15:15 | 000,000,000 | ---- | C] () -- C:\Users\Steffen\echo
[2011.07.06 22:37:31 | 000,000,064 | ---- | C] () -- C:\Windows\AVerText.ini
[2011.07.01 09:05:44 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\AVerIO.dll
[2011.07.01 09:05:44 | 000,003,456 | ---- | C] () -- C:\Windows\SysWow64\AVerIO.sys
[2011.07.01 09:05:42 | 000,606,208 | ---- | C] () -- C:\Windows\SysWow64\sptlib21.dll
[2011.07.01 09:05:42 | 000,311,296 | ---- | C] () -- C:\Windows\SysWow64\sptlib01.dll
[2011.07.01 09:05:42 | 000,294,912 | ---- | C] () -- C:\Windows\SysWow64\sptlib11.dll
[2011.07.01 09:05:42 | 000,290,816 | ---- | C] () -- C:\Windows\SysWow64\sptlib22.dll
[2011.07.01 09:05:42 | 000,249,856 | ---- | C] () -- C:\Windows\SysWow64\sptlib03.dll
[2011.07.01 09:05:42 | 000,225,280 | ---- | C] () -- C:\Windows\SysWow64\sptlib02.dll
[2011.07.01 09:05:42 | 000,135,168 | ---- | C] () -- C:\Windows\SysWow64\sptlib12.dll
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.31 08:59:24 | 000,002,169 | ---- | C] () -- C:\Windows\XENcfg.ini
[2011.03.19 22:46:31 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2011.03.03 12:37:56 | 000,000,029 | ---- | C] () -- C:\Windows\sfbm.INI
[2011.03.03 11:56:03 | 000,000,388 | ---- | C] () -- C:\Windows\XENMCcfg.ini
[2011.02.02 00:18:54 | 000,000,059 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\GoodnightTimer.ini
[2010.12.20 18:59:50 | 000,063,965 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.12.20 18:59:50 | 000,063,965 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.10.05 22:15:38 | 000,000,125 | -HS- | C] () -- C:\ProgramData\.zreglib
[2010.01.05 18:42:19 | 000,000,036 | ---- | C] () -- C:\Users\Steffen\AppData\Local\housecall.guid.cache
[2009.12.01 22:24:18 | 000,340,482 | ---- | C] () -- C:\Users\Steffen\Diskussion_Ergebnisse.odt
[2009.09.10 16:37:57 | 000,000,722 | ---- | C] () -- C:\Users\Steffen\RSD.rsdf
[2009.07.19 23:22:36 | 000,001,100 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d8caps.dat
[2009.02.07 16:25:09 | 000,013,232 | ---- | C] () -- C:\Program Files (x86)\EEIII - Kopie.ccf
[2008.12.09 22:47:51 | 000,000,564 | ---- | C] () -- C:\Users\Steffen\AppData\Roaming\AutoGK.ini
[2008.12.07 18:06:54 | 000,001,356 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d9caps.dat
[2008.12.06 16:46:54 | 000,000,064 | ---- | C] () -- C:\ProgramData\sandra.ldb
[2008.12.06 16:46:00 | 008,101,888 | ---- | C] () -- C:\ProgramData\sandra.mda
[2008.12.03 23:20:18 | 000,151,552 | ---- | C] () -- C:\Users\Steffen\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.11.26 23:57:17 | 000,001,460 | ---- | C] () -- C:\Users\Steffen\AppData\Local\d3d9caps64.dat
========== LOP Check ==========
[2011.08.28 10:56:05 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\#Short company name#
[2011.01.17 18:46:09 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Advanced Chemistry Development
[2009.09.03 14:25:47 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\AlcaTech
[2011.02.21 14:19:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Amazon
[2010.10.01 09:58:59 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\AquaSoft
[2012.07.15 17:34:16 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Atedu
[2012.01.22 15:17:36 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\BitKinex
[2012.08.09 15:15:32 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Caezi
[2009.07.11 18:35:26 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Canneverbe_Limited
[2009.06.26 10:43:28 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\capella-software
[2008.12.02 19:02:34 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DAEMON Tools
[2009.10.29 16:22:30 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DassaultSystemes
[2011.02.21 17:12:43 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Desktopicon
[2012.08.10 10:22:42 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Dropbox
[2010.10.01 10:12:34 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.04.01 00:44:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\FileZilla
[2010.10.29 12:00:44 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\FOG Downloader
[2009.03.24 19:03:40 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Foxit
[2012.07.18 21:40:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Fyxial
[2011.07.25 09:03:55 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\go
[2012.03.14 12:07:46 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\gtk-2.0
[2012.08.10 09:52:21 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\ICQ
[2009.08.04 22:49:31 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ideazon
[2012.08.08 22:17:25 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Imbenu
[2009.09.05 18:57:02 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\ImgBurn
[2011.09.02 09:30:37 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\IrfanView
[2011.09.13 14:30:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\JAM Software
[2009.11.15 20:06:30 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Juniper Networks
[2012.08.08 22:17:25 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Kepaza
[2011.11.19 11:49:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\kock
[2012.01.12 18:35:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Leadertech
[2010.12.05 14:36:27 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\LolClient
[2009.10.17 16:59:17 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\MAGIX
[2012.08.09 14:27:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Mumble
[2009.03.23 22:18:01 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\MyPhoneExplorer
[2008.12.03 23:08:53 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\OpenOffice.org
[2009.01.09 01:25:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Opera
[2012.07.18 22:23:00 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ovovx
[2009.10.03 19:04:56 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\PPLive
[2011.02.13 13:09:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\RIFT
[2009.03.18 23:18:09 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\RouterControl
[2011.01.27 17:41:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Rovio
[2009.03.15 17:17:22 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Sierra Entertainment
[2010.07.15 10:35:24 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Smart Recorder
[2010.02.15 18:26:31 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\TeamViewer
[2010.04.11 22:53:51 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Teeworlds
[2009.03.20 00:52:56 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Teleca
[2011.08.28 11:29:33 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\TerraTec
[2010.12.12 20:08:12 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\thriXXX
[2010.09.08 14:51:02 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Thunderbird
[2010.08.23 09:34:58 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Tobit
[2010.01.04 15:32:54 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Ulead Systems
[2008.11.28 01:14:17 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Wormux
[2011.01.28 16:40:35 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Wuala
[2011.04.17 14:51:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\Xilisoft
[2012.07.17 14:49:04 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\xm1
[2011.11.19 11:49:35 | 000,000,000 | ---D | M] -- C:\Users\Steffen\AppData\Roaming\xmldm
[2012.08.10 09:47:39 | 000,032,582 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2012.08.09 10:29:27 | 000,000,422 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{D3333D40-CCC0-4022-82C5-88EBDCAB575C}.job
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 841 bytes -> C:\Users\Steffen\Desktop\Ihre Anfrage - 056353 - XITRA.de.eml:OECustomProperty
@Alternate Data Stream - 229 bytes -> C:\ProgramData\TEMP:8FF81EB0
< End of report >
ja, mein Rechner ist zugemüllt und nicht up to date, aber Vista ließ sich nie updaten und geht mir auf die Nerven. :twak:
wenn der Virus, gibts auch ein frisches Win7 |
