Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   GVU-Trojaner: Trojan.Ransom.Gen (https://www.trojaner-board.de/124144-gvu-trojaner-trojan-ransom-gen.html)

berlyn 15.09.2012 21:11
GVU-Trojaner: Trojan.Ransom.Gen
 
Liebes Trojaner-Board-Team,

ich habe hier den Rechner eines Freundes stehen, der vermutlich mit einem GVU-Trojaner infiziert ist.

"Malwarebytes' Anti-Malware" wurde bereits ausgeführt, ebenso wie OTL und Gmer.

Vielen Dank vorab.

Nachfolgend die Log-Dateien:

MBAM-Log:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.10.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-PC [Administrator]

15.09.2012 17:48:10
mbam-log-2012-09-15 (17-48-10).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 196811
Laufzeit: 6 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\***\gewicht.exe (Trojan.ZADrop.Gen1) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk (Trojan.Ransom.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
OTL-Log:
Code:
OTL logfile created on: 15.09.2012 19:37:03 - Run 3
OTL by OldTimer - Version 3.2.61.4    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1021,76 Mb Total Physical Memory | 448,61 Mb Available Physical Memory | 43,91% Memory free
2,26 Gb Paging File | 1,21 Gb Available in Paging File | 53,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,02 Gb Total Space | 1,31 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive D: | 58,11 Gb Total Space | 34,36 Gb Free Space | 59,14% Space Free | Partition Type: NTFS
Drive E: | 21,23 Gb Total Space | 0,40 Gb Free Space | 1,91% Space Free | Partition Type: NTFS
Drive F: | 118,16 Gb Total Space | 7,49 Gb Free Space | 6,34% Space Free | Partition Type: NTFS
Drive G: | 59,57 Gb Total Space | 2,70 Gb Free Space | 4,53% Space Free | Partition Type: NTFS
Drive M: | 465,83 Gb Total Space | 294,82 Gb Free Space | 63,29% Space Free | Partition Type: NTFS
Drive N: | 400,00 Gb Total Space | 129,40 Gb Free Space | 32,35% Space Free | Partition Type: NTFS
Drive O: | 65,68 Gb Total Space | 8,90 Gb Free Space | 13,55% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - D:\Programme\Winamp\winampa.exe ()
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
PRC - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
PRC - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe ()
PRC - D:\Programme\Home Cinema\TV Enhance\TVEService.exe (CyberLink Corp.)
PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - D:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
PRC - C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - D:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Programme\ICQ\ICQNet.exe ()
PRC - C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - D:\Programme\Winamp\winampa.exe ()
MOD - D:\Programme\WinRAR\RarExt.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLTinyDB.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLCapEngine.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLSchMgr.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLCapSvcps.dll ()
MOD - C:\Programme\ICQ\ICQNet.exe ()
MOD - C:\Programme\ICQ\icqrt.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (TVECapSvc) -- D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
SRV - (TVESched) -- D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe ()
SRV - (NBService) -- D:\Programme\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (CCALib8) -- C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBAAPL) -- System32\Drivers\usbaapl.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (axdiifod) -- C:\Users\***\AppData\Local\Temp\axdiifod.sys File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Corp.)
DRV - (Ph3xIB32) -- C:\Windows\System32\drivers\Ph3xIB32.sys (Philips Semiconductors GmbH)
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lycos.de/
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: D:\Programme\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2105: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.07.11 22:53:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.07.11 22:53:54 | 000,000,000 | ---D | M]
 
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] D:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LanguageShortcut] D:\Programme\Home Cinema\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Mirabilis ICQ] C:\Programme\ICQ\ICQNet.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RemoteControl] D:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
O4 - HKLM..\Run: [TVEService] D:\Programme\Home Cinema\TV Enhance\TVEService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1146650413-166516795-3937567613-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra 'Tools' menuitem : ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6ACF4A85-B846-4F4D-9E34-C7D23233231E}: NameServer = 213.191.74.19 62.109.123.197
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O32 - Unable to obtain root file information for disk E:\
O32 - Unable to obtain root file information for disk F:\
O32 - Unable to obtain root file information for disk G:\
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.15 17:32:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.09.15 17:31:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.15 17:31:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.15 17:31:16 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.15 17:31:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.09.15 17:30:07 | 010,524,080 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.65.0.1400.exe
[2012.09.15 15:15:07 | 000,599,552 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.09.15 15:12:14 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\MueDomPC
[2012.09.15 13:11:19 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\tmp
[2012.08.30 21:47:56 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Lampen
[2012.08.28 17:53:05 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Türschloss
[2012.08.23 17:41:51 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\waggon
[2012.08.20 23:30:22 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\06185-LSV35-SingleSounds-WaterpumpsConductorsCouplers
[2012.08.20 23:30:18 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\06178-LSV35-SingleSounds-announcememts
[2012.08.17 01:23:17 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\DA_DI_COLL_V1
[2007.03.25 18:09:17 | 154,399,616 | ---- | C] (T-Online) -- C:\Users\***\T-Online_6.0.exe
[2007.03.25 18:09:13 | 008,965,498 | ---- | C] (Greentube AG) -- C:\Users\***\SkiChallenge2005Kitzbuehel_Version12a.exe
[2007.03.25 18:09:08 | 022,083,376 | ---- | C] (Apple Computer, Inc.) -- C:\Users\***\QuickTimeInstaller.exe
[2007.03.25 18:08:38 | 000,835,700 | ---- | C] (Macromedia, Inc.) -- C:\Users\***\Leuk.exe
[2007.03.25 18:08:35 | 004,258,276 | ---- | C] (Kerio Technologies                                          ) -- C:\Users\***\kerio-pf-4.0.0-win.exe
[2007.03.25 18:08:30 | 017,907,756 | ---- | C] (InstallShield Software Corporation) -- C:\Users\***\JAD516.exe
[2007.03.25 18:08:25 | 000,341,331 | ---- | C] (Macromedia, Inc.) -- C:\Users\***\FISH.EXE
[2007.03.25 18:08:03 | 035,097,792 | ---- | C] (Microsoft Corporation) -- C:\Users\***\directx_9c_redist.exe
[2007.03.25 18:07:34 | 022,504,744 | ---- | C] (Netopsystems AG                        ) -- C:\Users\***\AdbeRdr70_deu_full.exe
[2007.03.25 18:07:27 | 018,226,032 | ---- | C] (Netopsystems AG) -- C:\Users\***\AdbeRdr60_deu_full.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.15 18:44:01 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.15 18:00:38 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.15 18:00:38 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.15 18:00:27 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.15 18:00:14 | 1072,160,768 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.15 17:30:45 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.15 17:30:45 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.15 17:30:45 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.15 17:30:45 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.15 17:27:50 | 010,524,080 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\***\Desktop\mbam-setup-1.65.0.1400.exe
[2012.09.15 15:13:30 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.09.15 14:17:40 | 000,007,052 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.09.15 14:17:35 | 000,101,888 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.15 12:43:00 | 000,302,592 | ---- | M] () -- C:\Users\***\Desktop\okc2cb5f.exe
[2012.09.15 12:42:22 | 000,599,552 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.09.15 12:42:12 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2012.09.12 19:20:16 | 083,023,306 | ---- | M] () -- C:\ProgramData\avaj.pad
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.09.15 15:15:29 | 000,302,592 | ---- | C] () -- C:\Users\***\Desktop\okc2cb5f.exe
[2012.09.15 15:13:30 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.09.15 15:12:41 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2012.09.12 18:42:53 | 083,023,306 | ---- | C] () -- C:\ProgramData\avaj.pad
[2012.06.18 20:17:48 | 000,035,433 | ---- | C] () -- C:\Users\***\ARAG-Leistungsantrag1.pdf
[2012.04.11 20:17:10 | 000,113,492 | ---- | C] () -- C:\Users\***\ESt2011_Müller_***.elfo
[2011.04.08 20:33:21 | 000,117,440 | ---- | C] () -- C:\Users\***\ESt2010_Müller_***.elfo
[2009.01.15 17:04:09 | 000,024,806 | ---- | C] () -- C:\Users\***\***5.jpg
[2008.12.03 18:22:47 | 000,741,696 | ---- | C] () -- C:\Users\***\Stiftung Warentest Finanztest 2006.11-Riesterrente(Lesepflicht!!).pdf
[2008.12.03 18:21:29 | 000,073,831 | ---- | C] () -- C:\Users\***\Finanztest - Stiftung Warentest - Ratgeber Baufinanzierung - Geld Sparen 2008.pdf
[2008.08.09 17:06:41 | 004,086,373 | ---- | C] () -- C:\Users\***\v0649.mpg
[2008.08.09 17:06:41 | 001,679,686 | ---- | C] () -- C:\Users\***\v0642.wmv
[2008.08.09 17:06:41 | 001,366,931 | ---- | C] () -- C:\Users\***\v0675.wmv
[2008.08.09 17:06:40 | 003,207,190 | ---- | C] () -- C:\Users\***\v0501.mpeg
[2008.08.09 17:06:40 | 001,937,517 | ---- | C] () -- C:\Users\***\v0588.wmv
[2008.08.09 17:06:40 | 001,582,701 | ---- | C] () -- C:\Users\***\v0468.wmv
[2008.08.09 17:06:40 | 001,555,210 | ---- | C] () -- C:\Users\***\v0458.wmv
[2008.08.09 17:06:40 | 001,513,473 | ---- | C] () -- C:\Users\***\v0236.mpg
[2008.08.09 17:06:40 | 001,504,091 | ---- | C] () -- C:\Users\***\v0184.wmv
[2008.08.09 17:06:40 | 001,490,201 | ---- | C] () -- C:\Users\***\v0502.wmv
[2008.08.09 17:06:40 | 001,353,990 | ---- | C] () -- C:\Users\***\v0226.wmv
[2008.08.09 17:06:40 | 000,856,092 | ---- | C] () -- C:\Users\***\v0199.wmv
[2008.08.09 17:06:39 | 004,382,724 | ---- | C] () -- C:\Users\***\v0174.mpg
[2008.08.09 17:06:39 | 002,603,012 | ---- | C] () -- C:\Users\***\v0177.mpg
[2008.08.09 17:06:39 | 002,265,092 | ---- | C] () -- C:\Users\***\jobfrust.mpg
[2008.08.09 17:06:39 | 001,753,092 | ---- | C] () -- C:\Users\***\feine-herren.mpg
[2008.08.09 17:06:39 | 001,677,316 | ---- | C] () -- C:\Users\***\v0105.mpg
[2008.08.09 17:06:39 | 001,204,676 | ---- | C] () -- C:\Users\***\gentleman.mpeg
[2008.08.09 17:06:39 | 001,129,440 | ---- | C] () -- C:\Users\***\inspiration.mpeg
[2008.08.09 17:06:39 | 001,052,676 | ---- | C] () -- C:\Users\***\v0055.mpg
[2008.08.09 17:06:39 | 001,027,979 | ---- | C] () -- C:\Users\***\v0115.wmv
[2008.08.09 17:06:39 | 000,819,303 | ---- | C] () -- C:\Users\***\v0138.mpeg
[2008.08.09 17:06:39 | 000,751,620 | ---- | C] () -- C:\Users\***\fahrschule.mpeg
[2008.05.10 15:35:14 | 000,595,297 | ---- | C] () -- C:\Users\***\DSCN2117.JPG
[2008.05.10 15:35:00 | 000,588,361 | ---- | C] () -- C:\Users\***\DSCN2114.JPG
[2008.05.05 12:55:15 | 000,009,224 | ---- | C] () -- C:\Users\***\***4.jpg
[2008.04.08 12:42:53 | 000,007,052 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2008.03.17 15:15:30 | 000,461,011 | ---- | C] () -- C:\Users\***\Praxisbericht 01_Deloitte(28.02.08).pdf
[2007.10.28 12:45:43 | 002,948,891 | ---- | C] () -- C:\Users\***\El_Rey_del_martillo.wmv
[2007.10.28 12:45:43 | 002,793,560 | ---- | C] () -- C:\Users\***\bahnhof-markt.wmv
[2007.10.28 12:45:43 | 001,717,522 | ---- | C] () -- C:\Users\***\ScheissMontag.wmv
[2007.10.28 12:45:43 | 001,285,484 | ---- | C] () -- C:\Users\***\HowNOTToWorkOut.wmv
[2007.07.20 11:17:34 | 001,571,840 | ---- | C] () -- C:\Users\***\DasParadoxeunsererZeit.pps
[2007.06.16 15:53:22 | 000,069,052 | ---- | C] () -- C:\Users\***\***3.jpg
[2007.06.01 14:13:20 | 000,546,859 | ---- | C] () -- C:\Users\***\Surfen_und_Sparen_PCG_2007-04.pdf
[2007.05.07 10:29:57 | 000,796,396 | ---- | C] () -- C:\Users\***\.fonts.cache-1
[2007.04.21 00:15:03 | 001,652,736 | ---- | C] () -- C:\Users\***\ost.avi
[2007.04.19 18:26:51 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.04.06 11:21:03 | 000,060,551 | -H-- | C] () -- C:\Users\***\ZbThumbnail.info
[2007.03.31 11:21:59 | 000,000,078 | ---- | C] () -- C:\Users\***\AppData\Roaming\Default.PLS
[2007.03.25 18:09:52 | 002,372,760 | ---- | C] () -- C:\Users\***\winzip90.exe
[2007.03.25 18:09:52 | 000,986,173 | ---- | C] () -- C:\Users\***\wrar330d.exe
[2007.03.25 18:09:52 | 000,957,465 | ---- | C] () -- C:\Users\***\wrar320d.exe
[2007.03.25 18:09:52 | 000,051,200 | ---- | C] () -- C:\Users\***\WitzehartanderGrenze.pps
[2007.03.25 18:09:51 | 004,833,616 | ---- | C] () -- C:\Users\***\winamp509_full_emusic-8basic.exe
[2007.03.25 18:09:50 | 004,567,928 | ---- | C] () -- C:\Users\***\winamp506_full.exe
[2007.03.25 18:09:49 | 004,437,216 | ---- | C] () -- C:\Users\***\winamp50superprealphaleetness2_full_noaod.exe
[2007.03.25 18:09:49 | 004,376,975 | ---- | C] () -- C:\Users\***\winamp503_full.exe
[2007.03.25 18:09:49 | 000,153,600 | ---- | C] () -- C:\Users\***\Wieviel sind 60 GB.pps
[2007.03.25 18:09:48 | 001,929,851 | ---- | C] () -- C:\Users\***\Voting_Machine.wmv
[2007.03.25 18:09:48 | 001,624,068 | ---- | C] () -- C:\Users\***\WEDDING.mpg
[2007.03.25 18:09:48 | 000,832,000 | ---- | C] () -- C:\Users\***\Wer-reitet-so-spaet-durch-Nacht-und-Wind.pps
[2007.03.25 18:09:48 | 000,327,168 | ---- | C] () -- C:\Users\***\Vier-Soehne.pps
[2007.03.25 18:09:48 | 000,305,664 | ---- | C] () -- C:\Users\***\wennfrauendieweltregierenwuerden1.pps
[2007.03.25 18:09:48 | 000,078,694 | ---- | C] () -- C:\Users\***\WC-Papier.jpg
[2007.03.25 18:09:48 | 000,028,672 | ---- | C] () -- C:\Users\***\Wer9702B.pps
[2007.03.25 18:09:47 | 003,808,075 | ---- | C] () -- C:\Users\***\Versaute Kurz Sex Comics 2.pdf
[2007.03.25 18:09:47 | 000,031,002 | ---- | C] () -- C:\Users\***\VHS_Kurse.pdf
[2007.03.25 18:09:46 | 005,051,685 | ---- | C] () -- C:\Users\***\Versaute Kurz Sex Comics.pdf
[2007.03.25 18:09:46 | 001,216,512 | ---- | C] () -- C:\Users\***\VERRUECKTE_WELT_1.PPS
[2007.03.25 18:09:46 | 000,576,000 | ---- | C] () -- C:\Users\***\Urlaubsentscheidung.pps
[2007.03.25 18:09:46 | 000,373,824 | ---- | C] () -- C:\Users\***\Urlaub_026.jpg
[2007.03.25 18:09:46 | 000,033,347 | ---- | C] () -- C:\Users\***\unbez09.jpg
[2007.03.25 18:09:46 | 000,028,720 | ---- | C] () -- C:\Users\***\unbez10.jpg
[2007.03.25 18:09:46 | 000,028,201 | ---- | C] () -- C:\Users\***\unbez12.jpg
[2007.03.25 18:09:45 | 001,835,284 | ---- | C] () -- C:\Users\***\Unbenannt(2).tif
[2007.03.25 18:09:45 | 001,835,284 | ---- | C] () -- C:\Users\***\Unbenannt(1).tif
[2007.03.25 18:09:45 | 000,061,404 | ---- | C] () -- C:\Users\***\unbez08.jpg
[2007.03.25 18:09:45 | 000,060,923 | ---- | C] () -- C:\Users\***\unbez05.jpg
[2007.03.25 18:09:45 | 000,042,857 | ---- | C] () -- C:\Users\***\unbez02.jpg
[2007.03.25 18:09:45 | 000,039,961 | ---- | C] () -- C:\Users\***\unbez07.jpg
[2007.03.25 18:09:45 | 000,034,747 | ---- | C] () -- C:\Users\***\unbez01.jpg
[2007.03.25 18:09:45 | 000,031,691 | ---- | C] () -- C:\Users\***\unbez04.jpg
[2007.03.25 18:09:45 | 000,027,224 | ---- | C] () -- C:\Users\***\unbez03.jpg
[2007.03.25 18:09:44 | 003,121,136 | ---- | C] () -- C:\Users\***\umbro.mpg
[2007.03.25 18:09:44 | 001,570,304 | ---- | C] () -- C:\Users\***\TV-Quiz.pps
[2007.03.25 18:09:44 | 000,046,592 | ---- | C] () -- C:\Users\***\U KAMENNOGO_ Cafe_St.Petersburg(11.09.03)
[2007.03.25 18:09:43 | 004,235,776 | ---- | C] () -- C:\Users\***\tuebingen-show.pps
[2007.03.25 18:09:43 | 000,439,808 | ---- | C] () -- C:\Users\***\tshirts.pps
[2007.03.25 18:09:17 | 000,045,905 | ---- | C] () -- C:\Users\***\Tina3(30.04.05).jpg
[2007.03.25 18:09:17 | 000,043,703 | ---- | C] () -- C:\Users\***\Tina.jpg
[2007.03.25 18:09:17 | 000,039,190 | ---- | C] () -- C:\Users\***\Ti-Club-01.jpg
[2007.03.25 18:09:17 | 000,035,621 | ---- | C] () -- C:\Users\***\Tina2(30.04.05).jpg
[2007.03.25 18:09:17 | 000,032,612 | ---- | C] () -- C:\Users\***\Tina1(30.04.05).jpg
[2007.03.25 18:09:15 | 006,039,556 | ---- | C] () -- C:\Users\***\THE-NIKE-BEACH-EDITION.mpg
[2007.03.25 18:09:15 | 001,463,808 | ---- | C] () -- C:\Users\***\Telekom-aktien.pps
[2007.03.25 18:09:15 | 001,247,232 | ---- | C] () -- C:\Users\***\straende2003_1.pps
[2007.03.25 18:09:15 | 000,765,001 | ---- | C] () -- C:\Users\***\slsk152.exe
[2007.03.25 18:09:15 | 000,536,576 | ---- | C] () -- C:\Users\***\Tausche Mann gegen Katze.pps
[2007.03.25 18:09:15 | 000,397,312 | ---- | C] () -- C:\Users\***\Spiele-Quiz.pps
[2007.03.25 18:09:15 | 000,033,864 | ---- | C] () -- C:\Users\***\th_0_big.jpg
[2007.03.25 18:09:15 | 000,032,845 | ---- | C] () -- C:\Users\***\Tagesmotto.jpg
[2007.03.25 18:09:15 | 000,000,412 | ---- | C] () -- C:\Users\***\spider.sav
[2007.03.25 18:09:13 | 000,129,024 | ---- | C] () -- C:\Users\***\sensibel.pps
[2007.03.25 18:09:13 | 000,095,744 | ---- | C] () -- C:\Users\***\Schuhe.pps
[2007.03.25 18:09:13 | 000,092,397 | ---- | C] () -- C:\Users\***\sitz und höcker.jpg
[2007.03.25 18:09:13 | 000,055,659 | ---- | C] () -- C:\Users\***\Schiebebühne1.jpg
[2007.03.25 18:09:13 | 000,054,628 | ---- | C] () -- C:\Users\***\Schiebebühne2.jpg
[2007.03.25 18:09:13 | 000,052,739 | ---- | C] () -- C:\Users\***\Schiebebühne3.jpg
[2007.03.25 18:09:13 | 000,046,752 | ---- | C] () -- C:\Users\***\Simone.jpg
[2007.03.25 18:09:13 | 000,031,937 | ---- | C] () -- C:\Users\***\Simone3.jpg
[2007.03.25 18:09:13 | 000,030,636 | ---- | C] () -- C:\Users\***\Simone2.jpg
[2007.03.25 18:09:13 | 000,023,717 | ---- | C] () -- C:\Users\***\san2 schwarz-weiß.jpg
[2007.03.25 18:09:12 | 000,278,132 | ---- | C] () -- C:\Users\***\reifen4.pdf
[2007.03.25 18:09:12 | 000,039,038 | ---- | C] () -- C:\Users\***\S_0374.jpg
[2007.03.25 18:09:12 | 000,010,403 | ---- | C] () -- C:\Users\***\Reklamation Esprit(07.05.06).pdf
[2007.03.25 18:09:08 | 000,284,160 | ---- | C] () -- C:\Users\***\pussymassage..pps
[2007.03.25 18:09:08 | 000,113,835 | ---- | C] () -- C:\Users\***\Postkarten 004.jpg
[2007.03.25 18:09:08 | 000,101,098 | ---- | C] () -- C:\Users\***\Postkarten.jpg
[2007.03.25 18:09:08 | 000,098,569 | ---- | C] () -- C:\Users\***\Postkarten 002.jpg
[2007.03.25 18:09:08 | 000,097,506 | ---- | C] () -- C:\Users\***\pic01298.pcx
[2007.03.25 18:09:08 | 000,075,893 | ---- | C] () -- C:\Users\***\Postkarten 003.jpg
[2007.03.25 18:09:08 | 000,063,221 | ---- | C] () -- C:\Users\***\Postkarten 001.jpg
[2007.03.25 18:09:08 | 000,040,374 | ---- | C] () -- C:\Users\***\plärrer.jpg
[2007.03.25 18:09:07 | 004,521,988 | ---- | C] () -- C:\Users\***\Pepsi Piercing.mpeg
[2007.03.25 18:09:07 | 000,654,336 | ---- | C] () -- C:\Users\***\oeltankerunfall.pps
[2007.03.25 18:09:07 | 000,143,173 | ---- | C] () -- C:\Users\***\OSRAM_Bewerbung.pdf
[2007.03.25 18:09:07 | 000,112,340 | ---- | C] () -- C:\Users\***\Party.jpg
[2007.03.25 18:09:07 | 000,077,280 | ---- | C] () -- C:\Users\***\ninja_zx12r.pdf
[2007.03.25 18:09:07 | 000,060,416 | ---- | C] () -- C:\Users\***\Pech_1.pps
[2007.03.25 18:09:06 | 000,139,776 | ---- | C] () -- C:\Users\***\Neugier.pps
[2007.03.25 18:09:06 | 000,077,456 | ---- | C] () -- C:\Users\***\ninja_zx10r.pdf
[2007.03.25 18:08:59 | 033,831,916 | ---- | C] () -- C:\Users\***\Nero-6.6.0.13.exe
[2007.03.25 18:08:53 | 031,607,334 | ---- | C] () -- C:\Users\***\Nero-6.6.0.8a.exe
[2007.03.25 18:08:49 | 021,734,668 | ---- | C] () -- C:\Users\***\nero6009.exe
[2007.03.25 18:08:49 | 000,640,000 | ---- | C] () -- C:\Users\***\NATURALE.PPS
[2007.03.25 18:08:49 | 000,024,141 | ---- | C] () -- C:\Users\***\Nelly1.jpg
[2007.03.25 18:08:49 | 000,020,473 | ---- | C] () -- C:\Users\***\Nelly2.jpg
[2007.03.25 18:08:49 | 000,009,575 | ---- | C] () -- C:\Users\***\nal599_1.jpg
[2007.03.25 18:08:49 | 000,007,581 | ---- | C] () -- C:\Users\***\nal387_1.jpg
[2007.03.25 18:08:48 | 003,807,236 | ---- | C] () -- C:\Users\***\montavit-the-hero_1.mpg
[2007.03.25 18:08:48 | 000,964,612 | ---- | C] () -- C:\Users\***\myNewCoat.mpg.mpg
[2007.03.25 18:08:48 | 000,067,731 | ---- | C] () -- C:\Users\***\mime001.jpg
[2007.03.25 18:08:47 | 004,047,460 | ---- | C] () -- C:\Users\***\Mieze in the mix.wmv
[2007.03.25 18:08:47 | 000,695,808 | ---- | C] () -- C:\Users\***\mehr-ossi-wissen.pps
[2007.03.25 18:08:47 | 000,074,570 | ---- | C] () -- C:\Users\***\Melly3.jpg
[2007.03.25 18:08:40 | 029,864,473 | ---- | C] () -- C:\Users\***\mediamaker_107.exe
[2007.03.25 18:08:40 | 002,909,920 | ---- | C] () -- C:\Users\***\Mauerbau.mpg
[2007.03.25 18:08:39 | 001,220,608 | ---- | C] () -- C:\Users\***\ma80_32.exe
[2007.03.25 18:08:39 | 000,196,608 | ---- | C] () -- C:\Users\***\Männerregeln.pps
[2007.03.25 18:08:39 | 000,060,071 | ---- | C] () -- C:\Users\***\lokomotivwm80.jpg
[2007.03.25 18:08:39 | 000,059,961 | ---- | C] () -- C:\Users\***\lokomotiv78468.jpg
[2007.03.25 18:08:39 | 000,059,392 | ---- | C] () -- C:\Users\***\Logisches Wo.pps
[2007.03.25 18:08:39 | 000,018,944 | ---- | C] () -- C:\Users\***\Lohn.pps
[2007.03.25 18:08:39 | 000,004,914 | ---- | C] () -- C:\Users\***\mas256_1.jpg
[2007.03.25 18:08:39 | 000,000,132 | ---- | C] () -- C:\Users\***\Lothar Gallus.vcf
[2007.03.25 18:08:38 | 003,867,620 | ---- | C] () -- C:\Users\***\Liebesspiel.mpeg
[2007.03.25 18:08:38 | 000,794,112 | ---- | C] () -- C:\Users\***\Kuriositäten[1].pps
[2007.03.25 18:08:38 | 000,181,248 | ---- | C] () -- C:\Users\***\Libertad-para-Bolivia.pps
[2007.03.25 18:08:38 | 000,045,568 | ---- | C] () -- C:\Users\***\Krankenhaus.pps
[2007.03.25 18:08:38 | 000,008,772 | ---- | C] () -- C:\Users\***\kri549_1.jpg
[2007.03.25 18:08:37 | 003,037,798 | ---- | C] () -- C:\Users\***\klitekpp241d.exe
[2007.03.25 18:08:37 | 002,002,824 | ---- | C] () -- C:\Users\***\klimaanlage.exe
[2007.03.25 18:08:36 | 000,706,048 | ---- | C] () -- C:\Users\***\Kids.pps
[2007.03.25 18:08:36 | 000,496,128 | ---- | C] () -- C:\Users\***\Kleinanzeigen.pps
[2007.03.25 18:08:35 | 001,979,392 | ---- | C] () -- C:\Users\***\Katja.pps
[2007.03.25 18:08:35 | 000,661,504 | ---- | C] () -- C:\Users\***\Katze.pps
[2007.03.25 18:08:35 | 000,003,841 | ---- | C] () -- C:\Users\***\keinbild_thumb120x180.jpg
[2007.03.25 18:08:34 | 001,667,584 | ---- | C] () -- C:\Users\***\Karren_und_Frauen.pps
[2007.03.25 18:08:34 | 000,126,464 | ---- | C] () -- C:\Users\***\JustChecking.pps
[2007.03.25 18:08:34 | 000,031,232 | ---- | C] () -- C:\Users\***\Jokes-1.pps
[2007.03.25 18:08:34 | 000,007,229 | ---- | C] () -- C:\Users\***\jul365_5.jpg
[2007.03.25 18:08:34 | 000,004,279 | ---- | C] () -- C:\Users\***\jan215_5.jpg
[2007.03.25 18:08:29 | 003,207,935 | ---- | C] () -- C:\Users\***\isenbeck-ballet.asf
[2007.03.25 18:08:29 | 000,303,616 | ---- | C] () -- C:\Users\***\IKEA-Stuhl_mit_Anleitung.pps
[2007.03.25 18:08:29 | 000,155,648 | ---- | C] () -- C:\Users\***\insel.pps
[2007.03.25 18:08:29 | 000,065,262 | ---- | C] () -- C:\Users\***\image2.jpg
[2007.03.25 18:08:29 | 000,062,090 | ---- | C] () -- C:\Users\***\Ina 039.jpg
[2007.03.25 18:08:29 | 000,032,616 | ---- | C] () -- C:\Users\***\image.jpg
[2007.03.25 18:08:29 | 000,014,748 | ---- | C] () -- C:\Users\***\Ilka_München(15.07.04).jpg
[2007.03.25 18:08:29 | 000,008,286 | ---- | C] () -- C:\Users\***\iri037_1.jpg
[2007.03.25 18:08:28 | 002,447,994 | ---- | C] () -- C:\Users\***\hand-rolled.mpeg
[2007.03.25 18:08:28 | 001,902,000 | ---- | C] () -- C:\Users\***\icqlite_german.exe
[2007.03.25 18:08:28 | 000,372,736 | ---- | C] () -- C:\Users\***\HommageandieFrau-anmutigundzerbrechlich.pps
[2007.03.25 18:08:28 | 000,372,736 | ---- | C] () -- C:\Users\***\Hommage an die Frau - anmutig und zerbrechlich.pps
[2007.03.25 18:08:28 | 000,160,737 | ---- | C] () -- C:\Users\***\Hochzeit.jpg
[2007.03.25 18:08:28 | 000,022,300 | ---- | C] () -- C:\Users\***\i-1.jpg
[2007.03.25 18:08:27 | 000,408,064 | ---- | C] () -- C:\Users\***\Guten Morgen.pps
[2007.03.25 18:08:27 | 000,323,210 | ---- | C] () -- C:\Users\***\Ginnastica2.m1v
[2007.03.25 18:08:27 | 000,304,128 | ---- | C] () -- C:\Users\***\Geister.pps
[2007.03.25 18:08:27 | 000,276,353 | ---- | C] () -- C:\Users\***\Ginnastica1.m1v
[2007.03.25 18:08:27 | 000,234,876 | ---- | C] () -- C:\Users\***\Ginnastica3.m1v
[2007.03.25 18:08:27 | 000,176,543 | ---- | C] () -- C:\Users\***\Ginnastica4.m1v
[2007.03.25 18:08:27 | 000,093,586 | ---- | C] () -- C:\Users\***\gsx-r1000.pdf
[2007.03.25 18:08:27 | 000,088,064 | ---- | C] () -- C:\Users\***\Hallo-Freunde.pps
[2007.03.25 18:08:27 | 000,088,064 | ---- | C] () -- C:\Users\***\GLÜCKSWITZ.pps
[2007.03.25 18:08:27 | 000,075,776 | ---- | C] () -- C:\Users\***\G-Punkt1.pps
[2007.03.25 18:08:27 | 000,070,656 | ---- | C] () -- C:\Users\***\FUR_MEIN.pps
[2007.03.25 18:08:27 | 000,059,469 | ---- | C] () -- C:\Users\***\goethe.jpg
[2007.03.25 18:08:27 | 000,026,765 | ---- | C] () -- C:\Users\***\haha.jpg
[2007.03.25 18:08:27 | 000,009,717 | ---- | C] () -- C:\Users\***\Gutscheine.pdf
[2007.03.25 18:08:26 | 002,847,124 | ---- | C] () -- C:\Users\***\funny_cats_1 (1).wmv
[2007.03.25 18:08:26 | 001,495,040 | ---- | C] () -- C:\Users\***\Fun 112.pps
[2007.03.25 18:08:25 | 001,391,616 | ---- | C] () -- C:\Users\***\Fahrzeuge.pps
[2007.03.25 18:08:25 | 000,103,424 | ---- | C] () -- C:\Users\***\Frauen1.pps
[2007.03.25 18:08:25 | 000,079,985 | ---- | C] () -- C:\Users\***\Foto%20Frauen%201b.jpg
[2007.03.25 18:08:25 | 000,075,643 | ---- | C] () -- C:\Users\***\Flugzeug.jpg
[2007.03.25 18:08:25 | 000,075,264 | ---- | C] () -- C:\Users\***\Frauen.pps
[2007.03.25 18:08:24 | 004,902,912 | ---- | C] () -- C:\Users\***\eurcncs185030.mpeg
[2007.03.25 18:08:24 | 000,139,776 | ---- | C] () -- C:\Users\***\Erhöhung.pps
[2007.03.25 18:08:24 | 000,073,728 | ---- | C] () -- C:\Users\***\Erfolg.pps
[2007.03.25 18:08:23 | 000,209,408 | ---- | C] () -- C:\Users\***\EinfachmaleinnettesHALLO-usc.pps
[2007.03.25 18:08:23 | 000,064,000 | ---- | C] () -- C:\Users\***\eine-tolle-Frau.pps
[2007.03.25 18:08:22 | 003,239,325 | ---- | C] () -- C:\Users\***\eftp3setup_31281.exe
[2007.03.25 18:08:21 | 001,064,960 | ---- | C] () -- C:\Users\***\Echtgut!.pps
[2007.03.25 18:08:21 | 000,328,192 | ---- | C] () -- C:\Users\***\Durchfah.pps
[2007.03.25 18:08:20 | 000,890,880 | ---- | C] () -- C:\Users\***\Dry_Wet.pps
[2007.03.25 18:08:20 | 000,025,548 | ---- | C] () -- C:\Users\***\drogen_01.jpg
[2007.03.25 18:08:18 | 011,520,418 | ---- | C] () -- C:\Users\***\DrDivX.exe
[2007.03.25 18:08:17 | 001,043,142 | ---- | C] () -- C:\Users\***\DM1.BMP
[2007.03.25 18:08:17 | 000,186,880 | ---- | C] () -- C:\Users\***\doktorco.pps
[2007.03.25 18:08:17 | 000,154,662 | ---- | C] () -- C:\Users\***\DM6.jpg
[2007.03.25 18:08:17 | 000,108,126 | ---- | C] () -- C:\Users\***\DM2.JPG
[2007.03.25 18:08:17 | 000,059,192 | ---- | C] () -- C:\Users\***\DM8.jpg
[2007.03.25 18:08:17 | 000,055,750 | ---- | C] () -- C:\Users\***\DM4.jpg
[2007.03.25 18:08:17 | 000,045,066 | ---- | C] () -- C:\Users\***\download.jpg
[2007.03.25 18:08:17 | 000,039,242 | ---- | C] () -- C:\Users\***\downloa.jpg
[2007.03.25 18:08:17 | 000,014,121 | ---- | C] () -- C:\Users\***\DM5.jpg
[2007.03.25 18:08:17 | 000,010,262 | ---- | C] () -- C:\Users\***\DM3.JPG
[2007.03.25 18:08:17 | 000,009,202 | ---- | C] () -- C:\Users\***\DM_Neu.JPG
[2007.03.25 18:08:16 | 004,008,129 | ---- | C] () -- C:\Users\***\DivX505b_Bundle.exe
[2007.03.25 18:08:12 | 005,317,584 | ---- | C] () -- C:\Users\***\DivX51_Bundle.exe
[2007.03.25 18:08:03 | 000,291,546 | ---- | C] () -- C:\Users\***\Digitalkamera.pdf
[2007.03.25 18:08:03 | 000,184,832 | ---- | C] () -- C:\Users\***\Die-schlaue-MAMA.pps
[2007.03.25 18:08:03 | 000,077,312 | ---- | C] () -- C:\Users\***\Die Fee.pps
[2007.03.25 18:08:03 | 000,045,890 | ---- | C] () -- C:\Users\***\der_beste_schiedsrichter.jpg
[2007.03.25 18:08:02 | 001,478,880 | ---- | C] () -- C:\Users\***\DEODORAN.MPE
[2007.03.25 18:08:02 | 000,012,961 | ---- | C] () -- C:\Users\***\default_jobs_bild4.jpg
[2007.03.25 18:08:01 | 002,760,380 | ---- | C] () -- C:\Users\***\DeepBurner1_110117.exe
[2007.03.25 18:08:01 | 002,502,692 | ---- | C] () -- C:\Users\***\de_mc_br_fireblade_2004.pdf
[2007.03.25 18:08:00 | 001,680,252 | ---- | C] () -- C:\Users\***\DE3.mpg
[2007.03.25 18:08:00 | 000,358,889 | ---- | C] () -- C:\Users\***\DasistMobbing.mpeg
[2007.03.25 18:08:00 | 000,307,712 | ---- | C] () -- C:\Users\***\DasBett.pps
[2007.03.25 18:08:00 | 000,040,537 | ---- | C] () -- C:\Users\***\***3.jpg
[2007.03.25 18:08:00 | 000,037,255 | ---- | C] () -- C:\Users\***\***4.jpg
[2007.03.25 18:08:00 | 000,034,594 | ---- | C] () -- C:\Users\***\***_MoTown(15.06.04).jpg
[2007.03.25 18:07:59 | 000,640,054 | ---- | C] () -- C:\Users\***\***2.BMP
[2007.03.25 18:07:59 | 000,452,608 | ---- | C] () -- C:\Users\***\comics.pps
[2007.03.25 18:07:59 | 000,169,216 | ---- | C] () -- C:\Users\***\*** - Vorstand.JPG
[2007.03.25 18:07:59 | 000,032,513 | ---- | C] () -- C:\Users\***\***.jpg
[2007.03.25 18:07:58 | 002,242,705 | ---- | C] () -- C:\Users\***\CBR1000RR_zubeh.pdf
[2007.03.25 18:07:58 | 000,049,546 | ---- | C] () -- C:\Users\***\chatroom.JPG
[2007.03.25 18:07:58 | 000,044,274 | ---- | C] () -- C:\Users\***\chagall-marc-der-blumenstrauss-der-den-himmel-erleuchtet.jpg
[2007.03.25 18:07:58 | 000,024,112 | ---- | C] () -- C:\Users\***\CIMG0419.jpg
[2007.03.25 18:07:55 | 009,491,011 | ---- | C] () -- C:\Users\***\Canon_Software.pdf
[2007.03.25 18:07:54 | 004,452,373 | ---- | C] () -- C:\Users\***\Canon Photoshot A 620.pdf
[2007.03.25 18:07:54 | 000,094,476 | ---- | C] () -- C:\Users\***\C17_Launch_Over_Crew.jpg
[2007.03.25 18:07:53 | 001,469,159 | ---- | C] () -- C:\Users\***\Burn4Free_Setup.exe
[2007.03.25 18:07:53 | 000,386,048 | ---- | C] () -- C:\Users\***\bros.pps
[2007.03.25 18:07:53 | 000,188,928 | ---- | C] () -- C:\Users\***\Brillant.pps
[2007.03.25 18:07:53 | 000,047,432 | ---- | C] () -- C:\Users\***\Bullenreiten.jpg
[2007.03.25 18:07:53 | 000,030,843 | ---- | C] () -- C:\Users\***\Bundeswehr.JPG
[2007.03.25 18:07:50 | 009,595,392 | ---- | C] () -- C:\Users\***\Brennsoftware_setup.exe
[2007.03.25 18:07:50 | 000,238,080 | ---- | C] () -- C:\Users\***\Boooo.pps
[2007.03.25 18:07:50 | 000,139,776 | ---- | C] () -- C:\Users\***\brazil_girl.pps
[2007.03.25 18:07:50 | 000,064,807 | ---- | C] () -- C:\Users\***\BR 78 355.jpg
[2007.03.25 18:07:50 | 000,063,656 | ---- | C] () -- C:\Users\***\BR 38 3389.jpg
[2007.03.25 18:07:50 | 000,054,889 | ---- | C] () -- C:\Users\***\BR 38 1803.jpg
[2007.03.25 18:07:50 | 000,030,826 | ---- | C] () -- C:\Users\***\BR 05 mit Zug.JPG
[2007.03.25 18:07:50 | 000,027,859 | ---- | C] () -- C:\Users\***\BR 05.JPG
[2007.03.25 18:07:50 | 000,026,450 | ---- | C] () -- C:\Users\***\BR 01.JPG
[2007.03.25 18:07:49 | 001,300,992 | ---- | C] () -- C:\Users\***\bodybuilding1[1].pps
[2007.03.25 18:07:48 | 002,536,960 | ---- | C] () -- C:\Users\***\bldsinn.pps
[2007.03.25 18:07:48 | 002,369,536 | ---- | C] () -- C:\Users\***\Bildermix3.pps
[2007.03.25 18:07:48 | 000,139,226 | ---- | C] () -- C:\Users\***\Bild 1 Ratespiel.jpg
[2007.03.25 18:07:48 | 000,062,765 | ---- | C] () -- C:\Users\***\bike von seite2.jpg
[2007.03.25 18:07:48 | 000,060,311 | ---- | C] () -- C:\Users\***\bike von seite.jpg
[2007.03.25 18:07:48 | 000,056,024 | ---- | C] () -- C:\Users\***\Bild 2 Ratespiel.jpg
[2007.03.25 18:07:48 | 000,042,797 | ---- | C] () -- C:\Users\***\Bild036.jpg
[2007.03.25 18:07:47 | 000,049,659 | ---- | C] () -- C:\Users\***\baby.jpg
[2007.03.25 18:07:47 | 000,043,531 | ---- | C] () -- C:\Users\***\Badeanzug.jpg
[2007.03.25 18:07:47 | 000,040,371 | ---- | C] () -- C:\Users\***\Bettina.jpg
[2007.03.25 18:07:44 | 010,759,539 | ---- | C] () -- C:\Users\***\avg70free_298a417.exe
[2007.03.25 18:07:44 | 000,156,160 | ---- | C] () -- C:\Users\***\aufkl.pps
[2007.03.25 18:07:44 | 000,037,687 | ---- | C] () -- C:\Users\***\austrian_village.jpg
[2007.03.25 18:07:43 | 002,327,552 | ---- | C] () -- C:\Users\***\artistesdelephemere.pps
[2007.03.25 18:07:43 | 001,463,808 | ---- | C] () -- C:\Users\***\ARMYGIRLS.pps
[2007.03.25 18:07:43 | 000,563,200 | ---- | C] () -- C:\Users\***\arbeitstag.pps
[2007.03.25 18:07:43 | 000,032,992 | ---- | C] () -- C:\Users\***\Anlage hinten.JPG
[2007.03.25 18:07:43 | 000,031,156 | ---- | C] () -- C:\Users\***\Anlagenbild.JPG
[2007.03.25 18:07:43 | 000,029,698 | ---- | C] () -- C:\Users\***\Anlage vorne.JPG
[2007.03.25 18:07:43 | 000,021,299 | ---- | C] () -- C:\Users\***\Anlagenplaner 1080.jpg
[2007.03.25 18:07:43 | 000,009,431 | ---- | C] () -- C:\Users\***\ank485_2.jpg
[2007.03.25 18:07:43 | 000,006,878 | ---- | C] () -- C:\Users\***\any858_4.jpg
[2007.03.25 18:07:42 | 001,712,640 | ---- | C] () -- C:\Users\***\Akt-Rene-Rosie-Tenison.pps
[2007.03.25 18:07:42 | 000,716,288 | ---- | C] () -- C:\Users\***\Angelitos.pps
[2007.03.25 18:07:42 | 000,066,048 | ---- | C] () -- C:\Users\***\alter47-.pps
[2007.03.25 18:07:42 | 000,034,249 | ---- | C] () -- C:\Users\***\ANGEBER.jpg
[2007.03.25 18:07:41 | 001,698,304 | ---- | C] () -- C:\Users\***\Akt-Foxy-Feliciti.pps
[2007.03.25 18:07:27 | 000,071,891 | ---- | C] () -- C:\Users\***\251204%20132.jpg
[2007.03.25 18:07:27 | 000,061,371 | ---- | C] () -- C:\Users\***\215997_0_gross_img_0244.jpg
[2007.03.25 18:07:27 | 000,047,301 | ---- | C] () -- C:\Users\***\988704-large.jpg
[2007.03.25 18:07:27 | 000,044,551 | ---- | C] () -- C:\Users\***\3376867_400.jpg
[2007.03.25 18:07:27 | 000,037,009 | ---- | C] () -- C:\Users\***\949974-large.jpg
[2007.03.25 18:07:27 | 000,035,086 | ---- | C] () -- C:\Users\***\707880-large.jpg
[2007.03.25 18:07:27 | 000,025,280 | ---- | C] () -- C:\Users\***\988989-large.jpg
[2007.03.25 18:07:27 | 000,016,489 | ---- | C] () -- C:\Users\***\32214_large.jpg
[2007.03.25 18:07:27 | 000,010,172 | ---- | C] () -- C:\Users\***\307965413_thumb640x480.jpg
[2007.03.25 18:07:27 | 000,009,947 | ---- | C] () -- C:\Users\***\243838.jpg
[2007.03.25 18:07:26 | 001,091,584 | ---- | C] () -- C:\Users\***\501LostintheSchilderwaldundsoSkc.pps
[2007.03.25 18:07:26 | 000,183,808 | ---- | C] () -- C:\Users\***\76.pps
[2007.03.25 18:07:26 | 000,065,405 | ---- | C] () -- C:\Users\***\007.jpg
[2007.03.25 18:07:26 | 000,057,237 | ---- | C] () -- C:\Users\***\66af91a90fb150aea91816732.jpg
[2007.03.25 18:07:26 | 000,012,649 | ---- | C] () -- C:\Users\***\39_1.jpg
[2007.03.25 18:07:25 | 000,936,808 | ---- | C] () -- C:\Users\***\6.pdf
[2007.03.25 18:07:25 | 000,073,216 | ---- | C] () -- C:\Users\***\5_Geheimnisse.pps
[2007.03.25 18:07:25 | 000,069,120 | ---- | C] () -- C:\Users\***\5Frauen.pps
[2007.03.25 18:07:24 | 003,122,688 | ---- | C] () -- C:\Users\***\4ugly.avi
[2007.03.25 18:07:24 | 000,080,384 | ---- | C] () -- C:\Users\***\1_IQ-Test.pps
[2007.03.25 18:07:24 | 000,060,206 | ---- | C] () -- C:\Users\***\1_DiePfortpflanzung1.pdf
[2007.03.25 18:07:24 | 000,017,920 | ---- | C] () -- C:\Users\***\4.jpg
[2007.03.25 18:07:23 | 000,894,781 | ---- | C] () -- C:\Users\***\zoomplayer320rc1std.zip
[2007.03.25 18:07:21 | 010,226,356 | ---- | C] () -- C:\Users\***\lf2_v171.zip
[2007.03.25 18:07:20 | 000,307,432 | ---- | C] () -- C:\Users\***\dsj210.zip
[2007.03.25 18:07:17 | 000,933,376 | ---- | C] () -- C:\Users\***\Zwar-nur-schwarz-weiss-aber-oho.pps
[2007.03.25 18:07:17 | 000,230,912 | ---- | C] () -- C:\Users\***\wuestensturm.pps
[2007.03.25 17:18:59 | 000,101,888 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== LOP Check ==========
 
[2012.04.11 20:00:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2010.07.03 04:30:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2010.09.17 06:53:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2007.03.26 17:36:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQLite
[2009.02.25 19:09:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ProtectDisc
[2009.06.17 20:07:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RetroShare
[2012.09.15 17:58:42 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\***\WEDDING.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0649.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0501.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0236.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0177.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0174.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0138.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0105.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0055.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\umbro.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\THE-NIKE-BEACH-EDITION.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Pepsi Piercing.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\ost.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\myNewCoat.mpg.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\montavit-the-hero_1.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Mauerbau.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Liebesspiel.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\jobfrust.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\inspiration.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\hand-rolled.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica4.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica3.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica2.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica1.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\gentleman.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\feine-herren.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\fahrschule.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\eurcncs185030.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\Red Hot Chili Peppers - Snow (Hey Oh) (live at Top Of The Pops).mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\bounce.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DEODORAN.MPE:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DE3.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DasistMobbing.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\4ugly.avi:TOC.WMV

< End of report >
OTL-Extras-Log:
Code:
OTL Extras logfile created on: 15.09.2012 19:37:03 - Run 3
OTL by OldTimer - Version 3.2.61.4    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1021,76 Mb Total Physical Memory | 448,61 Mb Available Physical Memory | 43,91% Memory free
2,26 Gb Paging File | 1,21 Gb Available in Paging File | 53,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,02 Gb Total Space | 1,31 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive D: | 58,11 Gb Total Space | 34,36 Gb Free Space | 59,14% Space Free | Partition Type: NTFS
Drive E: | 21,23 Gb Total Space | 0,40 Gb Free Space | 1,91% Space Free | Partition Type: NTFS
Drive F: | 118,16 Gb Total Space | 7,49 Gb Free Space | 6,34% Space Free | Partition Type: NTFS
Drive G: | 59,57 Gb Total Space | 2,70 Gb Free Space | 4,53% Space Free | Partition Type: NTFS
Drive M: | 465,83 Gb Total Space | 294,82 Gb Free Space | 63,29% Space Free | Partition Type: NTFS
Drive N: | 400,00 Gb Total Space | 129,40 Gb Free Space | 32,35% Space Free | Partition Type: NTFS
Drive O: | 65,68 Gb Total Space | 8,90 Gb Free Space | 13,55% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Programme\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DisableUnicastResponsesToMulticastBroadcast" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{26AC08C8-7767-422A-918A-CD7FBAB783E7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{44FE109A-401C-464C-9B10-09FD9A2C6325}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{76B82FBB-BDD7-4E3B-80C6-4259E573CDF4}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C93F150B-E1AB-4B55-B3F9-C873E307AC36}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{066F5FB0-93E0-4484-B576-8159FFA260AC}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{092E5778-4F88-4F57-A625-AF4A14A8E424}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{0D3193F5-8A02-4DF6-950B-0123E093BBCD}" = protocol=17 | dir=in | app=d:\programme\smartftp client\smartftp.exe |
"{0F8C3F62-E4B2-41C4-8ED2-0C5D95A85CCB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{132062CE-C552-4AF8-9D59-BFB29228A5C3}" = dir=in | app=d:\programme\home cinema\tv enhance\tvenhance.exe |
"{1332D507-D9E3-4079-A75B-E4D32732F0FC}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{1F11936A-1E8C-47A4-9E96-6FC6D01AB23C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe |
"{20C8233D-C59E-4341-AE11-56DA1B6A7820}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{26A607F8-81D5-4A4B-ABEE-B58B6FF7BB5F}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
"{289F8806-B8A1-41FF-895F-5650F26D6523}" = protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{2DE8D9B0-A182-4F29-92A9-373C62E77375}" = dir=in | app=d:\programme\home cinema\makedisc\makedisc.exe |
"{2F57E7C5-4995-4581-8D95-A10BEE4D3DF0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{3900B50D-7104-4713-9C5D-1A99A552C27F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{3B91F124-D9D5-44FF-87A4-4C3A421469E7}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{549A9B1A-60DD-4133-A0DA-DF38AF16BE8A}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{57DBB606-39CE-4F75-8C9D-1B14A179A5CA}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{58FA129A-F3E3-41F5-9789-7C26F5A44D6B}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{654CF35D-6780-46A9-B798-6697014AF73B}" = protocol=6 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{67F3DC72-C6A9-4506-8745-CE7B251DD52D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
"{698CAC0E-938B-4EFD-AB87-048AE0E7C6E8}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{7B4CCAC2-00DC-4977-8ABC-B9CBC6B62751}" = protocol=17 | dir=in | app=c:\program files\antivir personaledition classic\avcenter.exe |
"{7CE8B2E6-5C4C-4C56-AE2D-54424C510D8D}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
"{87A7F54D-2E19-4070-A8CA-74CC603D26D0}" = protocol=6 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{88555B21-1E35-45D0-92C2-9EA17CB692AB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"{8948A4B3-DF9A-42EA-B5BD-F0ECC43C5259}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{93DE69AE-E76C-42E3-B6CF-6A6AC4A61796}" = protocol=6 | dir=in | app=d:\programme\smartftp client\smartftp.exe |
"{9ED762B9-6AE7-4A2F-8133-CF653036FBE7}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{A44AF5AC-767B-4374-8751-7B48A16D4360}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
"{AED83BD7-2611-4DC5-B78B-65ADE9E852EC}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
"{B706B0BA-1EC1-4431-B139-B7CD2585AA9F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{DA3B6311-2D2D-4ABD-A129-D8F78A8A0612}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{DB3D2A88-CC9F-41FC-BB6D-DAD602BC3E47}" = protocol=6 | dir=in | app=c:\program files\antivir personaledition classic\avcenter.exe |
"{DD94DD14-0551-40DC-AFBA-A5B5D3A3A990}" = dir=in | app=d:\programme\home cinema\tv enhance\tveservice.exe |
"{E8E594FB-FD87-453D-9994-AFA4B1C86261}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{EF879693-6B62-4E4F-8085-119444E703BF}" = protocol=17 | dir=out | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"{F6D4EC18-A1EF-4072-A9C0-9B43C826DF10}" = protocol=6 | dir=in | svc=wcescomm | app=%systemroot%\system32\svchost.exe |
"TCP Query User{103C5DB7-5021-4E55-938D-373D46C2CAEE}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{83DA893B-7841-4566-BC26-515423302E8C}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"TCP Query User{A0D2F195-CA38-4C40-942C-010247CCB99B}C:\program files\icq\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq\icq.exe |
"TCP Query User{B76CE582-1580-48CA-9F1C-B92D63995F15}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{CA14C971-333A-4FC7-94E2-601127BB09CD}D:\programme\icqlite\icqlite.exe" = protocol=6 | dir=in | app=d:\programme\icqlite\icqlite.exe |
"TCP Query User{DF01D447-0740-49EC-B0FB-0C647A260F4D}D:\programme\retroshare\retroshare.exe" = protocol=6 | dir=in | app=d:\programme\retroshare\retroshare.exe |
"UDP Query User{1D44B6EB-142A-450D-B6FA-0A08BD3FDA8E}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{4B9E8A98-992C-4F61-83D4-260F4996FFD2}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{A5EABBAA-C373-4988-9D72-D12580B2E70C}D:\programme\retroshare\retroshare.exe" = protocol=17 | dir=in | app=d:\programme\retroshare\retroshare.exe |
"UDP Query User{C4646718-6810-4834-BC11-CB25CE3D3219}C:\program files\icq\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq\icq.exe |
"UDP Query User{CD308D50-191E-4911-A85E-0BF2B18C4A13}D:\programme\icqlite\icqlite.exe" = protocol=17 | dir=in | app=d:\programme\icqlite\icqlite.exe |
"UDP Query User{D9109EBE-A86E-4611-9B2E-17E430C2E42C}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{06A1D88C-E102-4527-AF70-29FFD7AF215A}" = Scan
"{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
"{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Camera Window DS
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 29
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2F173C40-563E-11D4-89C5-0010ADDAAC33}" = EA.com Matchup
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{497072FE-0A75-4E5C-A5B7-EB1FA67F66F1}" = DJ_AIO_06_F4500_SW_MIN
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4DBBF091-FACD-422C-B43C-786335BD5398}" = MovieEdit Task
"{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Camera Window DVC
"{55A7B938-3D1E-4819-A87B-F83E736EF52E}" = F4500
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{63B75E16-F290-4FCD-AF67-A9134CD01031}" = Nero 7 Essentials
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Camera Window MC
"{6F23C1A3-9F62-470C-BD12-B83F04E67865}" = SmartFTP Client
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{75247E38-5C9B-45D6-ADF8-E11CB56B4990}" = Network
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F08A772-2816-4F46-84F1-49578502AD28}" = HP Deskjet F4500 Printer Driver Software 13.0 Rel .6
"{81D62C32-0984-11D3-86CD-00105AD33021}" = Caere Scan Manager 5.1
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = PhotoStitch
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90170407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Camera Access Library
"{903B0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Project Professional 2003
"{90510407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Visio Professional 2003
"{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
"{93973C6B-F862-4C16-84D1-7B675D650103}" = CANON iMAGE GATEWAY Task
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AB97F52-512B-43EF-AAEC-4825C17B32ED}" = EA.com Update
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Camera Window DVC
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = RAW Image Task 2.2
"{BBBC2B89-E193-4348-A83C-C8DD8210A4AC}" = Canon PhotoRecord
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX (G)
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0E8C34D-19D2-49FD-A900-88DEB788FF86}" = Internet Library
"{D36DD326-7280-11D8-97C8-000129760CBE}" = PhotoNow! 1.0
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D5A9B7C0-8751-11D8-9D75-000129760D75}" = MediaShow 3.0
"{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
"{DDD5104F-1C44-49EB-9E6B-29EC5D27658B}" = HP Update
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe  1.4.124.1
"{E4C891D6-6844-41B8-86E8-633CACCC644F}" = TV Enhance
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EEC010D0-1252-4E1D-BAD9-F1B8F414535C}" = PL-2303 Vista Driver Installer
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{FAF26102-09D7-4C58-AB01-0D59A2E517CA}" = Copy
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe PageMaker 7.0" = Adobe PageMaker 7.0
"Adobe Photoshop 6.0" = Adobe Photoshop 6.0
"Agfa ScanWise 1.60" = Agfa ScanWise 1.60
"Agfa ScanWise 2.00" = Agfa ScanWise 2.00
"Avira AntiVir Desktop" = Avira Free Antivirus
"Corel Applications" = Corel Applications
"ElsterFormular 13.1.1.8531p" = ElsterFormular
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"ESC64 Referenzhandbuch" = ESC64 Referenzhandbuch
"ESC64 Softwarehandbuch" = ESC64 Softwarehandbuch
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Print Projects" = HP Print Projects 1.0
"HP Smart Web Printing" = HP Smart Web Printing 4.60
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"ICQ" = ICQ
"ICQToolbar" = ICQ Toolbar
"InstallShield_{0A146245-DB79-4197-BF5D-FE1A699A2CC7}" = Canon Camera Window DSLR 5 for ZoomBrowser EX
"InstallShield_{4DBBF091-FACD-422C-B43C-786335BD5398}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{50E25180-3BDC-4B6D-80A2-3F1F0C9CF39D}" = Canon Camera Window DC_DV 6 for ZoomBrowser EX
"InstallShield_{6C3A75A6-9A90-44A3-A703-82AC1EA6A85D}" = Canon Camera Window MC 6 for ZoomBrowser EX
"InstallShield_{874E44F3-B9A7-4AA1-B4BA-83E5684ED9C6}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{901F8ED7-13E8-43EF-B738-2FE89B0588EB}" = Canon Camera Access Library
"InstallShield_{93973C6B-F862-4C16-84D1-7B675D650103}" = CANON iMAGE GATEWAY Task for ZoomBrowser EX
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"InstallShield_{A2EB8F2E-6D9B-4F8B-96EB-F976D33F416F}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{BAA43DA2-B6C5-46EC-B163-0E8EEAF975A4}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{D0E8C34D-19D2-49FD-A900-88DEB788FF86}" = Canon Internet Library for ZoomBrowser EX
"LokProgrammer" = LokProgrammer v2
"LokProgrammer4" = LokProgrammer 4.3.3
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Micrografx Designer 7" = Micrografx Designer 7
"Micrografx FlowCharter 7" = Micrografx FlowCharter 7
"Micrografx Picture Publisher 8" = Micrografx Picture Publisher 8
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"OmniPagePro9.0DeinstKey" = OmniPage Pro 9.0
"Pixie_is1" = Pixie 1.4.1
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"QuickTime" = QuickTime
"RetroShare" = RetroShare
"Shop for HP Supplies" = Shop for HP Supplies
"SmartFTP Client 2.0 Setup Files" = SmartFTP Client 2.0 Setup Files (remove only)
"SmartFTP Client 3.0 Setup Files" = SmartFTP Client 3.0 Setup Files (remove only)
"SUPER ©" = SUPER © Version 2009.bld.35 (Jan 5, 2009)
"Winamp" = Winamp
"WinGimp-2.0_is1" = The GIMP 2.2.14
"WinGTK-2_is1" = GTK+ 2.10.6-1 runtime environment
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"Yahoo! Companion" = Yahoo! Toolbar
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.09.2012 07:18:33 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:35 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:35 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:35 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:35 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:36 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:18:36 | Computer Name = ***-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 15.09.2012 07:56:51 | Computer Name = ***-PC | Source = Application Hang | ID = 1002
Description = Programm Acrobat.exe, Version 7.0.0.1333 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 1574  Anfangszeit: 01cd9338fbabde63  Zeitpunkt der Beendigung:
 48
 
Error - 15.09.2012 09:57:51 | Computer Name = ***-PC | Source = Perflib | ID = 1010
Description =
 
Error - 15.09.2012 11:57:17 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 9.0.8112.16448, Zeitstempel
 0x4fecf1b7, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x00000000,  Prozess-ID 0xcac, Anwendungsstartzeit
 01cd93321f5c3a7e.
 
[ System Events ]
Error - 09.09.2012 17:17:21 | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 10.09.2012 18:53:42 | Computer Name = ***-PC | Source = DCOM | ID = 10010
Description =
 
Error - 11.09.2012 12:43:50 | Computer Name = ***-PC | Source = DCOM | ID = 10010
Description =
 
Error - 12.09.2012 12:46:41 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.09.2012 um 18:44:25 unerwartet heruntergefahren.
 
Error - 12.09.2012 12:51:45 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.09.2012 um 18:49:24 unerwartet heruntergefahren.
 
Error - 12.09.2012 12:56:00 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009
Description =
 
Error - 12.09.2012 13:05:37 | Computer Name = ***-PC | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
 Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
 
Error - 12.09.2012 13:12:06 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.09.2012 um 19:06:12 unerwartet heruntergefahren.
 
Error - 12.09.2012 13:21:42 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.09.2012 um 19:19:51 unerwartet heruntergefahren.
 
Error - 13.09.2012 11:52:50 | Computer Name = ***-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
 
< End of report >
Gmer-Log:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-15 21:23:20
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3320820AS rev.3.AAC
Running: okc2cb5f.exe; Driver: C:\Users\***\AppData\Local\Temp\axdiifod.sys


---- System - GMER 1.0.15 ----

SSDT            877CBFC6                                  ZwCreateSection
SSDT            877CBFD0                                  ZwRequestWaitReplyPort
SSDT            877CBFCB                                  ZwSetContextThread
SSDT            877CBFD5                                  ZwSetSecurityObject
SSDT            877CBFDA                                  ZwSystemDebugControl
SSDT            877CBF67                                  ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!KeSetEvent + 215            826E48D8 4 Bytes  [C6, BF, 7C, 87]
.text          ntkrnlpa.exe!KeSetEvent + 539            826E4BFC 1 Byte  [D0]
.text          ntkrnlpa.exe!KeSetEvent + 539            826E4BFC 4 Bytes  [D0, BF, 7C, 87]
.text          ntkrnlpa.exe!KeSetEvent + 56D            826E4C30 4 Bytes  [CB, BF, 7C, 87]
.text          ntkrnlpa.exe!KeSetEvent + 5D1            826E4C94 4 Bytes  [D5, BF, 7C, 87] {AAD 0xbf; JL 0xffffffffffffff8b}
.text          ...                                     
?              System32\drivers\xtkg.sys                Das System kann den angegebenen Pfad nicht finden. !
.text          C:\Windows\system32\DRIVERS\nvlddmkm.sys  section is writeable [0x8AE05340, 0x39B137, 0xE8000020]
.reloc          C:\Windows\system32\drivers\acedrv11.sys  section is executable [0x9B357600, 0x25B0C, 0xE0000060]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\fastfat \Fat                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----

cosinus 17.09.2012 13:03
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

berlyn 23.09.2012 12:52
Vielen Dank soweit!

MBAM-Log vom 22.09.2012:
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.22.05

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
*** :: ***-PC [Administrator]

22.09.2012 20:37:00
mbam-log-2012-09-22 (20-37-00).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|M:\|N:\|O:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 492104
Laufzeit: 1 Stunde(n), 38 Minute(n), 48 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
D:\Programme\eRightSoft\SUPER\SUPER.exe (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\***\AppData\Local\Temp\java.dll (Trojan.Ransom) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
ESET-Log vom 23.09.2012:
Code:
C:\Users\***\AppData\Local\Temp\jar_cache3817537853621472231.tmp        a variant of Java/Exploit.CVE-2012-1723.CG trojan
D:\Eigene Dateien\GDiVX1.9.9.6.exe        multiple threats
D:\Neuer Ordner\GDiVX1.9.9.6.exe        multiple threats

cosinus 23.09.2012 17:51
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Falls der adwCleaner schon mal in der runtergeladen wurde, bitte die alte adwcleaner.exe löschen und neu runterladen!!
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Suche.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[Rx].txt. (x=fortlaufende Nummer)

berlyn 25.09.2012 12:31
AdwCleaner-Log vom 25.09.2012:
Code:
# AdwCleaner v2.003 - Datei am 09/25/2012 um 09:30:02 erstellt
# Aktualisiert am 23/09/2012 von Xplode
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Benutzer : *** - ***-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\***\Desktop\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v [Version kann nicht ermittelt werden]

Datei : C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [756 octets] - [25/09/2012 09:30:02]

########## EOF - C:\AdwCleaner[R1].txt - [815 octets] ##########

cosinus 25.09.2012 14:46
Hätte da mal zwei Fragen bevor es weiter geht (wir sind noch nicht fertig!)

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

berlyn 25.09.2012 16:55
Nochmal danke soweit!

Zu den Fragen:
1) Scheint alles uneingeschränkt zu funktionieren.
2) Im Startmenü fehlen keine Einträge und es sind auch keine leeren Ordner da.

cosinus 25.09.2012 19:29
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

berlyn 30.09.2012 14:07
OTL-Log vom 27.09.2012:
Code:
OTL logfile created on: 27.09.2012 17:52:12 - Run 4
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\***\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1021,76 Mb Total Physical Memory | 382,21 Mb Available Physical Memory | 37,41% Memory free
2,26 Gb Paging File | 1,36 Gb Available in Paging File | 60,23% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 41,02 Gb Total Space | 1,10 Gb Free Space | 2,68% Space Free | Partition Type: NTFS
Drive D: | 58,11 Gb Total Space | 34,36 Gb Free Space | 59,14% Space Free | Partition Type: NTFS
Drive E: | 21,23 Gb Total Space | 0,40 Gb Free Space | 1,91% Space Free | Partition Type: NTFS
Drive F: | 118,16 Gb Total Space | 7,49 Gb Free Space | 6,34% Space Free | Partition Type: NTFS
Drive G: | 59,57 Gb Total Space | 2,70 Gb Free Space | 4,53% Space Free | Partition Type: NTFS
Drive M: | 465,83 Gb Total Space | 294,82 Gb Free Space | 63,29% Space Free | Partition Type: NTFS
Drive N: | 400,00 Gb Total Space | 129,40 Gb Free Space | 32,35% Space Free | Partition Type: NTFS
Drive O: | 65,68 Gb Total Space | 8,90 Gb Free Space | 13,55% Space Free | Partition Type: NTFS
 
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - D:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
PRC - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
PRC - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe ()
PRC - D:\Programme\Home Cinema\TV Enhance\TVEService.exe (CyberLink Corp.)
PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - D:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
PRC - C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - D:\Programme\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - D:\Programme\WinRAR\RarExt.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLTinyDB.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLCapEngine.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLSchMgr.dll ()
MOD - D:\Programme\Home Cinema\TV Enhance\Kernel\TV\CLCapSvcps.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- D:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (TVECapSvc) -- D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
SRV - (TVESched) -- D:\Programme\Home Cinema\TV Enhance\Kernel\TV\TVESched.exe ()
SRV - (NBService) -- D:\Programme\Nero 7\Nero BackItUp\NBService.exe (Nero AG)
SRV - (CCALib8) -- C:\Programme\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) -- C:\Programme\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (USBAAPL) -- System32\Drivers\usbaapl.sys File not found
DRV - (NwlnkFwd) -- system32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- system32\DRIVERS\nwlnkflt.sys File not found
DRV - (IpInIp) -- system32\DRIVERS\ipinip.sys File not found
DRV - (blbdrive) -- C:\Windows\system32\drivers\blbdrive.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (winusb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (acedrv11) -- C:\Windows\System32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (netr73) -- C:\Windows\System32\drivers\netr73.sys (Ralink Technology Corp.)
DRV - (Ph3xIB32) -- C:\Windows\System32\drivers\Ph3xIB32.sys (Philips Semiconductors GmbH)
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.lycos.de/
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: D:\Programme\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2105: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2571: C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1739: C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.07.11 22:53:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010.07.11 22:53:54 | 000,000,000 | ---D | M]
 
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\gcswf32.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\21.0.1180.89\pdf.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Enabled) = D:\Programme\Adobe\Acrobat 7.0\Acrobat\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)  (Enabled) = C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: DivX Player Netscape Plugin (Enabled) = D:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll
CHR - plugin: DivX Web Player (Enabled) = D:\Programme\DivX\DivX Web Player\npdivx32.dll
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] D:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [LanguageShortcut] D:\Programme\Home Cinema\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [Mirabilis ICQ] C:\Programme\ICQ\ICQNet.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RemoteControl] D:\Programme\Home Cinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" File not found
O4 - HKLM..\Run: [TVEService] D:\Programme\Home Cinema\TV Enhance\TVEService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] D:\Programme\Winamp\winampa.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdcBase.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-1146650413-166516795-3937567613-1000..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - D:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra 'Tools' menuitem : ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Programme\ICQ\Icq.exe (ICQ Inc.)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Common Files\microsoft shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - G:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: WudfPf - Driver
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4A20C437-EA91-3118-5908-1528B45E69BB} - Microsoft Windows Media Player
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3codecp -  File not found
Drivers32: msacm.sl_anet - C:\Windows\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\Windows\System32\DivX.dll (DivX, Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.wmv3 - C:\Windows\System32\WMV9VCM.dll (Microsoft Corporation)
Drivers32: vidc.yv12 - C:\Windows\System32\yv12vfw.dll (www.helixcommunity.org)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.09.25 00:42:41 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\{917AB26B-27D6-4D3D-8243-FB97291FD285}
[2012.09.23 00:38:27 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012.09.22 20:34:27 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.09.22 20:26:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.09.22 20:14:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Google
[2012.09.22 20:14:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Google
[2012.09.22 20:14:23 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2012.09.15 17:32:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2012.09.15 17:31:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.09.15 17:31:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.09.15 17:31:16 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.09.15 17:31:16 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.09.15 15:15:07 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.09.15 15:12:14 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\***PC
[2012.09.15 13:11:19 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\tmp
[2012.08.30 21:47:56 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\Lampen
[2007.03.25 18:09:17 | 154,399,616 | ---- | C] (T-Online) -- C:\Users\***\T-Online_6.0.exe
[2007.03.25 18:09:13 | 008,965,498 | ---- | C] (Greentube AG) -- C:\Users\***\SkiChallenge2005Kitzbuehel_Version12a.exe
[2007.03.25 18:09:08 | 022,083,376 | ---- | C] (Apple Computer, Inc.) -- C:\Users\***\QuickTimeInstaller.exe
[2007.03.25 18:08:38 | 000,835,700 | ---- | C] (Macromedia, Inc.) -- C:\Users\***\Leuk.exe
[2007.03.25 18:08:35 | 004,258,276 | ---- | C] (Kerio Technologies                                          ) -- C:\Users\***\kerio-pf-4.0.0-win.exe
[2007.03.25 18:08:30 | 017,907,756 | ---- | C] (InstallShield Software Corporation) -- C:\Users\***\JAD516.exe
[2007.03.25 18:08:25 | 000,341,331 | ---- | C] (Macromedia, Inc.) -- C:\Users\***\FISH.EXE
[2007.03.25 18:08:03 | 035,097,792 | ---- | C] (Microsoft Corporation) -- C:\Users\***\directx_9c_redist.exe
[2007.03.25 18:07:34 | 022,504,744 | ---- | C] (Netopsystems AG                        ) -- C:\Users\***\AdbeRdr70_deu_full.exe
[2007.03.25 18:07:27 | 018,226,032 | ---- | C] (Netopsystems AG) -- C:\Users\***\AdbeRdr60_deu_full.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.09.27 17:47:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.09.27 17:44:15 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.09.27 17:41:05 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.27 17:33:08 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.27 17:33:04 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.09.27 17:33:04 | 000,003,264 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.09.27 17:32:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.09.27 17:32:52 | 1072,160,768 | -HS- | M] () -- C:\hiberfil.sys
[2012.09.22 20:34:55 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.09.22 20:31:54 | 000,000,049 | ---- | M] () -- C:\Windows\NeroDigital.ini
[2012.09.15 17:30:45 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.09.15 17:30:45 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.09.15 17:30:45 | 000,126,054 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.09.15 17:30:45 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.09.15 15:13:30 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2012.09.15 14:17:40 | 000,007,052 | ---- | M] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2012.09.15 14:17:35 | 000,101,888 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.09.15 12:42:12 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2012.09.12 19:20:16 | 083,023,306 | ---- | M] () -- C:\ProgramData\avaj.pad
[2012.09.07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
 
========== Files Created - No Company Name ==========
 
[2012.09.22 20:14:51 | 000,001,100 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.09.22 20:14:50 | 000,001,096 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.09.15 15:13:30 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2012.09.15 15:12:41 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2012.09.12 18:42:53 | 083,023,306 | ---- | C] () -- C:\ProgramData\avaj.pad
[2012.06.18 20:17:48 | 000,035,433 | ---- | C] () -- C:\Users\***\ARAG-Leistungsantrag1.pdf
[2012.04.11 20:17:10 | 000,113,492 | ---- | C] () -- C:\Users\***\ESt2011_***_***.elfo
[2011.04.08 20:33:21 | 000,117,440 | ---- | C] () -- C:\Users\***\ESt2010_***_***.elfo
[2009.01.15 17:04:09 | 000,024,806 | ---- | C] () -- C:\Users\***\***5.jpg
[2008.12.03 18:22:47 | 000,741,696 | ---- | C] () -- C:\Users\***\Stiftung Warentest Finanztest 2006.11-Riesterrente(Lesepflicht!!).pdf
[2008.12.03 18:21:29 | 000,073,831 | ---- | C] () -- C:\Users\***\Finanztest - Stiftung Warentest - Ratgeber Baufinanzierung - Geld Sparen 2008.pdf
[2008.08.09 17:06:41 | 004,086,373 | ---- | C] () -- C:\Users\***\v0649.mpg
[2008.08.09 17:06:41 | 001,679,686 | ---- | C] () -- C:\Users\***\v0642.wmv
[2008.08.09 17:06:41 | 001,366,931 | ---- | C] () -- C:\Users\***\v0675.wmv
[2008.08.09 17:06:40 | 003,207,190 | ---- | C] () -- C:\Users\***\v0501.mpeg
[2008.08.09 17:06:40 | 001,937,517 | ---- | C] () -- C:\Users\***\v0588.wmv
[2008.08.09 17:06:40 | 001,582,701 | ---- | C] () -- C:\Users\***\v0468.wmv
[2008.08.09 17:06:40 | 001,555,210 | ---- | C] () -- C:\Users\***\v0458.wmv
[2008.08.09 17:06:40 | 001,513,473 | ---- | C] () -- C:\Users\***\v0236.mpg
[2008.08.09 17:06:40 | 001,504,091 | ---- | C] () -- C:\Users\***\v0184.wmv
[2008.08.09 17:06:40 | 001,490,201 | ---- | C] () -- C:\Users\***\v0502.wmv
[2008.08.09 17:06:40 | 001,353,990 | ---- | C] () -- C:\Users\***\v0226.wmv
[2008.08.09 17:06:40 | 000,856,092 | ---- | C] () -- C:\Users\***\v0199.wmv
[2008.08.09 17:06:39 | 004,382,724 | ---- | C] () -- C:\Users\***\v0174.mpg
[2008.08.09 17:06:39 | 002,603,012 | ---- | C] () -- C:\Users\***\v0177.mpg
[2008.08.09 17:06:39 | 002,265,092 | ---- | C] () -- C:\Users\***\jobfrust.mpg
[2008.08.09 17:06:39 | 001,753,092 | ---- | C] () -- C:\Users\***\feine-herren.mpg
[2008.08.09 17:06:39 | 001,677,316 | ---- | C] () -- C:\Users\***\v0105.mpg
[2008.08.09 17:06:39 | 001,204,676 | ---- | C] () -- C:\Users\***\gentleman.mpeg
[2008.08.09 17:06:39 | 001,129,440 | ---- | C] () -- C:\Users\***\inspiration.mpeg
[2008.08.09 17:06:39 | 001,052,676 | ---- | C] () -- C:\Users\***\v0055.mpg
[2008.08.09 17:06:39 | 001,027,979 | ---- | C] () -- C:\Users\***\v0115.wmv
[2008.08.09 17:06:39 | 000,819,303 | ---- | C] () -- C:\Users\***\v0138.mpeg
[2008.08.09 17:06:39 | 000,751,620 | ---- | C] () -- C:\Users\***\fahrschule.mpeg
[2008.05.10 15:35:14 | 000,595,297 | ---- | C] () -- C:\Users\***\DSCN2117.JPG
[2008.05.10 15:35:00 | 000,588,361 | ---- | C] () -- C:\Users\***\DSCN2114.JPG
[2008.05.05 12:55:15 | 000,009,224 | ---- | C] () -- C:\Users\***\***4.jpg
[2008.04.08 12:42:53 | 000,007,052 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2008.03.17 15:15:30 | 000,461,011 | ---- | C] () -- C:\Users\***\Praxisbericht 01_Deloitte(28.02.08).pdf
[2007.10.28 12:45:43 | 002,948,891 | ---- | C] () -- C:\Users\***\El_Rey_del_martillo.wmv
[2007.10.28 12:45:43 | 002,793,560 | ---- | C] () -- C:\Users\***\bahnhof-markt.wmv
[2007.10.28 12:45:43 | 001,717,522 | ---- | C] () -- C:\Users\***\ScheissMontag.wmv
[2007.10.28 12:45:43 | 001,285,484 | ---- | C] () -- C:\Users\***\HowNOTToWorkOut.wmv
[2007.07.20 11:17:34 | 001,571,840 | ---- | C] () -- C:\Users\***\DasParadoxeunsererZeit.pps
[2007.06.16 15:53:22 | 000,069,052 | ---- | C] () -- C:\Users\***\***3.jpg
[2007.06.01 14:13:20 | 000,546,859 | ---- | C] () -- C:\Users\***\Surfen_und_Sparen_PCG_2007-04.pdf
[2007.05.07 10:29:57 | 000,796,396 | ---- | C] () -- C:\Users\***\.fonts.cache-1
[2007.04.21 00:15:03 | 001,652,736 | ---- | C] () -- C:\Users\***\ost.avi
[2007.04.19 18:26:51 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2007.04.06 11:21:03 | 000,060,551 | -H-- | C] () -- C:\Users\***\ZbThumbnail.info
[2007.03.31 11:21:59 | 000,000,078 | ---- | C] () -- C:\Users\***\AppData\Roaming\Default.PLS
[2007.03.25 18:09:52 | 002,372,760 | ---- | C] () -- C:\Users\***\winzip90.exe
[2007.03.25 18:09:52 | 000,986,173 | ---- | C] () -- C:\Users\***\wrar330d.exe
[2007.03.25 18:09:52 | 000,957,465 | ---- | C] () -- C:\Users\***\wrar320d.exe
[2007.03.25 18:09:52 | 000,051,200 | ---- | C] () -- C:\Users\***\WitzehartanderGrenze.pps
[2007.03.25 18:09:51 | 004,833,616 | ---- | C] () -- C:\Users\***\winamp509_full_emusic-8basic.exe
[2007.03.25 18:09:50 | 004,567,928 | ---- | C] () -- C:\Users\***\winamp506_full.exe
[2007.03.25 18:09:49 | 004,437,216 | ---- | C] () -- C:\Users\***\winamp50superprealphaleetness2_full_noaod.exe
[2007.03.25 18:09:49 | 004,376,975 | ---- | C] () -- C:\Users\***\winamp503_full.exe
[2007.03.25 18:09:49 | 000,153,600 | ---- | C] () -- C:\Users\***\Wieviel sind 60 GB.pps
[2007.03.25 18:09:48 | 001,929,851 | ---- | C] () -- C:\Users\***\Voting_Machine.wmv
[2007.03.25 18:09:48 | 001,624,068 | ---- | C] () -- C:\Users\***\WEDDING.mpg
[2007.03.25 18:09:48 | 000,832,000 | ---- | C] () -- C:\Users\***\Wer-reitet-so-spaet-durch-Nacht-und-Wind.pps
[2007.03.25 18:09:48 | 000,327,168 | ---- | C] () -- C:\Users\***\Vier-Soehne.pps
[2007.03.25 18:09:48 | 000,305,664 | ---- | C] () -- C:\Users\***\wennfrauendieweltregierenwuerden1.pps
[2007.03.25 18:09:48 | 000,078,694 | ---- | C] () -- C:\Users\***\WC-Papier.jpg
[2007.03.25 18:09:48 | 000,028,672 | ---- | C] () -- C:\Users\***\Wer9702B.pps
[2007.03.25 18:09:47 | 003,808,075 | ---- | C] () -- C:\Users\***\Versaute Kurz Sex Comics 2.pdf
[2007.03.25 18:09:47 | 000,031,002 | ---- | C] () -- C:\Users\***\VHS_Kurse.pdf
[2007.03.25 18:09:46 | 005,051,685 | ---- | C] () -- C:\Users\***\Versaute Kurz Sex Comics.pdf
[2007.03.25 18:09:46 | 001,216,512 | ---- | C] () -- C:\Users\***\VERRUECKTE_WELT_1.PPS
[2007.03.25 18:09:46 | 000,576,000 | ---- | C] () -- C:\Users\***\Urlaubsentscheidung.pps
[2007.03.25 18:09:46 | 000,373,824 | ---- | C] () -- C:\Users\***\Urlaub_026.jpg
[2007.03.25 18:09:46 | 000,033,347 | ---- | C] () -- C:\Users\***\unbez09.jpg
[2007.03.25 18:09:46 | 000,028,720 | ---- | C] () -- C:\Users\***\unbez10.jpg
[2007.03.25 18:09:46 | 000,028,201 | ---- | C] () -- C:\Users\***\unbez12.jpg
[2007.03.25 18:09:45 | 001,835,284 | ---- | C] () -- C:\Users\***\Unbenannt(2).tif
[2007.03.25 18:09:45 | 001,835,284 | ---- | C] () -- C:\Users\***\Unbenannt(1).tif
[2007.03.25 18:09:45 | 000,061,404 | ---- | C] () -- C:\Users\***\unbez08.jpg
[2007.03.25 18:09:45 | 000,060,923 | ---- | C] () -- C:\Users\***\unbez05.jpg
[2007.03.25 18:09:45 | 000,042,857 | ---- | C] () -- C:\Users\***\unbez02.jpg
[2007.03.25 18:09:45 | 000,039,961 | ---- | C] () -- C:\Users\***\unbez07.jpg
[2007.03.25 18:09:45 | 000,034,747 | ---- | C] () -- C:\Users\***\unbez01.jpg
[2007.03.25 18:09:45 | 000,031,691 | ---- | C] () -- C:\Users\***\unbez04.jpg
[2007.03.25 18:09:45 | 000,027,224 | ---- | C] () -- C:\Users\***\unbez03.jpg
[2007.03.25 18:09:44 | 003,121,136 | ---- | C] () -- C:\Users\***\umbro.mpg
[2007.03.25 18:09:44 | 001,570,304 | ---- | C] () -- C:\Users\***\TV-Quiz.pps
[2007.03.25 18:09:44 | 000,046,592 | ---- | C] () -- C:\Users\***\U KAMENNOGO_ Cafe_St.Petersburg(11.09.03)
[2007.03.25 18:09:43 | 004,235,776 | ---- | C] () -- C:\Users\***\tuebingen-show.pps
[2007.03.25 18:09:43 | 000,439,808 | ---- | C] () -- C:\Users\***\tshirts.pps
[2007.03.25 18:09:17 | 000,045,905 | ---- | C] () -- C:\Users\***\Tina3(30.04.05).jpg
[2007.03.25 18:09:17 | 000,043,703 | ---- | C] () -- C:\Users\***\Tina.jpg
[2007.03.25 18:09:17 | 000,039,190 | ---- | C] () -- C:\Users\***\Ti-Club-01.jpg
[2007.03.25 18:09:17 | 000,035,621 | ---- | C] () -- C:\Users\***\Tina2(30.04.05).jpg
[2007.03.25 18:09:17 | 000,032,612 | ---- | C] () -- C:\Users\***\Tina1(30.04.05).jpg
[2007.03.25 18:09:15 | 006,039,556 | ---- | C] () -- C:\Users\***\THE-NIKE-BEACH-EDITION.mpg
[2007.03.25 18:09:15 | 001,463,808 | ---- | C] () -- C:\Users\***\Telekom-aktien.pps
[2007.03.25 18:09:15 | 001,247,232 | ---- | C] () -- C:\Users\***\straende2003_1.pps
[2007.03.25 18:09:15 | 000,765,001 | ---- | C] () -- C:\Users\***\slsk152.exe
[2007.03.25 18:09:15 | 000,536,576 | ---- | C] () -- C:\Users\***\Tausche Mann gegen Katze.pps
[2007.03.25 18:09:15 | 000,397,312 | ---- | C] () -- C:\Users\***\Spiele-Quiz.pps
[2007.03.25 18:09:15 | 000,033,864 | ---- | C] () -- C:\Users\***\th_0_big.jpg
[2007.03.25 18:09:15 | 000,032,845 | ---- | C] () -- C:\Users\***\Tagesmotto.jpg
[2007.03.25 18:09:15 | 000,000,412 | ---- | C] () -- C:\Users\***\spider.sav
[2007.03.25 18:09:13 | 000,129,024 | ---- | C] () -- C:\Users\***\sensibel.pps
[2007.03.25 18:09:13 | 000,095,744 | ---- | C] () -- C:\Users\***\Schuhe.pps
[2007.03.25 18:09:13 | 000,092,397 | ---- | C] () -- C:\Users\***\sitz und höcker.jpg
[2007.03.25 18:09:13 | 000,055,659 | ---- | C] () -- C:\Users\***\Schiebebühne1.jpg
[2007.03.25 18:09:13 | 000,054,628 | ---- | C] () -- C:\Users\***\Schiebebühne2.jpg
[2007.03.25 18:09:13 | 000,052,739 | ---- | C] () -- C:\Users\***\Schiebebühne3.jpg
[2007.03.25 18:09:13 | 000,046,752 | ---- | C] () -- C:\Users\***\Simone.jpg
[2007.03.25 18:09:13 | 000,031,937 | ---- | C] () -- C:\Users\***\Simone3.jpg
[2007.03.25 18:09:13 | 000,030,636 | ---- | C] () -- C:\Users\***\Simone2.jpg
[2007.03.25 18:09:13 | 000,023,717 | ---- | C] () -- C:\Users\***\san2 schwarz-weiß.jpg
[2007.03.25 18:09:12 | 000,278,132 | ---- | C] () -- C:\Users\***\reifen4.pdf
[2007.03.25 18:09:12 | 000,039,038 | ---- | C] () -- C:\Users\***\S_0374.jpg
[2007.03.25 18:09:12 | 000,010,403 | ---- | C] () -- C:\Users\***\Reklamation Esprit(07.05.06).pdf
[2007.03.25 18:09:08 | 000,284,160 | ---- | C] () -- C:\Users\***\pussymassage..pps
[2007.03.25 18:09:08 | 000,113,835 | ---- | C] () -- C:\Users\***\Postkarten 004.jpg
[2007.03.25 18:09:08 | 000,101,098 | ---- | C] () -- C:\Users\***\Postkarten.jpg
[2007.03.25 18:09:08 | 000,098,569 | ---- | C] () -- C:\Users\***\Postkarten 002.jpg
[2007.03.25 18:09:08 | 000,097,506 | ---- | C] () -- C:\Users\***\pic01298.pcx
[2007.03.25 18:09:08 | 000,075,893 | ---- | C] () -- C:\Users\***\Postkarten 003.jpg
[2007.03.25 18:09:08 | 000,063,221 | ---- | C] () -- C:\Users\***\Postkarten 001.jpg
[2007.03.25 18:09:08 | 000,040,374 | ---- | C] () -- C:\Users\***\plärrer.jpg
[2007.03.25 18:09:07 | 004,521,988 | ---- | C] () -- C:\Users\***\Pepsi Piercing.mpeg
[2007.03.25 18:09:07 | 000,654,336 | ---- | C] () -- C:\Users\***\oeltankerunfall.pps
[2007.03.25 18:09:07 | 000,143,173 | ---- | C] () -- C:\Users\***\OSRAM_Bewerbung.pdf
[2007.03.25 18:09:07 | 000,112,340 | ---- | C] () -- C:\Users\***\Party.jpg
[2007.03.25 18:09:07 | 000,077,280 | ---- | C] () -- C:\Users\***\ninja_zx12r.pdf
[2007.03.25 18:09:07 | 000,060,416 | ---- | C] () -- C:\Users\***\Pech_1.pps
[2007.03.25 18:09:06 | 000,139,776 | ---- | C] () -- C:\Users\***\Neugier.pps
[2007.03.25 18:09:06 | 000,077,456 | ---- | C] () -- C:\Users\***\ninja_zx10r.pdf
[2007.03.25 18:08:59 | 033,831,916 | ---- | C] () -- C:\Users\***\Nero-6.6.0.13.exe
[2007.03.25 18:08:53 | 031,607,334 | ---- | C] () -- C:\Users\***\Nero-6.6.0.8a.exe
[2007.03.25 18:08:49 | 021,734,668 | ---- | C] () -- C:\Users\***\nero6009.exe
[2007.03.25 18:08:49 | 000,640,000 | ---- | C] () -- C:\Users\***\NATURALE.PPS
[2007.03.25 18:08:49 | 000,024,141 | ---- | C] () -- C:\Users\***\Nelly1.jpg
[2007.03.25 18:08:49 | 000,020,473 | ---- | C] () -- C:\Users\***\Nelly2.jpg
[2007.03.25 18:08:49 | 000,009,575 | ---- | C] () -- C:\Users\***\nal599_1.jpg
[2007.03.25 18:08:49 | 000,007,581 | ---- | C] () -- C:\Users\***\nal387_1.jpg
[2007.03.25 18:08:48 | 003,807,236 | ---- | C] () -- C:\Users\***\montavit-the-hero_1.mpg
[2007.03.25 18:08:48 | 000,964,612 | ---- | C] () -- C:\Users\***\myNewCoat.mpg.mpg
[2007.03.25 18:08:48 | 000,067,731 | ---- | C] () -- C:\Users\***\mime001.jpg
[2007.03.25 18:08:47 | 004,047,460 | ---- | C] () -- C:\Users\***\Mieze in the mix.wmv
[2007.03.25 18:08:47 | 000,695,808 | ---- | C] () -- C:\Users\***\mehr-ossi-wissen.pps
[2007.03.25 18:08:47 | 000,074,570 | ---- | C] () -- C:\Users\***\Melly3.jpg
[2007.03.25 18:08:40 | 029,864,473 | ---- | C] () -- C:\Users\***\mediamaker_107.exe
[2007.03.25 18:08:40 | 002,909,920 | ---- | C] () -- C:\Users\***\Mauerbau.mpg
[2007.03.25 18:08:39 | 001,220,608 | ---- | C] () -- C:\Users\***\ma80_32.exe
[2007.03.25 18:08:39 | 000,196,608 | ---- | C] () -- C:\Users\***\Männerregeln.pps
[2007.03.25 18:08:39 | 000,060,071 | ---- | C] () -- C:\Users\***\lokomotivwm80.jpg
[2007.03.25 18:08:39 | 000,059,961 | ---- | C] () -- C:\Users\***\lokomotiv78468.jpg
[2007.03.25 18:08:39 | 000,059,392 | ---- | C] () -- C:\Users\***\Logisches Wo.pps
[2007.03.25 18:08:39 | 000,018,944 | ---- | C] () -- C:\Users\***\Lohn.pps
[2007.03.25 18:08:39 | 000,004,914 | ---- | C] () -- C:\Users\***\mas256_1.jpg
[2007.03.25 18:08:39 | 000,000,132 | ---- | C] () -- C:\Users\***\Lothar Gallus.vcf
[2007.03.25 18:08:38 | 003,867,620 | ---- | C] () -- C:\Users\***\Liebesspiel.mpeg
[2007.03.25 18:08:38 | 000,794,112 | ---- | C] () -- C:\Users\***\Kuriositäten[1].pps
[2007.03.25 18:08:38 | 000,181,248 | ---- | C] () -- C:\Users\***\Libertad-para-Bolivia.pps
[2007.03.25 18:08:38 | 000,045,568 | ---- | C] () -- C:\Users\***\Krankenhaus.pps
[2007.03.25 18:08:38 | 000,008,772 | ---- | C] () -- C:\Users\***\kri549_1.jpg
[2007.03.25 18:08:37 | 003,037,798 | ---- | C] () -- C:\Users\***\klitekpp241d.exe
[2007.03.25 18:08:37 | 002,002,824 | ---- | C] () -- C:\Users\***\klimaanlage.exe
[2007.03.25 18:08:36 | 000,706,048 | ---- | C] () -- C:\Users\***\Kids.pps
[2007.03.25 18:08:36 | 000,496,128 | ---- | C] () -- C:\Users\***\Kleinanzeigen.pps
[2007.03.25 18:08:35 | 001,979,392 | ---- | C] () -- C:\Users\***\Katja.pps
[2007.03.25 18:08:35 | 000,661,504 | ---- | C] () -- C:\Users\***\Katze.pps
[2007.03.25 18:08:35 | 000,003,841 | ---- | C] () -- C:\Users\***\keinbild_thumb120x180.jpg
[2007.03.25 18:08:34 | 001,667,584 | ---- | C] () -- C:\Users\***\Karren_und_Frauen.pps
[2007.03.25 18:08:34 | 000,126,464 | ---- | C] () -- C:\Users\***\JustChecking.pps
[2007.03.25 18:08:34 | 000,031,232 | ---- | C] () -- C:\Users\***\Jokes-1.pps
[2007.03.25 18:08:34 | 000,007,229 | ---- | C] () -- C:\Users\***\jul365_5.jpg
[2007.03.25 18:08:34 | 000,004,279 | ---- | C] () -- C:\Users\***\jan215_5.jpg
[2007.03.25 18:08:29 | 003,207,935 | ---- | C] () -- C:\Users\***\isenbeck-ballet.asf
[2007.03.25 18:08:29 | 000,303,616 | ---- | C] () -- C:\Users\***\IKEA-Stuhl_mit_Anleitung.pps
[2007.03.25 18:08:29 | 000,155,648 | ---- | C] () -- C:\Users\***\insel.pps
[2007.03.25 18:08:29 | 000,065,262 | ---- | C] () -- C:\Users\***\image2.jpg
[2007.03.25 18:08:29 | 000,062,090 | ---- | C] () -- C:\Users\***\Ina 039.jpg
[2007.03.25 18:08:29 | 000,032,616 | ---- | C] () -- C:\Users\***\image.jpg
[2007.03.25 18:08:29 | 000,014,748 | ---- | C] () -- C:\Users\***\Ilka_München(15.07.04).jpg
[2007.03.25 18:08:29 | 000,008,286 | ---- | C] () -- C:\Users\***\iri037_1.jpg
[2007.03.25 18:08:28 | 002,447,994 | ---- | C] () -- C:\Users\***\hand-rolled.mpeg
[2007.03.25 18:08:28 | 001,902,000 | ---- | C] () -- C:\Users\***\icqlite_german.exe
[2007.03.25 18:08:28 | 000,372,736 | ---- | C] () -- C:\Users\***\HommageandieFrau-anmutigundzerbrechlich.pps
[2007.03.25 18:08:28 | 000,372,736 | ---- | C] () -- C:\Users\***\Hommage an die Frau - anmutig und zerbrechlich.pps
[2007.03.25 18:08:28 | 000,160,737 | ---- | C] () -- C:\Users\***\Hochzeit.jpg
[2007.03.25 18:08:28 | 000,022,300 | ---- | C] () -- C:\Users\***\i-1.jpg
[2007.03.25 18:08:27 | 000,408,064 | ---- | C] () -- C:\Users\***\Guten Morgen.pps
[2007.03.25 18:08:27 | 000,323,210 | ---- | C] () -- C:\Users\***\Ginnastica2.m1v
[2007.03.25 18:08:27 | 000,304,128 | ---- | C] () -- C:\Users\***\Geister.pps
[2007.03.25 18:08:27 | 000,276,353 | ---- | C] () -- C:\Users\***\Ginnastica1.m1v
[2007.03.25 18:08:27 | 000,234,876 | ---- | C] () -- C:\Users\***\Ginnastica3.m1v
[2007.03.25 18:08:27 | 000,176,543 | ---- | C] () -- C:\Users\***\Ginnastica4.m1v
[2007.03.25 18:08:27 | 000,093,586 | ---- | C] () -- C:\Users\***\gsx-r1000.pdf
[2007.03.25 18:08:27 | 000,088,064 | ---- | C] () -- C:\Users\***\Hallo-Freunde.pps
[2007.03.25 18:08:27 | 000,088,064 | ---- | C] () -- C:\Users\***\GLÜCKSWITZ.pps
[2007.03.25 18:08:27 | 000,075,776 | ---- | C] () -- C:\Users\***\G-Punkt1.pps
[2007.03.25 18:08:27 | 000,070,656 | ---- | C] () -- C:\Users\***\FUR_MEIN.pps
[2007.03.25 18:08:27 | 000,059,469 | ---- | C] () -- C:\Users\***\goethe.jpg
[2007.03.25 18:08:27 | 000,026,765 | ---- | C] () -- C:\Users\***\haha.jpg
[2007.03.25 18:08:27 | 000,009,717 | ---- | C] () -- C:\Users\***\Gutscheine.pdf
[2007.03.25 18:08:26 | 002,847,124 | ---- | C] () -- C:\Users\***\funny_cats_1 (1).wmv
[2007.03.25 18:08:26 | 001,495,040 | ---- | C] () -- C:\Users\***\Fun 112.pps
[2007.03.25 18:08:25 | 001,391,616 | ---- | C] () -- C:\Users\***\Fahrzeuge.pps
[2007.03.25 18:08:25 | 000,103,424 | ---- | C] () -- C:\Users\***\Frauen1.pps
[2007.03.25 18:08:25 | 000,079,985 | ---- | C] () -- C:\Users\***\Foto%20Frauen%201b.jpg
[2007.03.25 18:08:25 | 000,075,643 | ---- | C] () -- C:\Users\***\Flugzeug.jpg
[2007.03.25 18:08:25 | 000,075,264 | ---- | C] () -- C:\Users\***\Frauen.pps
[2007.03.25 18:08:24 | 004,902,912 | ---- | C] () -- C:\Users\***\eurcncs185030.mpeg
[2007.03.25 18:08:24 | 000,139,776 | ---- | C] () -- C:\Users\***\Erhöhung.pps
[2007.03.25 18:08:24 | 000,073,728 | ---- | C] () -- C:\Users\***\Erfolg.pps
[2007.03.25 18:08:23 | 000,209,408 | ---- | C] () -- C:\Users\***\EinfachmaleinnettesHALLO-usc.pps
[2007.03.25 18:08:23 | 000,064,000 | ---- | C] () -- C:\Users\***\eine-tolle-Frau.pps
[2007.03.25 18:08:22 | 003,239,325 | ---- | C] () -- C:\Users\***\eftp3setup_31281.exe
[2007.03.25 18:08:21 | 001,064,960 | ---- | C] () -- C:\Users\***\Echtgut!.pps
[2007.03.25 18:08:21 | 000,328,192 | ---- | C] () -- C:\Users\***\Durchfah.pps
[2007.03.25 18:08:20 | 000,890,880 | ---- | C] () -- C:\Users\***\Dry_Wet.pps
[2007.03.25 18:08:20 | 000,025,548 | ---- | C] () -- C:\Users\***\drogen_01.jpg
[2007.03.25 18:08:18 | 011,520,418 | ---- | C] () -- C:\Users\***\DrDivX.exe
[2007.03.25 18:08:17 | 001,043,142 | ---- | C] () -- C:\Users\***\DM1.BMP
[2007.03.25 18:08:17 | 000,186,880 | ---- | C] () -- C:\Users\***\doktorco.pps
[2007.03.25 18:08:17 | 000,154,662 | ---- | C] () -- C:\Users\***\DM6.jpg
[2007.03.25 18:08:17 | 000,108,126 | ---- | C] () -- C:\Users\***\DM2.JPG
[2007.03.25 18:08:17 | 000,059,192 | ---- | C] () -- C:\Users\***\DM8.jpg
[2007.03.25 18:08:17 | 000,055,750 | ---- | C] () -- C:\Users\***\DM4.jpg
[2007.03.25 18:08:17 | 000,045,066 | ---- | C] () -- C:\Users\***\download.jpg
[2007.03.25 18:08:17 | 000,039,242 | ---- | C] () -- C:\Users\***\downloa.jpg
[2007.03.25 18:08:17 | 000,014,121 | ---- | C] () -- C:\Users\***\DM5.jpg
[2007.03.25 18:08:17 | 000,010,262 | ---- | C] () -- C:\Users\***\DM3.JPG
[2007.03.25 18:08:17 | 000,009,202 | ---- | C] () -- C:\Users\***\DM_Neu.JPG
[2007.03.25 18:08:16 | 004,008,129 | ---- | C] () -- C:\Users\***\DivX505b_Bundle.exe
[2007.03.25 18:08:12 | 005,317,584 | ---- | C] () -- C:\Users\***\DivX51_Bundle.exe
[2007.03.25 18:08:03 | 000,291,546 | ---- | C] () -- C:\Users\***\Digitalkamera.pdf
[2007.03.25 18:08:03 | 000,184,832 | ---- | C] () -- C:\Users\***\Die-schlaue-MAMA.pps
[2007.03.25 18:08:03 | 000,077,312 | ---- | C] () -- C:\Users\***\Die Fee.pps
[2007.03.25 18:08:03 | 000,045,890 | ---- | C] () -- C:\Users\***\der_beste_schiedsrichter.jpg
[2007.03.25 18:08:02 | 001,478,880 | ---- | C] () -- C:\Users\***\DEODORAN.MPE
[2007.03.25 18:08:02 | 000,012,961 | ---- | C] () -- C:\Users\***\default_jobs_bild4.jpg
[2007.03.25 18:08:01 | 002,760,380 | ---- | C] () -- C:\Users\***\DeepBurner1_110117.exe
[2007.03.25 18:08:01 | 002,502,692 | ---- | C] () -- C:\Users\***\de_mc_br_fireblade_2004.pdf
[2007.03.25 18:08:00 | 001,680,252 | ---- | C] () -- C:\Users\***\DE3.mpg
[2007.03.25 18:08:00 | 000,358,889 | ---- | C] () -- C:\Users\***\DasistMobbing.mpeg
[2007.03.25 18:08:00 | 000,307,712 | ---- | C] () -- C:\Users\***\DasBett.pps
[2007.03.25 18:08:00 | 000,040,537 | ---- | C] () -- C:\Users\***\***3.jpg
[2007.03.25 18:08:00 | 000,037,255 | ---- | C] () -- C:\Users\***\***4.jpg
[2007.03.25 18:08:00 | 000,034,594 | ---- | C] () -- C:\Users\***\***_MoTown(15.06.04).jpg
[2007.03.25 18:07:59 | 000,640,054 | ---- | C] () -- C:\Users\***\***2.BMP
[2007.03.25 18:07:59 | 000,452,608 | ---- | C] () -- C:\Users\***\comics.pps
[2007.03.25 18:07:59 | 000,169,216 | ---- | C] () -- C:\Users\***\*** - Vorstand.JPG
[2007.03.25 18:07:59 | 000,032,513 | ---- | C] () -- C:\Users\***\***.jpg
[2007.03.25 18:07:58 | 002,242,705 | ---- | C] () -- C:\Users\***\CBR1000RR_zubeh.pdf
[2007.03.25 18:07:58 | 000,049,546 | ---- | C] () -- C:\Users\***\chatroom.JPG
[2007.03.25 18:07:58 | 000,044,274 | ---- | C] () -- C:\Users\***\chagall-marc-der-blumenstrauss-der-den-himmel-erleuchtet.jpg
[2007.03.25 18:07:58 | 000,024,112 | ---- | C] () -- C:\Users\***\CIMG0419.jpg
[2007.03.25 18:07:55 | 009,491,011 | ---- | C] () -- C:\Users\***\Canon_Software.pdf
[2007.03.25 18:07:54 | 004,452,373 | ---- | C] () -- C:\Users\***\Canon Photoshot A 620.pdf
[2007.03.25 18:07:54 | 000,094,476 | ---- | C] () -- C:\Users\***\C17_Launch_Over_Crew.jpg
[2007.03.25 18:07:53 | 001,469,159 | ---- | C] () -- C:\Users\***\Burn4Free_Setup.exe
[2007.03.25 18:07:53 | 000,386,048 | ---- | C] () -- C:\Users\***\bros.pps
[2007.03.25 18:07:53 | 000,188,928 | ---- | C] () -- C:\Users\***\Brillant.pps
[2007.03.25 18:07:53 | 000,047,432 | ---- | C] () -- C:\Users\***\Bullenreiten.jpg
[2007.03.25 18:07:53 | 000,030,843 | ---- | C] () -- C:\Users\***\Bundeswehr.JPG
[2007.03.25 18:07:50 | 009,595,392 | ---- | C] () -- C:\Users\***\Brennsoftware_setup.exe
[2007.03.25 18:07:50 | 000,238,080 | ---- | C] () -- C:\Users\***\Boooo.pps
[2007.03.25 18:07:50 | 000,139,776 | ---- | C] () -- C:\Users\***\brazil_girl.pps
[2007.03.25 18:07:50 | 000,064,807 | ---- | C] () -- C:\Users\***\BR 78 355.jpg
[2007.03.25 18:07:50 | 000,063,656 | ---- | C] () -- C:\Users\***\BR 38 3389.jpg
[2007.03.25 18:07:50 | 000,054,889 | ---- | C] () -- C:\Users\***\BR 38 1803.jpg
[2007.03.25 18:07:50 | 000,030,826 | ---- | C] () -- C:\Users\***\BR 05 mit Zug.JPG
[2007.03.25 18:07:50 | 000,027,859 | ---- | C] () -- C:\Users\***\BR 05.JPG
[2007.03.25 18:07:50 | 000,026,450 | ---- | C] () -- C:\Users\***\BR 01.JPG
[2007.03.25 18:07:49 | 001,300,992 | ---- | C] () -- C:\Users\***\bodybuilding1[1].pps
[2007.03.25 18:07:48 | 002,536,960 | ---- | C] () -- C:\Users\***\bldsinn.pps
[2007.03.25 18:07:48 | 002,369,536 | ---- | C] () -- C:\Users\***\Bildermix3.pps
[2007.03.25 18:07:48 | 000,139,226 | ---- | C] () -- C:\Users\***\Bild 1 Ratespiel.jpg
[2007.03.25 18:07:48 | 000,062,765 | ---- | C] () -- C:\Users\***\bike von seite2.jpg
[2007.03.25 18:07:48 | 000,060,311 | ---- | C] () -- C:\Users\***\bike von seite.jpg
[2007.03.25 18:07:48 | 000,056,024 | ---- | C] () -- C:\Users\***\Bild 2 Ratespiel.jpg
[2007.03.25 18:07:48 | 000,042,797 | ---- | C] () -- C:\Users\***\Bild036.jpg
[2007.03.25 18:07:47 | 000,049,659 | ---- | C] () -- C:\Users\***\baby.jpg
[2007.03.25 18:07:47 | 000,043,531 | ---- | C] () -- C:\Users\***\Badeanzug.jpg
[2007.03.25 18:07:47 | 000,040,371 | ---- | C] () -- C:\Users\***\Bettina.jpg
[2007.03.25 18:07:44 | 010,759,539 | ---- | C] () -- C:\Users\***\avg70free_298a417.exe
[2007.03.25 18:07:44 | 000,156,160 | ---- | C] () -- C:\Users\***\aufkl.pps
[2007.03.25 18:07:44 | 000,037,687 | ---- | C] () -- C:\Users\***\austrian_village.jpg
[2007.03.25 18:07:43 | 002,327,552 | ---- | C] () -- C:\Users\***\artistesdelephemere.pps
[2007.03.25 18:07:43 | 001,463,808 | ---- | C] () -- C:\Users\***\ARMYGIRLS.pps
[2007.03.25 18:07:43 | 000,563,200 | ---- | C] () -- C:\Users\***\arbeitstag.pps
[2007.03.25 18:07:43 | 000,032,992 | ---- | C] () -- C:\Users\***\Anlage hinten.JPG
[2007.03.25 18:07:43 | 000,031,156 | ---- | C] () -- C:\Users\***\Anlagenbild.JPG
[2007.03.25 18:07:43 | 000,029,698 | ---- | C] () -- C:\Users\***\Anlage vorne.JPG
[2007.03.25 18:07:43 | 000,021,299 | ---- | C] () -- C:\Users\***\Anlagenplaner 1080.jpg
[2007.03.25 18:07:43 | 000,009,431 | ---- | C] () -- C:\Users\***\ank485_2.jpg
[2007.03.25 18:07:43 | 000,006,878 | ---- | C] () -- C:\Users\***\any858_4.jpg
[2007.03.25 18:07:42 | 001,712,640 | ---- | C] () -- C:\Users\***\Akt-Rene-Rosie-Tenison.pps
[2007.03.25 18:07:42 | 000,716,288 | ---- | C] () -- C:\Users\***\Angelitos.pps
[2007.03.25 18:07:42 | 000,066,048 | ---- | C] () -- C:\Users\***\alter47-.pps
[2007.03.25 18:07:42 | 000,034,249 | ---- | C] () -- C:\Users\***\ANGEBER.jpg
[2007.03.25 18:07:41 | 001,698,304 | ---- | C] () -- C:\Users\***\Akt-Foxy-Feliciti.pps
[2007.03.25 18:07:27 | 000,071,891 | ---- | C] () -- C:\Users\***\251204%20132.jpg
[2007.03.25 18:07:27 | 000,061,371 | ---- | C] () -- C:\Users\***\215997_0_gross_img_0244.jpg
[2007.03.25 18:07:27 | 000,047,301 | ---- | C] () -- C:\Users\***\988704-large.jpg
[2007.03.25 18:07:27 | 000,044,551 | ---- | C] () -- C:\Users\***\3376867_400.jpg
[2007.03.25 18:07:27 | 000,037,009 | ---- | C] () -- C:\Users\***\949974-large.jpg
[2007.03.25 18:07:27 | 000,035,086 | ---- | C] () -- C:\Users\***\707880-large.jpg
[2007.03.25 18:07:27 | 000,025,280 | ---- | C] () -- C:\Users\***\988989-large.jpg
[2007.03.25 18:07:27 | 000,016,489 | ---- | C] () -- C:\Users\***\32214_large.jpg
[2007.03.25 18:07:27 | 000,010,172 | ---- | C] () -- C:\Users\***\307965413_thumb640x480.jpg
[2007.03.25 18:07:27 | 000,009,947 | ---- | C] () -- C:\Users\***\243838.jpg
[2007.03.25 18:07:26 | 001,091,584 | ---- | C] () -- C:\Users\***\501LostintheSchilderwaldundsoSkc.pps
[2007.03.25 18:07:26 | 000,183,808 | ---- | C] () -- C:\Users\***\76.pps
[2007.03.25 18:07:26 | 000,065,405 | ---- | C] () -- C:\Users\***\007.jpg
[2007.03.25 18:07:26 | 000,057,237 | ---- | C] () -- C:\Users\***\66af91a90fb150aea91816732.jpg
[2007.03.25 18:07:26 | 000,012,649 | ---- | C] () -- C:\Users\***\39_1.jpg
[2007.03.25 18:07:25 | 000,936,808 | ---- | C] () -- C:\Users\***\6.pdf
[2007.03.25 18:07:25 | 000,073,216 | ---- | C] () -- C:\Users\***\5_Geheimnisse.pps
[2007.03.25 18:07:25 | 000,069,120 | ---- | C] () -- C:\Users\***\5Frauen.pps
[2007.03.25 18:07:24 | 003,122,688 | ---- | C] () -- C:\Users\***\4ugly.avi
[2007.03.25 18:07:24 | 000,080,384 | ---- | C] () -- C:\Users\***\1_IQ-Test.pps
[2007.03.25 18:07:24 | 000,060,206 | ---- | C] () -- C:\Users\***\1_DiePfortpflanzung1.pdf
[2007.03.25 18:07:24 | 000,017,920 | ---- | C] () -- C:\Users\***\4.jpg
[2007.03.25 18:07:23 | 000,894,781 | ---- | C] () -- C:\Users\***\zoomplayer320rc1std.zip
[2007.03.25 18:07:21 | 010,226,356 | ---- | C] () -- C:\Users\***\lf2_v171.zip
[2007.03.25 18:07:20 | 000,307,432 | ---- | C] () -- C:\Users\***\dsj210.zip
[2007.03.25 18:07:17 | 000,933,376 | ---- | C] () -- C:\Users\***\Zwar-nur-schwarz-weiss-aber-oho.pps
[2007.03.25 18:07:17 | 000,230,912 | ---- | C] () -- C:\Users\***\wuestensturm.pps
[2007.03.25 17:18:59 | 000,101,888 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
 
========== ZeroAccess Check ==========
 
[2006.11.02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.04.11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.04.11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.04.11 20:00:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2010.07.03 04:30:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2010.09.17 06:53:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2007.03.26 17:36:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQLite
[2009.02.25 19:09:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ProtectDisc
[2009.06.17 20:07:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RetroShare
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2009.05.14 19:52:03 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Adobe
[2007.03.28 10:42:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AdobeUM
[2008.05.13 16:36:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ahead
[2010.10.14 18:20:26 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Apple Computer
[2011.10.17 00:42:40 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Avira
[2007.03.31 11:22:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CyberLink
[2007.03.30 09:35:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DivX
[2012.04.11 20:00:14 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\elsterformular
[2010.07.03 04:30:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\gtk-2.0
[2010.05.06 21:34:16 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HP
[2011.04.06 23:14:48 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\HpUpdate
[2010.09.17 06:53:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ
[2007.03.26 17:36:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQLite
[2007.03.25 13:13:39 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Identities
[2007.03.25 14:49:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Macromedia
[2012.09.15 17:32:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Media Center Programs
[2010.08.16 22:14:27 | 000,000,000 | --SD | M] -- C:\Users\***\AppData\Roaming\Microsoft
[2009.02.25 19:09:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ProtectDisc
[2009.06.17 20:07:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\RetroShare
[2010.02.07 11:35:50 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\skypePM
[2007.03.26 17:27:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SmartFTP
[2008.11.19 12:03:44 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Winamp
[2007.03.27 01:08:33 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WinRAR
[2010.02.19 21:09:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Yahoo!
 
< %APPDATA%\*.exe /s >
[2011.02.15 00:43:49 | 000,010,134 | R--- | M] () -- C:\Users\***\AppData\Roaming\Microsoft\Installer\{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}\ARPPRODUCTICON.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\drivers\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008.02.13 21:13:36 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008.02.13 21:13:36 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008.02.13 21:13:35 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.04.03 20:04:20 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2007.04.03 20:04:21 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012.09.07 17:04:42 | 000,218,696 | ---- | M] () MD5=4E0D8C9F83B7FD82393F7D8CCC27E7AE -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 64 bytes -> C:\Users\***\WEDDING.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0649.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0501.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0236.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0177.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0174.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0138.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0105.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\v0055.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\umbro.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\THE-NIKE-BEACH-EDITION.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Pepsi Piercing.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\ost.avi:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\myNewCoat.mpg.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\montavit-the-hero_1.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Mauerbau.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Liebesspiel.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\jobfrust.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\inspiration.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\hand-rolled.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica4.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica3.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica2.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Ginnastica1.m1v:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\gentleman.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\feine-herren.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\fahrschule.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\eurcncs185030.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\Red Hot Chili Peppers - Snow (Hey Oh) (live at Top Of The Pops).mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\Desktop\bounce.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DEODORAN.MPE:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DE3.mpg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\DasistMobbing.mpeg:TOC.WMV
@Alternate Data Stream - 64 bytes -> C:\Users\***\4ugly.avi:TOC.WMV

< End of report >

cosinus 01.10.2012 12:42
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-1146650413-166516795-3937567613-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: []  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - E:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2008.11.11 11:40:16 | 000,000,112 | RHS- | M] () - G:\autorun.inf -- [ NTFS ]
:Files
D:\Eigene Dateien\GDiVX1.9.9.6.exe
D:\Neuer Ordner\GDiVX1.9.9.6.exe
C:\ProgramData\*.pad
C:\Programme\ICQ6Toolbar
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131