Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   svchost.exe Problem (https://www.trojaner-board.de/92628-svchost-exe-problem.html)

chrismio 07.11.2010 23:52
svchost.exe Problem
 
Hallo,

da ich vermultich alleine nicht weiter komme,möchte ich gerne die Profis um Hilfe bitten.

Meine Logfile und meine Vermutung:




O4 - HKLM\..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKCU\..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe


Running processes:
C:\Program Files (x86)\PopTray\PopTray.exe
C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
D:\Downloads\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ievkbd.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: link filter bho - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe"
O4 - HKLM\..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKLM\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKCU\..\Policies\Explorer\Run: [Policies] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETZWERKDIENST')
O4 - Startup: PopTray.lnk = C:\Program Files (x86)\PopTray\PopTray.exe
O8 - Extra context menu item: An vorhandenes PDF anfügen - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll
O13 - Gopher Prefix:
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. - C:\Windows\system32\astsrv.exe
O23 - Service: Ati External Event Utility - Unknown owner - C:\Windows\system32\Ati2evxx.exe (file missing)
O23 - Service: Kaspersky Anti-Virus Service (AVP) - Kaspersky Lab ZAO - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe
O23 - Service: Dell Printer Status Watcher (DLPWD) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE
O23 - Service: Dell Printer Status Database (DLSDB) - Dell Inc. - C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero Update (NAUpdate) - Nero AG - C:\Program Files (x86)\Nero\Update\NASvc.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\SysWOW64\nlssrv32.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
O23 - Service: @C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)


bin mir nicht sicher, die exe startet immer beim Windowsstart mit .

Bitte um Hilfe, ob ich sie löschen ( wenn ja dann wie) muss, oder ist das olles ok.

mfG chrismio

cosinus 08.11.2010 02:55
Gewöhn dir bitte an, Logfiles nur vollständig zu posten! Der Kopf des HJT-Logs fehlt!


Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Danach OTL:

Systemscan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

chrismio 08.11.2010 08:47
Danke für die schnelle Antwort.

Anbei poste ich die Logfiles vom Malwarebytes und vom OTL.
Daknke für Hilfe.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 5068

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

08.11.2010 08:24:50
mbam-log-2010-11-08 (08-24-50).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 141248
Laufzeit: 31 Minute(n), 8 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 4
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 8

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{rp8rv11u-mlop-oxwa-33l2-g83rckoln4v3} (Generic.Bot.H) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hkcu (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hklm (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\policies (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Generic.Bot.H) -> Quarantined and deleted successfully.
C:\Users\Chris\AppData\Roaming\runtime.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R0IQ733.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R36XCI3.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R8LM9A8.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$R9CX11H.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$RMSAP8U.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.
C:\$Recycle.Bin\S-1-5-21-972587628-1301024485-730574312-1000\$RN7YSE9.exe (Trojan.FakeMS.Gen) -> Quarantined and deleted successfully.


OTL Logfile:
Code:
OTL Extras logfile created on: 08.11.2010 08:31:16 - Run 1
OTL by OldTimer - Version 3.2.17.3    Folder = D:\Downloads
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 68,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,07 Gb Total Space | 38,01 Gb Free Space | 54,26% Space Free | Partition Type: NTFS
Drive D: | 152,71 Gb Total Space | 68,77 Gb Free Space | 45,03% Space Free | Partition Type: NTFS
Drive E: | 221,81 Gb Total Space | 216,06 Gb Free Space | 97,41% Space Free | Partition Type: NTFS
Drive F: | 11,02 Gb Total Space | 5,17 Gb Free Space | 46,93% Space Free | Partition Type: NTFS
Drive Z: | 10,00 Gb Total Space | 6,48 Gb Free Space | 64,79% Space Free | Partition Type: NTFS
 
Computer Name: CHRIS-PC | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\ieframe.DLL (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %* File not found
cmdfile [open] -- "%1" %* File not found
comfile [open] -- "%1" %* File not found
exefile [open] -- "%1" %* File not found
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %* File not found
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1" File not found
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S File not found
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found
Directory [ACDSee Pro 3.Manage] -- "D:\Programme\ACDSee\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [Bridge] -- D:\Programme\Adobe Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ACDSee Pro 3.Manage] -- "D:\Programme\ACDSee\ACDSee Pro\3.0\ACDSeeQVPro3.exe" "%1" (ACD Systems International Inc.)
Directory [Bridge] -- D:\Programme\Adobe Photoshop CS5\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9D00A8DA-650F-21C6-E787-78756733F15F}" = ATI Catalyst Install Manager
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{AC76BA86-1033-0000-0064-0003D0000004}" = Adobe Acrobat 9 Pro Extended 64-bit Add-On
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{E5A509B4-D9B1-4FD9-B3EF-EDB216AA8651}" = ccc-utility64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"ImagenomicNoisewareProPlugin" = Imagenomic Noiseware 4.2 Professional Plug-in (build 4205)
"KLiteCodecPack64_is1" = K-Lite Codec Pack (64-bit) v4.0.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{08C8666B-C502-4AB3-B4CB-D74AC42D14FE}" = Nero BackItUp 10 Help (CHM)
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0FFAC7BB-50DC-CB54-6CA7-A8B74513280B}" = CCC Help Chinese Traditional
"{105F3CE5-FE55-408E-BF30-E78F85BA0B12}" = Dell-Druckersoftware
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16987E99-C95C-4513-9239-7B44A0A71DB5}" = Nero SoundTrax 10 Help (CHM)
"{1B280FAF-AE10-4E31-A41A-DB3917D651DC}" = ACDSee Pro 3
"{1C802083-6D79-78ED-BF1C-601DDF908DD1}" = Catalyst Control Center Core Implementation
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F7FB68F-52F6-46A3-B42F-38CE46295AE5}" = Nero MediaHub 10
"{237CCB62-8454-43E3-B158-3ACD0134852E}" = High-Definition Video Playback 10
"{2436F2A8-4B7E-4B6C-AE4E-604C84AA6A4F}" = Nero Core Components 10
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{277C1559-4CF7-44FF-8D07-98AA9C13AABD}" = Nero Multimedia Suite 10
"{28728178-FF15-218B-0B63-012692F42C28}" = CCC Help Danish
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{32851025-1E46-83A3-1320-471619254E39}" = Catalyst Control Center Localization All
"{329411A0-19F3-4740-874F-17400B126F27}" = Nero Vision 10 Help (CHM)
"{33643918-7957-4839-92C7-EA96CB621A98}" = Nero Express 10 Help (CHM)
"{34490F4E-48D0-492E-8249-B48BECF0537C}" = Nero DiscSpeed 10
"{40217B2F-462B-94A4-E84E-6A1C6EDBCE2F}" = CCC Help Swedish
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{523B2B1B-D8DB-4B41-90FF-C4D799E2758A}" = Nero ControlCenter 10 Help (CHM)
"{5343A801-92E5-C234-9F27-AB27EC738BF6}" = CCC Help Japanese
"{555868C6-49FB-484F-BB43-8980651A1B00}" = Nero BurnRights 10 Help (CHM)
"{5D22226D-EBC1-C95F-7746-2E3A9F4C97BA}" = CCC Help Russian
"{600C37F2-098B-A165-C1DB-6AE2B89D8D49}" = Catalyst Control Center Graphics Previews Common
"{61F8CA2C-9A80-8A1B-D3B9-347530CB387F}" = CCC Help Norwegian
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63AA3EAB-23BB-48B2-9AD0-44F878075604}" = Nero 10 Menu TemplatePack Basic
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{66049135-9659-4AAD-9169-9CCA269EBB3E}" = Nero InfoTool 10 Help (CHM)
"{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"{674B407D-EAB1-B6B6-F9BF-C34CEE4CD83F}" = Catalyst Control Center Graphics Light
"{68AB6930-5BFF-4FF6-923B-516A91984FE6}" = Nero BackItUp 10
"{69F411C5-4851-6DA9-EA4C-160BEF8788AA}" = CCC Help French
"{6DD27E54-2598-0FEC-7CE1-BE00924C0570}" = Catalyst Control Center Graphics Previews Vista
"{6DFB899F-17A2-48F0-A533-ED8D6866CF38}" = Nero Control Center 10
"{70550193-1C22-445C-8FA4-564E155DB1A7}" = Nero Express 10
"{7A295D8F-484B-4FFB-89AB-C1FD497591FE}" = Nero WaveEditor 10 Help (CHM)
"{7A5D731D-B4B3-490E-B339-75685712BAAB}" = Nero Burning ROM 10
"{7C27114E-6FC8-21F5-E501-FE48F09243DF}" = CCC Help Dutch
"{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE)
"{80237C20-CBF3-F841-4AD5-E727AA86FBD1}" = CCC Help Italian
"{802EE127-D32A-1447-09DC-77419772BCDC}" = CCC Help Portuguese
"{836AFA32-7B8B-2C19-99D9-36EF32B42EB8}" = CCC Help Thai
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8ECEC853-5C3D-4B10-B5C7-FF11FF724807}" = Nero Recode 10
"{90120000-0014-0000-0000-0000000FF1CE}" = Microsoft Office Professional 2007
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0014-0000-0000-0000000FF1CE}_PRO_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_PRO_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_PRO_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PRO_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PRO_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_PRO_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0000-1000-0000000FF1CE}_PRO_{E64BA721-2310-4B55-BE5A-2925F9706192}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002A-0407-1000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_PRO_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2)
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92E25238-61A3-4ACD-A407-3C480EEF47A7}" = Nero RescueAgent 10 Help (CHM)
"{943CFD7D-5336-47AF-9418-E02473A5A517}" = Nero BurnRights 10
"{946942CB-D078-F33A-A3CD-27E0393507FD}" = CCC Help Turkish
"{9682B99B-BB28-AD37-CA50-C1CB5BFF0FA6}" = Catalyst Control Center Graphics Full New
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A4297F3-2A51-4ED9-92CA-4BCB8380947E}" = Nero Vision 10
"{9B6B24BE-80E7-46C4-9FA5-B167D5E0F345}" = Nero BurningROM 10 Help (CHM)
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9EB46587-4354-411C-BBAC-A9BBB2131F3D}" = FocalPoint 1.0
"{A02CC93A-134F-0319-1438-B1E895B52577}" = CCC Help German
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7E1ADB8-162B-7C33-60FB-0561A17BD876}" = CCC Help Spanish
"{A96EEF55-155C-552E-ABB1-6FDAEF5BD944}" = CCC Help Polish
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_940" = Adobe Acrobat 9.4.0 - CPSID_83708
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{ADB25FF0-AEC4-2CFB-130C-2C60D80C5934}" = CCC Help Greek
"{B04D5DA5-11DA-830C-85C6-0FF9185787E7}" = Skins
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{BB603E9F-ECE8-7713-B0AC-7E0614E8C058}" = Catalyst Control Center HydraVision Full
"{BE232D60-AEA5-502F-ACBF-9AC188A82C21}" = CCC Help Finnish
"{C15C4AB5-EF5D-5050-273C-4636E3FBE301}" = CCC Help Czech
"{C18A0418-442A-4186-AF98-D08F5054A2FC}" = Nero DiscSpeed 10 Help (CHM)
"{C3273C55-E1E4-41FF-8D69-0158090DB8D8}" = Nero CoverDesigner 10 Help (CHM)
"{C3580AC4-C827-4332-B935-9A282ED5BB97}" = Nero Dolby Files 10
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}" = Microsoft Primary Interoperability Assemblies 2005
"{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DB7C1D4A-08BA-4C7E-A8AA-B7F9BB372DCF}" = Nero Recode 10 Help (CHM)
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E09CD13D-7CE3-351C-1625-8DC7F21A99C0}" = ccc-core-static
"{E1EE5339-5D32-458F-BAAB-B19F6301BCE2}" = Nero SoundTrax 10
"{E337E787-CF61-4B7B-B84F-509202A54023}" = Nero RescueAgent 10
"{E373E0E2-20F5-90DF-B315-615EA6E52101}" = Catalyst Control Center Graphics Full Existing
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.0
"{E6DA746E-1175-88BD-2B16-1DC62018E060}" = CCC Help Chinese Standard
"{EDCDFAD5-DF80-4600-A493-E9DAD6810230}" = Nero WaveEditor 10
"{F053BFD9-4357-6A82-6042-CF919667448F}" = CCC Help English
"{F17EB02C-DA0D-EDEF-2E16-501FB700A710}" = CCC Help Hungarian
"{F412B4AF-388C-4FF5-9B2F-33DB1C536953}" = Nero InfoTool 10
"{F467862A-D9CA-47ED-8D81-B4B3C9399272}" = Nero MediaHub 10 Help (CHM)
"{F5CB822F-B365-43D1-BCC0-4FDA1A2017A7}" = Nero 10 Movie ThemePack Basic
"{F5DDC0CD-F13A-83F0-5103-563A17EA306F}" = CCC Help Korean
"{F6117F9C-ADB5-4590-9BE4-12C7BEC28702}" = Nero StartSmart 10 Help (CHM)
"{F61D489E-6C44-49AC-AD02-7DA8ACA73A65}" = Nero StartSmart 10
"{FCF00A6E-FB58-477A-ABE9-232907105521}" = Nero CoverDesigner 10
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aignesamdeadlink_is1" = AM-DeadLink 4.3
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Bokeh" = Alien Skin Bokeh
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"ffdshow_is1" = ffdshow [rev 3268] [2010-02-14]
"HDR Efex Pro" = HDR Efex Pro
"HijackThis" = HijackThis 2.0.2
"HyperSnap 6" = HyperSnap 6
"InstallWIX_{66F1F013-008F-4875-B283-5A814B820347}" = Kaspersky Internet Security 2011
"IsoBuster_is1" = IsoBuster 2.6
"KLiteCodecPack_is1" = K-Lite Codec Pack 5.1.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)
"Perfectly Clear Plugin" = Perfectly Clear Plugin 1.0.3
"phonostar3RadioPlayer_is1" = phonostar-Player Version 3.01.2
"PhotomatixPro3Betax32_is1" = Photomatix Pro version 3.2.5
"PopTray" = PopTray 3.20
"PRO" = Microsoft Office Professional 2007
"Security Task Manager" = Security Task Manager 1.7h
"Sharpener Pro 3.0" = Sharpener Pro 3.0
"Totalcmd" = Total Commander (Remove or Repair)
"TuneUp Utilities" = TuneUp Utilities
"Viveza 2" = Viveza 2
"Winamp" = Winamp
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---

OTL Logfile:
Code:
OTL logfile created on: 08.11.2010 08:31:16 - Run 1
OTL by OldTimer - Version 3.2.17.3    Folder = D:\Downloads
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 68,00% Memory free
8,00 Gb Paging File | 7,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 70,07 Gb Total Space | 38,01 Gb Free Space | 54,26% Space Free | Partition Type: NTFS
Drive D: | 152,71 Gb Total Space | 68,77 Gb Free Space | 45,03% Space Free | Partition Type: NTFS
Drive E: | 221,81 Gb Total Space | 216,06 Gb Free Space | 97,41% Space Free | Partition Type: NTFS
Drive F: | 11,02 Gb Total Space | 5,17 Gb Free Space | 46,93% Space Free | Partition Type: NTFS
Drive Z: | 10,00 Gb Total Space | 6,48 Gb Free Space | 64,79% Space Free | Partition Type: NTFS
 
Computer Name: CHRIS-PC | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Windows\SysWOW64\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation)
PRC - C:\Windows\SysWOW64\ASTSRV.EXE (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\PopTray\PopTray.exe (Renier Crause)
 
 
========== Modules (SafeList) ==========
 
MOD - D:\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (astcc) -- C:\Windows\SysNative\astsrv.exe File not found
SRV:64bit: - (Ati External Event Utility) -- C:\Windows\SysNative\Ati2evxx.exe (ATI Technologies Inc.)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (AVP) -- C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (DLSDB) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe (Dell Inc.)
SRV - (NAUpdate) -- C:\Program Files (x86)\Nero\Update\NASvc.exe (Nero AG)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (DLPWD) -- C:\Programme\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe (Dell Inc.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (astcc) -- C:\Windows\SysWOW64\ASTSRV.EXE (Nalpeiron Ltd.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (e1express) Intel(R) -- C:\Windows\SysNative\drivers\e1e6232e.sys (Intel Corporation)
DRV:64bit: - (LVUSBS64) -- C:\Windows\SysNative\drivers\LVUSBS64.sys (Logitech Inc.)
DRV:64bit: - (LVRS64) -- C:\Windows\SysNative\drivers\lvrs64.sys (Logitech Inc.)
DRV:64bit: - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\SysNative\drivers\LV302V64.SYS (Logitech Inc.)
DRV:64bit: - (lvpepf64) -- C:\Windows\SysNative\drivers\lv302a64.sys (Logitech Inc.)
DRV - (Null) -- C:\Windows\SysWow64\NULL ()
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FC 25 B4 45 69 77 CB 01  [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "wetter.com"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.web.de"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.1
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.10
FF - prefs.js..extensions.enabledItems: snaplinks@snaplinks.mozdev.org:1.0.8
FF - prefs.js..extensions.enabledItems: {06652CB6-16D0-4e7a-BF2D-E0037A87E57A}:0.2.5
FF - prefs.js..extensions.enabledItems: {e1c8879e-9db4-4adf-92d2-d4856bd434ef}:1.1.9.2
FF - prefs.js..extensions.enabledItems: {ec268e28-22c6-4a6c-ac22-635cabee283c}:1.0.1
FF - prefs.js..extensions.enabledItems: pl@dictionaries.addons.mozilla.org:1.0.20100911
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {35106bca-6c78-48c7-ac28-56df30b51d2a}:1.3.8
FF - prefs.js..extensions.enabledItems: {81514210-E22A-4e69-93D5-E1EFD45B4620}:0.3.10.01.23
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
 
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.10.30 12:16:33 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.11.08 00:12:09 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\THBExt [2010.10.29 14:49:24 | 000,000,000 | ---D | M]
 
[2010.10.29 14:02:44 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Extensions
[2010.11.07 21:44:26 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions
[2010.10.30 11:37:22 | 000,000,000 | ---D | M] (Locate in Bookmark Folders) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{06652CB6-16D0-4e7a-BF2D-E0037A87E57A}
[2010.10.29 16:30:19 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010.11.05 16:56:51 | 000,000,000 | ---D | M] (Linkification) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{35106bca-6c78-48c7-ac28-56df30b51d2a}
[2010.10.29 16:28:20 | 000,000,000 | ---D | M] (Past Modern) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{81514210-E22A-4e69-93D5-E1EFD45B4620}
[2010.11.03 12:43:12 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.10.31 08:01:20 | 000,000,000 | ---D | M] (text/plain) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{e1c8879e-9db4-4adf-92d2-d4856bd434ef}
[2010.10.31 08:04:29 | 000,000,000 | ---D | M] (Plain Text Links) -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\{ec268e28-22c6-4a6c-ac22-635cabee283c}
[2010.11.01 21:13:31 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\pl@dictionaries.addons.mozilla.org
[2010.10.29 16:37:38 | 000,000,000 | ---D | M] -- C:\Users\Chris\AppData\Roaming\mozilla\Firefox\Profiles\jseekovh.default\extensions\snaplinks@snaplinks.mozdev.org
[2010.10.30 12:49:05 | 000,002,255 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\jseekovh.default\searchplugins\askcom.xml
[2010.11.02 19:55:35 | 000,003,470 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Mozilla\FireFox\Profiles\jseekovh.default\searchplugins\wettercom.xml
[2010.11.07 21:44:26 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions
[2010.11.05 14:15:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.11.05 14:15:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.06.29 05:01:22 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2010.10.27 06:44:13 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.10.27 06:44:13 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.10.27 06:44:13 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.10.27 06:44:13 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.10.27 06:44:13 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.11.06 21:54:07 | 000,001,080 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 mpa.one.microsoft.com
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [HKLM] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKCU..\Run: [HKCU] C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft)
O4 - Startup: C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk = C:\Program Files (x86)\PopTray\PopTray.exe (Renier Crause)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 03 0F FF 03  [binary data]
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Users\Chris\AppData\Roaming\WinDir\Svchost.exe (Microsoft)
O8:64bit: - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\ie_banner_deny.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Meine Programme\Kaspersky Internet Security\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - Reg Error: Key error. File not found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\x64\kloehk.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\x64\kloehk.dll (Kaspersky Lab ZAO)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\x64\sbhook64.dll acaptuser64.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\x64\sbhook64.dll acaptuser64.dll File not found
O20 - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\mzvkbd3.dll (Kaspersky Lab ZAO)
O20 - AppInit_DLLs: (C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll) - C:\PROGRA~2\MEINEP~1\KASPER~1\sbhook.dll acaptuser32.dll File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20:64bit: - Winlogon\Notify\klogon: DllName - Reg Error: Key error. - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 0
O34 - HKLM BootExecute: (autocheck autochk /p \??\M:) -  File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.11.08 00:25:59 | 000,024,416 | R--- | C] (Adobe Systems Inc.) -- C:\Windows\SysNative\AdobePDFUI.dll
[2010.11.08 00:23:59 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Malwarebytes
[2010.11.08 00:23:34 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
[2010.11.08 00:23:32 | 000,024,664 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2010.11.08 00:23:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2010.11.08 00:23:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2010.11.08 00:19:22 | 000,112,056 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\acaptuser32.dll
[2010.11.07 23:03:44 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2010.11.07 23:03:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Security Task Manager
[2010.11.07 22:10:18 | 000,052,568 | ---- | C] (Adobe Systems Inc) -- C:\Windows\SysNative\AdobePDF.dll
[2010.11.07 21:27:43 | 000,000,000 | ---D | C] -- C:\Programme\KLCP64
[2010.11.07 21:21:51 | 000,839,680 | ---- | C] (hxxp://www.mp3dev.org/) -- C:\Windows\SysWow64\lameACM.acm
[2010.11.07 21:21:50 | 000,217,088 | ---- | C] (www.helixcommunity.org) -- C:\Windows\SysWow64\yv12vfw.dll
[2010.11.07 21:21:50 | 000,118,784 | ---- | C] (fccHandler) -- C:\Windows\SysWow64\ac3acm.acm
[2010.11.07 21:21:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\K-Lite Codec Pack
[2010.11.07 12:10:11 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010.11.07 10:46:43 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Google
[2010.11.07 10:44:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2010.11.06 23:42:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Works
[2010.11.06 23:42:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio
[2010.11.06 23:42:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2010.11.06 23:42:23 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2010.11.06 23:40:48 | 000,000,000 | ---D | C] -- C:\Programme\Microsoft Office
[2010.11.06 23:40:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2010.11.06 23:38:28 | 000,000,000 | RH-D | C] -- C:\MSOCache
[2010.11.05 16:06:16 | 000,000,000 | ---D | C] -- C:\Users\Chris\SamyGoTemp
[2010.11.05 14:16:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2010.11.05 14:16:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2010.11.05 14:15:54 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2010.11.05 14:15:54 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.11.05 14:15:54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.11.05 14:15:54 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.11.05 14:15:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2010.11.05 10:53:58 | 000,192,832 | ---- | C] (Dell Inc.) -- C:\Windows\SysNative\dlsrm.dll
[2010.11.05 10:53:15 | 000,000,000 | ---D | C] -- C:\Programme\Dell Printers
[2010.11.03 20:15:53 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2010.11.03 19:23:37 | 000,180,736 | ---- | C] (Dell Inc.) -- C:\Windows\SysNative\dlhsmzil.dll
[2010.11.03 12:15:31 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Nik Software
[2010.11.01 21:01:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audiograbber
[2010.10.31 09:07:34 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\aignes
[2010.10.31 09:07:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AM-DeadLink
[2010.10.30 17:06:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSXML 4.0
[2010.10.30 12:19:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\totalcmd
[2010.10.30 12:19:44 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\GHISLER
[2010.10.30 12:16:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ask.com
[2010.10.30 12:16:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Smart Projects
[2010.10.30 10:52:32 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\onOne Software
[2010.10.30 10:52:30 | 000,000,000 | ---D | C] -- C:\ProgramData\onOne Software
[2010.10.30 10:52:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\onOne Software
[2010.10.30 10:45:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\Documents\Aufnahmen
[2010.10.30 10:45:17 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\phonostar GmbH
[2010.10.30 10:45:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\phonostar-Player
[2010.10.30 10:40:41 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Athentech
[2010.10.30 10:38:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Athentech
[2010.10.30 10:33:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PhotomatixPro3
[2010.10.30 10:24:07 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Alien Skin
[2010.10.30 10:11:35 | 000,057,344 | ---- | C] (Nalpeiron Ltd.) -- C:\Windows\SysWow64\ASTSRV.EXE
[2010.10.30 10:11:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Alien Skin
[2010.10.30 09:04:51 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\skypePM
[2010.10.30 09:02:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2010.10.30 09:02:29 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2010.10.30 09:02:29 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Skype
[2010.10.30 09:02:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2010.10.30 08:48:10 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Nero
[2010.10.30 08:42:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nero
[2010.10.30 08:38:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Nero
[2010.10.30 08:37:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Nero
[2010.10.30 08:32:14 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DCompiler_42.dll
[2010.10.30 08:31:53 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_40.dll
[2010.10.30 08:31:33 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_35.dll
[2010.10.30 08:31:12 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_34.dll
[2010.10.30 08:30:52 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_30.dll
[2010.10.29 23:27:53 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2010.10.29 23:27:53 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Adobe Mini Bridge CS5
[2010.10.29 22:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Nik Software
[2010.10.29 22:41:35 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Imagenomic
[2010.10.29 22:05:06 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Nik Software
[2010.10.29 21:54:58 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe
[2010.10.29 21:25:37 | 000,033,608 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe
[2010.10.29 21:25:31 | 000,036,168 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\uxtuneup.dll
[2010.10.29 21:25:31 | 000,030,024 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\uxtuneup.dll
[2010.10.29 21:25:31 | 000,025,928 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll
[2010.10.29 21:25:30 | 000,021,320 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll
[2010.10.29 21:25:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\TuneUp Software
[2010.10.29 21:24:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2010
[2010.10.29 21:23:54 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2010.10.29 21:23:32 | 000,000,000 | -HSD | C] -- C:\ProgramData\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010.10.29 21:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2010.10.29 20:58:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
[2010.10.29 20:42:13 | 000,000,000 | ---D | C] -- C:\Windows\MSSecurityNS
[2010.10.29 20:42:13 | 000,000,000 | ---D | C] -- C:\Windows\MSSecurityNi
[2010.10.29 20:35:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\winrar
[2010.10.29 20:30:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\ACD Systems
[2010.10.29 20:30:26 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\ACD Systems
[2010.10.29 20:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\ACD Systems
[2010.10.29 20:29:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ACD Systems
[2010.10.29 20:20:01 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Downloaded Installations
[2010.10.29 20:04:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ffdshow
[2010.10.29 20:02:16 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Media Player Classic
[2010.10.29 19:56:52 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\D3DX9_42.dll
[2010.10.29 19:56:51 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\d3dx9_31.dll
[2010.10.29 19:56:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect
[2010.10.29 19:55:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2010.10.29 19:55:54 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Winamp
[2010.10.29 19:55:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp
[2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\ATI
[2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\ATI
[2010.10.29 19:49:15 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI
[2010.10.29 19:47:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ATI Technologies
[2010.10.29 18:41:35 | 000,000,000 | ---D | C] -- C:\Programme\ATI Technologies
[2010.10.29 18:41:32 | 000,000,000 | ---D | C] -- C:\Programme\ATI
[2010.10.29 18:38:11 | 000,000,000 | -H-D | C] -- C:\ATI
[2010.10.29 17:44:53 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2010.10.29 16:54:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2010.10.29 16:52:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2010.10.29 16:52:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe
[2010.10.29 16:47:27 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Macromedia
[2010.10.29 16:47:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Adobe
[2010.10.29 16:47:10 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Adobe
[2010.10.29 16:47:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe
[2010.10.29 16:46:42 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Adobe
[2010.10.29 16:34:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight
[2010.10.29 15:56:47 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\T-Online
[2010.10.29 15:42:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\PopTray
[2010.10.29 15:41:27 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed
[2010.10.29 15:41:09 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2010.10.29 15:41:09 | 000,000,000 | ---D | C] -- C:\ProgramData\T-Online
[2010.10.29 15:40:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2010.10.29 15:29:53 | 001,942,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dfshim.dll
[2010.10.29 15:29:53 | 001,130,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dfshim.dll
[2010.10.29 15:29:53 | 000,320,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHost.exe
[2010.10.29 15:29:53 | 000,295,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHost.exe
[2010.10.29 15:29:53 | 000,109,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\PresentationHostProxy.dll
[2010.10.29 15:29:53 | 000,099,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\PresentationHostProxy.dll
[2010.10.29 15:29:53 | 000,049,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netfxperf.dll
[2010.10.29 15:29:53 | 000,048,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netfxperf.dll
[2010.10.29 15:28:54 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe
[2010.10.29 15:19:55 | 000,702,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2010.10.29 15:19:54 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll
[2010.10.29 15:19:53 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll
[2010.10.29 15:19:53 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll
[2010.10.29 15:19:53 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2010.10.29 15:19:53 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll
[2010.10.29 15:19:53 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll
[2010.10.29 15:19:52 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec
[2010.10.29 15:19:52 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec
[2010.10.29 15:19:52 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2010.10.29 15:19:52 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2010.10.29 15:19:52 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2010.10.29 15:19:52 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe
[2010.10.29 15:19:52 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe
[2010.10.29 15:19:50 | 000,046,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msasn1.dll
[2010.10.29 15:19:44 | 001,446,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\lsasrv.dll
[2010.10.29 15:19:20 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll
[2010.10.29 15:19:20 | 000,293,888 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll
[2010.10.29 15:19:20 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\fontsub.dll
[2010.10.29 15:19:20 | 000,070,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\fontsub.dll
[2010.10.29 15:19:20 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll
[2010.10.29 15:19:20 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll
[2010.10.29 15:19:11 | 000,027,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\Diskdump.sys
[2010.10.29 15:19:08 | 000,961,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CPFilters.dll
[2010.10.29 15:19:08 | 000,641,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CPFilters.dll
[2010.10.29 15:19:08 | 000,552,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msdri.dll
[2010.10.29 15:19:08 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MSNP.ax
[2010.10.29 15:19:08 | 000,258,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mpg2splt.ax
[2010.10.29 15:19:08 | 000,204,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSNP.ax
[2010.10.29 15:19:07 | 000,613,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\psisdecd.dll
[2010.10.29 15:19:07 | 000,465,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\psisdecd.dll
[2010.10.29 15:19:07 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mpg2splt.ax
[2010.10.29 15:18:52 | 005,507,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2010.10.29 15:18:51 | 003,955,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2010.10.29 15:18:51 | 003,899,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2010.10.29 15:18:42 | 001,975,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\CertEnroll.dll
[2010.10.29 15:18:42 | 001,320,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\CertEnroll.dll
[2010.10.29 15:18:36 | 000,954,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40.dll
[2010.10.29 15:18:35 | 000,954,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc40u.dll
[2010.10.29 15:18:29 | 014,627,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmp.dll
[2010.10.29 15:18:27 | 011,406,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmp.dll
[2010.10.29 15:18:25 | 012,625,408 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmploc.DLL
[2010.10.29 15:18:24 | 012,625,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmploc.DLL
[2010.10.29 15:18:21 | 000,422,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_isv.dll
[2010.10.29 15:18:21 | 000,369,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc.dll
[2010.10.29 15:18:21 | 000,365,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_isv.dll
[2010.10.29 15:18:20 | 000,424,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc.dll
[2010.10.29 15:18:20 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_isv.exe
[2010.10.29 15:18:20 | 000,356,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate.exe
[2010.10.29 15:18:20 | 000,324,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_isv.exe
[2010.10.29 15:18:20 | 000,320,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate.exe
[2010.10.29 15:18:20 | 000,306,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp.exe
[2010.10.29 15:18:20 | 000,305,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RMActivate_ssp_isv.exe
[2010.10.29 15:18:20 | 000,280,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp.exe
[2010.10.29 15:18:20 | 000,277,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RMActivate_ssp_isv.exe
[2010.10.29 15:18:20 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp_isv.dll
[2010.10.29 15:18:20 | 000,121,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\secproc_ssp.dll
[2010.10.29 15:18:20 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp_isv.dll
[2010.10.29 15:18:20 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\secproc_ssp.dll
[2010.10.29 15:18:16 | 002,870,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\explorer.exe
[2010.10.29 15:18:16 | 002,614,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\explorer.exe
[2010.10.29 15:18:16 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winlogon.exe
[2010.10.29 15:18:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft.NET
[2010.10.29 15:18:14 | 002,085,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ole32.dll
[2010.10.29 15:18:09 | 001,736,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll
[2010.10.29 15:18:08 | 001,024,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wmpmde.dll
[2010.10.29 15:18:08 | 000,738,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wmpmde.dll
[2010.10.29 15:18:06 | 000,144,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdd.dll
[2010.10.29 15:18:06 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\sscore.dll
[2010.10.29 15:18:04 | 000,633,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\comctl32.dll
[2010.10.29 15:18:03 | 001,572,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\quartz.dll
[2010.10.29 15:18:03 | 001,328,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\quartz.dll
[2010.10.29 15:18:03 | 000,091,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\avifil32.dll
[2010.10.29 15:18:03 | 000,084,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mciavi32.dll
[2010.10.29 15:17:57 | 000,861,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\oleaut32.dll
[2010.10.29 15:17:56 | 000,082,944 | ---- | C] (Radius Inc.) -- C:\Windows\SysWow64\iccvid.dll
[2010.10.29 15:17:55 | 000,148,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\t2embed.dll
[2010.10.29 15:17:55 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\t2embed.dll
[2010.10.29 15:17:54 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2010.10.29 15:17:51 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2010.10.29 15:17:51 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2010.10.29 15:17:46 | 000,483,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\StructuredQuery.dll
[2010.10.29 15:17:44 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2010.10.29 15:17:44 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2010.10.29 15:17:44 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2010.10.29 15:17:44 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2010.10.29 15:17:44 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2010.10.29 15:17:44 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2010.10.29 15:17:43 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rtutils.dll
[2010.10.29 15:17:43 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rtutils.dll
[2010.10.29 15:14:56 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Microsoft Help
[2010.10.29 15:14:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2010.10.29 14:49:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Meine Programme
[2010.10.29 14:49:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2010.10.29 14:49:08 | 000,556,120 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2010.10.29 14:47:47 | 000,000,000 | -HSD | C] -- C:\Windows\Installer
[2010.10.29 14:47:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
[2010.10.29 14:44:36 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010.10.29 14:38:06 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\WinRAR
[2010.10.29 14:37:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Formats
[2010.10.29 14:21:05 | 000,000,000 | ---D | C] -- C:\Windows\Panther
[2010.10.29 14:02:40 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Mozilla
[2010.10.29 14:02:40 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Mozilla
[2010.10.29 14:02:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2010.10.29 14:01:50 | 000,000,000 | ---D | C] -- C:\Programme\Meine Programme
[2010.10.29 13:32:28 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\logishrd
[2010.10.29 13:32:05 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cabview.dll
[2010.10.29 13:32:05 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cabview.dll
[2010.10.29 13:32:04 | 000,220,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2010.10.29 13:32:04 | 000,172,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wintrust.dll
[2010.10.29 13:30:30 | 000,000,000 | R--D | C] -- C:\Users\Chris\Searches
[2010.10.29 13:30:22 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Identities
[2010.10.29 13:30:20 | 000,000,000 | R--D | C] -- C:\Users\Chris\Contacts
[2010.10.29 13:30:18 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\VirtualStore
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Vorlagen
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Verlauf
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Temporary Internet Files
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Startmenü
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\SendTo
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Recent
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Netzwerkumgebung
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Lokale Einstellungen
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Videos
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Musik
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Eigene Dateien
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Documents\Eigene Bilder
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Druckumgebung
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Cookies
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\AppData\Local\Anwendungsdaten
[2010.10.29 13:30:07 | 000,000,000 | -HSD | C] -- C:\Users\Chris\Anwendungsdaten
[2010.10.29 13:30:05 | 000,000,000 | --SD | C] -- C:\Users\Chris\AppData\Roaming\Microsoft
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Videos
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Saved Games
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Pictures
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Music
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Links
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Favorites
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Downloads
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Documents
[2010.10.29 13:30:05 | 000,000,000 | R--D | C] -- C:\Users\Chris\Desktop
[2010.10.29 13:30:05 | 000,000,000 | -H-D | C] -- C:\Users\Chris\AppData
[2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Temp
[2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Local\Microsoft
[2010.10.29 13:30:05 | 000,000,000 | ---D | C] -- C:\Users\Chris\AppData\Roaming\Media Center Programs
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Recovery
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Programme
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Programme\Gemeinsame Dateien
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente
[2010.10.29 13:29:45 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten
[2010.10.29 13:29:44 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen
[2010.10.29 13:24:43 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2010.10.29 13:22:01 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch
[2010.10.29 13:21:45 | 000,000,000 | -HSD | C] -- C:\System Volume Information
 
========== Files - Modified Within 30 Days ==========
 
[2010.11.08 08:34:29 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2010.11.08 08:34:29 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2010.11.08 08:34:02 | 001,507,106 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2010.11.08 08:34:02 | 000,657,438 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2010.11.08 08:34:02 | 000,618,714 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2010.11.08 08:34:02 | 000,130,810 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2010.11.08 08:34:02 | 000,107,034 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2010.11.08 08:30:06 | 000,024,697 | -H-- | M] () -- C:\Users\Chris\AppData\Roaming\Chrislog.dat
[2010.11.08 08:27:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010.11.08 08:26:55 | 3169,255,424 | -HS- | M] () -- C:\hiberfil.sys
[2010.11.08 00:23:39 | 000,001,016 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.07 11:54:57 | 004,909,256 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2010.11.07 10:46:44 | 000,002,219 | ---- | M] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.11.07 10:42:51 | 000,063,141 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Chris3SQLite3.dll
[2010.11.07 10:42:15 | 000,000,000 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\chrtmp
[2010.11.07 10:41:40 | 000,000,034 | ---- | M] () -- C:\Windows\cdplayer.ini
[2010.11.06 07:57:13 | 000,010,225 | ---- | M] () -- C:\Users\Chris\Documents\Viel Schönes soll euch die Zukunft bringen.docx
[2010.11.05 16:15:40 | 000,000,639 | ---- | M] () -- C:\Users\Chris\Desktop\SamyGO.lnk
[2010.11.05 14:15:40 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\deployJava1.dll
[2010.11.05 14:15:40 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaws.exe
[2010.11.05 14:15:40 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\javaw.exe
[2010.11.05 14:15:40 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\SysWow64\java.exe
[2010.11.05 10:53:59 | 000,001,249 | ---- | M] () -- C:\Users\Public\Desktop\Bestellen von Druckerverbrauchsmaterial.lnk
[2010.11.01 21:01:55 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Audiograbber.lnk
[2010.10.31 09:07:18 | 000,000,965 | ---- | M] () -- C:\Users\Chris\Desktop\AM-DeadLink.lnk
[2010.10.30 12:19:44 | 000,001,040 | ---- | M] () -- C:\Users\Chris\Desktop\Total Commander.lnk
[2010.10.30 10:45:17 | 000,000,995 | ---- | M] () -- C:\Users\Chris\Desktop\phonostar-Player.lnk
[2010.10.30 10:33:40 | 000,001,987 | ---- | M] () -- C:\Users\Chris\Desktop\Photomatix Pro 3.lnk
[2010.10.30 09:46:58 | 000,001,040 | ---- | M] () -- C:\Users\Chris\Desktop\Hyper Snap.lnk
[2010.10.30 09:30:41 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.10.30 09:05:00 | 000,000,048 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.10.30 08:51:04 | 000,002,961 | ---- | M] () -- C:\Users\Chris\Desktop\Nero.lnk
[2010.10.29 23:04:31 | 000,003,072 | ---- | M] () -- C:\Windows\SysWow64\Viveza2FC32.dll
[2010.10.29 21:25:22 | 000,002,214 | ---- | M] () -- C:\Users\Public\Desktop\1-Klick.lnk
[2010.10.29 21:25:22 | 000,002,172 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010.10.29 15:56:01 | 001,499,556 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.10.29 15:42:59 | 000,001,027 | ---- | M] () -- C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk
[2010.10.29 15:41:36 | 000,001,722 | ---- | M] () -- C:\Windows\SysWow64\NULL
[2010.10.29 14:57:05 | 000,000,355 | ---- | M] () -- C:\Users\Chris\Desktop\Computer.lnk
[2010.10.29 14:56:02 | 000,556,120 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2010.10.29 14:49:47 | 000,149,773 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat
[2010.10.29 14:49:47 | 000,106,765 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat
[2010.10.29 14:02:41 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat
[2010.10.29 14:02:38 | 000,001,939 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010.10.29 13:26:00 | 000,057,050 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2010.10.29 13:26:00 | 000,057,050 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2010.10.29 13:24:42 | 000,000,000 | ---- | M] () -- C:\Windows\ativpsrm.bin
[2010.10.29 13:24:02 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010.10.18 19:00:00 | 000,136,704 | ---- | M] () -- C:\Windows\SysNative\ff_vfw.dll
[2010.10.13 16:16:02 | 000,004,096 | ---- | M] () -- C:\Windows\SysWow64\HDREfexProFC64.dll
[2010.10.13 16:16:02 | 000,004,096 | ---- | M] () -- C:\Windows\SysNative\HDREfexProFC64.dll
[2010.10.12 13:28:46 | 000,002,560 | ---- | M] () -- C:\Windows\SysWow64\HDREfexProFC32.dll
[2010.10.12 13:28:46 | 000,002,560 | ---- | M] () -- C:\Windows\SysNative\HDREfexProFC32.dll
 
========== Files Created - No Company Name ==========
 
[2010.11.08 00:23:39 | 000,001,016 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.11.07 21:27:46 | 000,191,488 | ---- | C] () -- C:\Windows\SysNative\unrar.dll
[2010.11.07 21:27:45 | 000,136,704 | ---- | C] () -- C:\Windows\SysNative\ff_vfw.dll
[2010.11.07 21:21:53 | 000,178,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2010.11.07 21:21:52 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2010.11.07 21:21:51 | 000,000,414 | ---- | C] () -- C:\Windows\SysWow64\lame_acm.xml
[2010.11.07 21:21:50 | 000,881,664 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2010.11.07 21:21:50 | 000,205,824 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2010.11.07 10:46:44 | 000,002,219 | ---- | C] () -- C:\Users\Public\Desktop\Google Earth.lnk
[2010.11.07 10:42:51 | 000,063,141 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\Chris3SQLite3.dll
[2010.11.07 10:42:15 | 000,000,000 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\chrtmp
[2010.11.06 07:57:12 | 000,010,225 | ---- | C] () -- C:\Users\Chris\Documents\Viel Schönes soll euch die Zukunft bringen.docx
[2010.11.05 16:15:40 | 000,000,639 | ---- | C] () -- C:\Users\Chris\Desktop\SamyGO.lnk
[2010.11.05 10:53:59 | 000,001,249 | ---- | C] () -- C:\Users\Public\Desktop\Bestellen von Druckerverbrauchsmaterial.lnk
[2010.11.03 12:35:34 | 000,004,096 | ---- | C] () -- C:\Windows\SysNative\HDREfexProFC64.dll
[2010.11.03 12:35:16 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\HDREfexProFC32.dll
[2010.11.03 12:18:33 | 000,002,560 | ---- | C] () -- C:\Windows\SysNative\HDREfexProFC32.dll
[2010.11.03 12:18:12 | 000,004,096 | ---- | C] () -- C:\Windows\SysWow64\HDREfexProFC64.dll
[2010.11.01 21:04:40 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.11.01 21:01:55 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Audiograbber.lnk
[2010.10.31 09:07:18 | 000,000,965 | ---- | C] () -- C:\Users\Chris\Desktop\AM-DeadLink.lnk
[2010.10.30 12:19:44 | 000,001,040 | ---- | C] () -- C:\Users\Chris\Desktop\Total Commander.lnk
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\UC.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\RAR.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\PKZIP.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\PKUNZIP.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\NOCLOSE.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\LHA.PIF
[2010.10.30 12:19:44 | 000,000,545 | ---- | C] () -- C:\Windows\ARJ.PIF
[2010.10.30 10:45:17 | 000,000,995 | ---- | C] () -- C:\Users\Chris\Desktop\phonostar-Player.lnk
[2010.10.30 10:33:40 | 000,001,987 | ---- | C] () -- C:\Users\Chris\Desktop\Photomatix Pro 3.lnk
[2010.10.30 09:46:58 | 000,001,040 | ---- | C] () -- C:\Users\Chris\Desktop\Hyper Snap.lnk
[2010.10.30 09:05:00 | 000,000,048 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.10.30 09:02:30 | 000,002,517 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2010.10.30 08:51:04 | 000,002,961 | ---- | C] () -- C:\Users\Chris\Desktop\Nero.lnk
[2010.10.29 21:25:22 | 000,002,214 | ---- | C] () -- C:\Users\Public\Desktop\1-Klick.lnk
[2010.10.29 21:25:22 | 000,002,172 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities.lnk
[2010.10.29 20:04:04 | 000,085,504 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll
[2010.10.29 18:01:44 | 000,000,003 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\text.txt
[2010.10.29 15:56:01 | 001,499,556 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.10.29 15:42:59 | 000,001,027 | ---- | C] () -- C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PopTray.lnk
[2010.10.29 15:41:36 | 000,001,722 | ---- | C] () -- C:\Windows\SysWow64\NULL
[2010.10.29 14:57:05 | 000,000,355 | ---- | C] () -- C:\Users\Chris\Desktop\Computer.lnk
[2010.10.29 14:49:47 | 000,149,773 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat
[2010.10.29 14:49:47 | 000,106,765 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat
[2010.10.29 14:37:55 | 000,166,400 | ---- | C] () -- C:\Program Files (x86)\RarExt.dll
[2010.10.29 14:02:41 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.10.29 14:02:38 | 000,001,939 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2010.10.29 13:24:42 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.10.29 13:24:02 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf
[2010.10.29 13:21:45 | 3169,255,424 | -HS- | C] () -- C:\hiberfil.sys
[2009.12.18 10:58:28 | 000,003,072 | ---- | C] () -- C:\Windows\SysWow64\Viveza2FC32.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2006.06.21 03:54:26 | 000,024,697 | -H-- | C] () -- C:\Users\Chris\AppData\Roaming\Chrislog.dat

< End of report >
--- --- ---


mfg chrismio

cosinus 08.11.2010 09:31
Zitat:
Art des Suchlaufs: Quick-Scan
Und dabei hab ich Vollscan extra fett geschrieben :lach:


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:58 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131