Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows startet nicht mehr! Nur schwarzer Bildschirm mit Cursor oben links! (https://www.trojaner-board.de/104065-windows-startet-mehr-nur-schwarzer-bildschirm-cursor-oben-links.html)

superchrisi 11.10.2011 20:39
Windows startet nicht mehr! Nur schwarzer Bildschirm mit Cursor oben links!
 
Hallo an alle,

mein Laptop mit Windows 7 startet nicht mehr! Beim Surfen im Internet ging kurz der Virenscanner auf und dann ging er sofort aus! Nun startet er nicht mehr und bleibt beim schwarzen Bildschirm mit dem blinkendem Cursor oben links in der Ecke stehen!

Das nächste Problem ist das ich die Recovery DVDs die ich erstellt habe wegen Umzug nicht finde!

Kann mir jemand helfen das Problem zu lösen??

Vielen Dank schonmal für eure Hilfe!

Mfg
superchrisi

cosinus 11.10.2011 20:56
Probier mal SREP von Larusso :)

Downloade dir bitte srep.exe und speichere diese auf einen USB Stick. Wichtig: Nicht in einen Ordner speichern.
  • Starte den infizierten Rechner neu auf.
  • Während dem Hochfahren drücke mehrmals die F8 Taste. Danach solltest Du einige Optionen zur Auswahl haben. Navigiere mit den Pfeiltasten zu Abgesicherter Modus mit Eingabeaufforderung und drücke Enter ** Hinweis: Es kann sein, dass eine andere F Taste gedrückt werden muss, um in die Startoptionen zu kommen.
  • Logge dich nun in das infizierte Benutzerkonto ein.
  • Schließe den USB Stick an den infizierten Rechner an.
  • Nun ist etwas Handarbeit gefragt.
    • Du musst zuerst heraus finden, welchen Laufwerksbuchstaben der USB Stick hat.
    • Dazu gib bitte einfach E: ein und drücke Enter. Sollte folgende Meldung kommen.
      Zitat:
      Das System kann das angegeben Laufwerk nicht finden
      versuche einen anderen Laufwerksbuchstaben. ( zB F: )
  • Sobald Du den richtigen Laufwerksbuchstaben gefunden hast, gib folgendes ein und drücke Enter.
    start srep.exe
  • Bestätige den Disclaimer mit OK.
  • Lass das Tool in Ruhe laufen. Der Rechner wird automatisch neu starten.
Nun solltest Du wieder auf dein System zugreifen können. Auf deinen USB Stick befindet sich eine shell.txt. Bitte poste diese in deiner nächsten Antwort.

superchrisi 11.10.2011 21:07
Hallo Cosinus,
danke für die schnelle Antwort!

Ich habe jede F Taste ausprobiert leider ohne Erfolg! Es blinkt immer der Cursor auf dem schwarzen Bildschirm! :-(

cosinus 12.10.2011 16:14
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt.

superchrisi 14.10.2011 10:22
Hallo,
ich habe den scan gerade gemacht! Es wurde aber nur die Datei otl.txt erstellt!

Hier das Ergebnis!OTL Logfile:
Code:
OTL logfile created on: 10/14/2011 3:13:58 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.86 Mb Free Space | 75.87% Space Free | Partition Type: NTFS
Drive D: | 285.99 Gb Total Space | 191.29 Gb Free Space | 66.89% Space Free | Partition Type: NTFS
Drive E: | 3.77 Gb Total Space | 1.59 Gb Free Space | 42.24% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/09/30 17:44:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2011/06/28 15:10:24 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/01 17:17:08 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/11/21 05:49:24 | 000,247,608 | ---- | M] () [Auto] -- D:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010/10/19 08:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) [Auto] -- D:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/08/28 05:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/07/10 05:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 22:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/01/16 03:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2007/07/24 14:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- D:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/01/04 22:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto] -- D:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/06/28 15:10:24 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- D:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/06/28 15:10:24 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- D:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/05/10 02:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2011/05/10 02:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/10/04 21:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/09/15 00:40:00 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009/08/11 00:59:50 | 000,686,080 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/07/27 03:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/06/23 23:00:18 | 000,216,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/03/28 11:25:30 | 000,017,952 | ---- | M] (Acer, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\OEM\factory\int15.sys -- (int15.sys)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,First Home Page = Internet Explorer 9 - Das Internet neu erleben
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.iminent.com/?appId=4e3cced1-2636-45d0-aafc-5015230946b7&lcid=1031&ref=homepage
IE - HKU\Kathrin_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes]
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FD 14 E6 97 15 A1 CB 01  [binary data]
IE - HKU\lanze090860_ON_D\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {90b49673-5506-483e-b92b-ca0265bd9ca8} - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\lanze090860_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
IE - HKU\NetworkService_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://search.iminent.com/?appId=4e3cced1-2636-45d0-aafc-5015230946b7&lcid=1031&ref=homepage"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7
FF - prefs.js..extensions.enabledItems: webbooster@iminent.com:4.22.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q="
 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: D:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@ngm.nexoneu.com/NxGame: D:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: D:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.22\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/10 20:17:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.22\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/09/10 20:17:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/08/04 10:47:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011/08/04 10:47:39 | 000,000,000 | ---D | M]
 
[2011/02/06 11:55:34 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions
[2010/01/18 05:26:47 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/02/06 11:55:34 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2011/10/03 02:55:27 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions
[2011/02/13 14:52:58 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011/10/01 18:24:57 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-1.xml
[2011/04/16 05:54:49 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-2.xml
[2011/05/21 06:12:01 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-3.xml
[2011/06/24 06:55:59 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-4.xml
[2011/09/02 02:07:15 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-5.xml
[2011/09/15 04:22:38 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-6.xml
[2011/02/13 14:52:58 | 000,000,168 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.gif
[2011/02/13 14:52:58 | 000,000,618 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.src
[2011/03/02 01:32:19 | 000,001,056 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.xml
[2011/09/15 04:21:51 | 000,002,270 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\SearchTheWeb.xml
[2011/09/11 05:32:47 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files (x86)\Mozilla Firefox\extensions
[2011/02/27 17:28:46 | 000,000,000 | ---D | M] (Skype extension) -- D:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/09/11 05:32:47 | 000,000,000 | ---D | M] (Iminent WebBooster) -- D:\Program Files (x86)\Mozilla Firefox\extensions\webbooster@iminent.com
[2011/08/30 02:51:57 | 000,001,392 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/08/30 02:51:57 | 000,002,344 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/30 02:51:57 | 000,006,805 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/08/21 18:09:52 | 000,002,157 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\SearchTheWeb.xml
[2011/08/30 02:51:57 | 000,001,178 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/08/30 02:51:57 | 000,001,105 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (IMVU Inc Toolbar) - {90b49673-5506-483e-b92b-ca0265bd9ca8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - D:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (IMVU Inc Toolbar) - {90b49673-5506-483e-b92b-ca0265bd9ca8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (IMVU Inc Toolbar) - {90B49673-5506-483E-B92B-CA0265BD9CA8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3:64bit: - HKU\lanze090860_ON_D\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - D:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKU\lanze090860_ON_D\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\lanze090860_ON_D\..\Toolbar\WebBrowser: (IMVU Inc Toolbar) - {90B49673-5506-483E-B92B-CA0265BD9CA8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [Acer ePower Management] D:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] D:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [IAAnotif] D:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] D:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [avgnt] D:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] D:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IMBooster] D:\Program Files (x86)\Iminent\IMBooster\imbooster.exe (Iminent)
O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] D:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKU\Kathrin_ON_D..\Run: [ICQ] D:\Users\Kathrin\AppData\Roaming\ICQ\Application\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKU\lanze090860_ON_D..\Run: [ICQ] D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\lanze090860_ON_D..\Run: [Microsoft® Windows Update] D:\Users\lanze090860\M-1-52-5782-8752-5245\winsvc.exe ()
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - Startup: D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk ()
O4 - Startup: D:\Users\lanze090860\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\Kathrin_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Kathrin_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\Kathrin_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\lanze090860_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\lanze090860_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\lanze090860_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Google Sidewiki... - D:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - D:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - D:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - D:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/09/25 06:16:43 | 000,000,000 | ---D | C] -- D:\de08992e7f4f4473c06f6fc2052d35
[2009/10/19 19:31:46 | 000,036,136 | ---- | C] (Oberon Media) -- D:\ProgramData\FullRemove.exe
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
[1 D:\Users\lanze090860\AppData\Local\*.tmp files -> D:\Users\lanze090860\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/10/05 04:31:39 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2011/10/05 04:30:15 | 000,001,426 | ---- | M] () -- D:\Users\lanze090860\Desktop\Registry kostenlos entrümpeln!.lnk
[2011/10/05 04:29:42 | 000,001,106 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/05 04:29:35 | 000,000,304 | -H-- | M] () -- D:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2011/10/05 04:28:49 | 3143,299,072 | -HS- | M] () -- D:\hiberfil.sys
[2011/10/05 04:23:59 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/10/05 04:23:59 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/10/04 17:24:54 | 000,001,110 | ---- | M] () -- D:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/04 09:02:11 | 000,000,288 | ---- | M] () -- D:\Windows\tasks\RegClean Pro_DEFAULT.job
[2011/10/03 15:27:55 | 000,001,350 | ---- | M] () -- D:\Users\Kathrin\Desktop\Clean Registry for Free!.lnk
[2011/10/03 15:26:39 | 000,000,929 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
[2011/10/03 10:52:31 | 000,000,594 | -H-- | M] () -- D:\Windows\tasks\Norton Security Scan for lanze090860.job
[2011/10/03 06:49:32 | 000,711,370 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2011/10/03 06:49:32 | 000,662,950 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2011/10/03 06:49:32 | 000,153,766 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2011/10/03 06:49:32 | 000,124,144 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2011/09/28 14:30:40 | 000,000,184 | ---- | M] () -- D:\Windows\WININIT.INI
[2011/09/24 04:01:17 | 000,011,226 | ---- | M] () -- D:\Users\lanze090860\Documents\TVG Nettelstedt-Hüttenberg.ods
[2011/09/21 11:34:40 | 000,000,296 | ---- | M] () -- D:\Windows\tasks\RegClean Pro_UPDATES.job
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
[1 D:\Users\lanze090860\AppData\Local\*.tmp files -> D:\Users\lanze090860\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/09/28 14:30:36 | 000,000,184 | ---- | C] () -- D:\Windows\WININIT.INI
[2011/07/23 13:43:44 | 000,000,000 | ---- | C] () -- D:\Users\lanze090860\AppData\Local\{F104F643-437F-4F02-A501-9E5F813823DA}
[2011/06/16 11:28:44 | 000,000,193 | ---- | C] () -- D:\Windows\WORDPAD.INI
[2010/08/25 14:34:30 | 000,982,240 | ---- | C] () -- D:\Windows\SysWow64\igkrng500.bin
[2010/08/25 14:34:30 | 000,439,308 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng500.bin
[2010/08/25 14:34:30 | 000,092,356 | ---- | C] () -- D:\Windows\SysWow64\igfcg500m.bin
[2010/08/25 13:52:00 | 000,208,896 | ---- | C] () -- D:\Windows\SysWow64\iglhsip32.dll
[2010/08/25 13:52:00 | 000,143,360 | ---- | C] () -- D:\Windows\SysWow64\iglhcp32.dll
[2010/03/12 09:49:19 | 000,000,056 | -H-- | C] () -- D:\ProgramData\ezsidmv.dat
[2010/01/18 04:27:02 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat
[2009/10/19 20:01:07 | 000,134,592 | ---- | C] () -- D:\Windows\SysWow64\igfcg500.bin
[2009/08/02 18:21:54 | 000,197,912 | ---- | C] () -- D:\Windows\SysWow64\physxcudart_20.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelSwedish.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelSpanish.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelPortugese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelKorean.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelJapanese.dll
[2009/08/02 18:21:52 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelGerman.dll
[2009/08/02 18:21:52 | 000,058,648 | ---- | C] () -- D:\Windows\SysWow64\AgCPanelFrench.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/07/06 09:50:51 | 001,526,948 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2009/07/06 09:42:37 | 000,626,688 | ---- | C] () -- D:\Windows\Image.dll
[2009/07/06 09:42:37 | 000,200,704 | ---- | C] () -- D:\Windows\PLFSetI.exe
[2009/07/06 09:42:37 | 000,020,480 | ---- | C] () -- D:\Windows\USB_VIDEO_REG.exe
[2009/07/06 09:42:37 | 000,000,323 | ---- | C] () -- D:\Windows\PidList.ini
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/10/19 19:48:07 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2010/03/02 04:50:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Arcade Lab
[2010/01/28 13:33:44 | 000,000,000 | -H-D | M] -- D:\ProgramData\CanonBJ
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/07/04 17:13:54 | 000,000,000 | ---D | M] -- D:\ProgramData\Easybits GO
[2009/10/19 20:03:03 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2010/01/20 13:20:45 | 000,000,000 | ---D | M] -- D:\ProgramData\Friends Games
[2011/05/21 07:21:09 | 000,000,000 | ---D | M] -- D:\ProgramData\ICQ
[2011/09/11 05:33:03 | 000,000,000 | ---D | M] -- D:\ProgramData\IMinent
[2010/01/18 04:19:48 | 000,000,000 | ---D | M] -- D:\ProgramData\McQcModifier-5c47-a7b0
[2010/05/09 12:30:10 | 000,000,000 | ---D | M] -- D:\ProgramData\NexonEU
[2010/01/18 05:38:39 | 000,000,000 | ---D | M] -- D:\ProgramData\Oberon Media
[2010/01/17 14:07:32 | 000,000,000 | ---D | M] -- D:\ProgramData\OEM
[2010/02/16 12:33:36 | 000,000,000 | ---D | M] -- D:\ProgramData\Partner
[2010/04/09 07:18:31 | 000,000,000 | ---D | M] -- D:\ProgramData\PlayFirst
[2010/06/09 08:37:53 | 000,000,000 | ---D | M] -- D:\ProgramData\PMB Files
[2010/07/19 16:25:28 | 000,000,000 | ---D | M] -- D:\ProgramData\Sandlot Games
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2011/08/28 04:59:57 | 000,000,000 | ---D | M] -- D:\ProgramData\TEMP
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2011/04/16 04:51:59 | 000,000,000 | ---D | M] -- D:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2011/10/04 09:02:11 | 000,000,288 | ---- | M] () -- D:\Windows\Tasks\RegClean Pro_DEFAULT.job
[2011/09/21 11:34:40 | 000,000,296 | ---- | M] () -- D:\Windows\Tasks\RegClean Pro_UPDATES.job
[2011/10/05 04:29:19 | 000,032,632 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
[2010/06/02 07:37:36 | 000,000,258 | -H-- | M] () -- D:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011/10/05 04:29:35 | 000,000,304 | -H-- | M] () -- D:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:C46995DA
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:ABE89FFE
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:4CF61E54
< End of report >
--- --- ---

cosinus 16.10.2011 12:27
Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = iGoogle Redirect
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,First Home Page = Internet Explorer 9 - Das Internet neu erleben
IE - HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.iminent.com/?appId=4e3cced1-2636-45d0-aafc-5015230946b7&lcid=1031&ref=homepage
IE - HKU\Kathrin_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle Redirect
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = [String data over 1000 bytes]
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN, Messenger und Hotmail sowie Nachrichten, Unterhaltung, Video, Sport, Lifestyle, Finanzen, Auto uvm. bei MSN
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = FD 14 E6 97 15 A1 CB 01  [binary data]
IE - HKU\lanze090860_ON_D\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKU\lanze090860_ON_D\..\URLSearchHook: {90b49673-5506-483e-b92b-ca0265bd9ca8} - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "http://search.iminent.com/?appId=4e3cced1-2636-45d0-aafc-5015230946b7&lcid=1031&ref=homepage"
FF - prefs.js..extensions.enabledItems: webbooster@iminent.com:4.22.0
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q="
[2011/02/06 11:55:34 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com
[2011/10/03 02:55:27 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions
[2011/02/13 14:52:58 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011/10/01 18:24:57 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-1.xml
[2011/04/16 05:54:49 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-2.xml
[2011/05/21 06:12:01 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-3.xml
[2011/06/24 06:55:59 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-4.xml
[2011/09/02 02:07:15 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-5.xml
[2011/09/15 04:22:38 | 000,000,950 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-6.xml
[2011/02/13 14:52:58 | 000,000,168 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.gif
[2011/02/13 14:52:58 | 000,000,618 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.src
[2011/03/02 01:32:19 | 000,001,056 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.xml
[2011/09/15 04:21:51 | 000,002,270 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\SearchTheWeb.xml
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (no name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No CLSID value found.
O2 - BHO: (IMVU Inc Toolbar) - {90b49673-5506-483e-b92b-ca0265bd9ca8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O2 - BHO: (IMinent WebBooster (BHO)) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - D:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - D:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (IMVU Inc Toolbar) - {90b49673-5506-483e-b92b-ca0265bd9ca8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (IMVU Inc Toolbar) - {90B49673-5506-483E-B92B-CA0265BD9CA8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O3 - HKU\Kathrin_ON_D\..\Toolbar\WebBrowser: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKU\lanze090860_ON_D\..\Toolbar\WebBrowser: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKU\lanze090860_ON_D\..\Toolbar\WebBrowser: (IMVU Inc Toolbar) - {90B49673-5506-483E-B92B-CA0265BD9CA8} - D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll (Conduit Ltd.)
O4 - HKU\lanze090860_ON_D..\Run: [Microsoft® Windows Update] D:\Users\lanze090860\M-1-52-5782-8752-5245\winsvc.exe ()
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - Startup: D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk ()
O32 - HKLM CDRom: AutoRun - 1
[2011/09/25 06:16:43 | 000,000,000 | ---D | C] -- D:\de08992e7f4f4473c06f6fc2052d35
[2009/10/19 19:31:46 | 000,036,136 | ---- | C] (Oberon Media) -- D:\ProgramData\FullRemove.exe
[2011/10/03 15:27:55 | 000,001,350 | ---- | M] () -- D:\Users\Kathrin\Desktop\Clean Registry for Free!.lnk
[2011/10/03 15:26:39 | 000,000,929 | ---- | M] () -- D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk
[2011/07/23 13:43:44 | 000,000,000 | ---- | C] () -- D:\Users\lanze090860\AppData\Local\{F104F643-437F-4F02-A501-9E5F813823DA}
@Alternate Data Stream - 147 bytes -> D:\ProgramData\TEMP:4D066AD2
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:C46995DA
@Alternate Data Stream - 146 bytes -> D:\ProgramData\TEMP:AB689DEA
@Alternate Data Stream - 133 bytes -> D:\ProgramData\TEMP:93DE1838
@Alternate Data Stream - 127 bytes -> D:\ProgramData\TEMP:0B9176C0
@Alternate Data Stream - 122 bytes -> D:\ProgramData\TEMP:ABE89FFE
@Alternate Data Stream - 118 bytes -> D:\ProgramData\TEMP:4CF61E54
:Files
D:\Users\lanze090860\M-1-52-5782-8752-5245
D:\Windows\tasks\*.job
:Commands
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

superchrisi 16.10.2011 21:41
Hallo,
bin nach der Anleitung vorgegangen.

Hier der Logfile:

========== OTL ==========
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main\\First Home Page| /E : value set successfully!
HKU\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\Kathrin_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!
HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\URLSearchHooks\\{84FF7BD6-B47F-46F8-9130-01B2696B36CB} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\URLSearchHooks\\{90b49673-5506-483e-b92b-ca0265bd9ca8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90b49673-5506-483e-b92b-ca0265bd9ca8}\ deleted successfully.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "ICQ Search" removed from browser.search.selectedEngine
Prefs.js: "hxxp://search.iminent.com/?appId=4e3cced1-2636-45d0-aafc-5015230946b7&lcid=1031&ref=homepage" removed from browser.startup.homepage
Prefs.js: webbooster@iminent.com:4.22.0 removed from extensions.enabledItems
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=" removed from keyword.URL
D:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions\IMVUClientXUL@imvu.com folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\skin folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\tr folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\sk folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\ru folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\it folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\he folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\fr folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\es folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\en-US folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\de folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\cs folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale\bg folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\locale folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content\img folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome\content folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions folder moved successfully.
Folder D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\ not found.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-1.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-2.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-3.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-4.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-5.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin-6.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.gif moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.src moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\icqplugin.xml moved successfully.
D:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\tb7qefe7.default\searchplugins\SearchTheWeb.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{58124A0B-DC32-4180-9BFF-E0E21AE34026}\ deleted successfully.
D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{90b49673-5506-483e-b92b-ca0265bd9ca8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90b49673-5506-483e-b92b-ca0265bd9ca8}\ not found.
D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}\ deleted successfully.
D:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll moved successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
D:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{90b49673-5506-483e-b92b-ca0265bd9ca8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90b49673-5506-483e-b92b-ca0265bd9ca8}\ not found.
File D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ deleted successfully.
File D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_USERS\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{90B49673-5506-483E-B92B-CA0265BD9CA8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90B49673-5506-483E-B92B-CA0265BD9CA8}\ not found.
File D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll not found.
Registry value HKEY_USERS\Kathrin_ON_D\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5}\ not found.
File D:\Program Files (x86)\IMinent Toolbar\tbcore3.dll not found.
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File D:\Program Files (x86)\ConduitEngine\ConduitEngine.dll not found.
Registry value HKEY_USERS\lanze090860_ON_D\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{90B49673-5506-483E-B92B-CA0265BD9CA8} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90B49673-5506-483E-B92B-CA0265BD9CA8}\ not found.
File D:\Program Files (x86)\IMVU_Inc\prxtbIMV0.dll not found.
Registry key HKEY_USERS\lanze090860_ON_D\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run not found.
D:\Users\lanze090860\M-1-52-5782-8752-5245\winsvc.exe moved successfully.
Registry key HKEY_USERS\LocalService_ON_D\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
Registry key HKEY_USERS\NetworkService_ON_D\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce not found.
D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
D:\de08992e7f4f4473c06f6fc2052d35\Graphics folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\3082 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\3076 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\2070 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\2052 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1055 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1053 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1049 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1046 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1045 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1044 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1043 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1042 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1041 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1040 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1038 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1037 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1036 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1035 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1033 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1032 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1031 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1030 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1029 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1028 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35\1025 folder moved successfully.
D:\de08992e7f4f4473c06f6fc2052d35 folder moved successfully.
D:\ProgramData\FullRemove.exe moved successfully.
D:\Users\Kathrin\Desktop\Clean Registry for Free!.lnk moved successfully.
File D:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk not found.
D:\Users\lanze090860\AppData\Local\{F104F643-437F-4F02-A501-9E5F813823DA} moved successfully.
ADS D:\ProgramData\TEMP:4D066AD2 deleted successfully.
ADS D:\ProgramData\TEMP:C46995DA deleted successfully.
ADS D:\ProgramData\TEMP:AB689DEA deleted successfully.
ADS D:\ProgramData\TEMP:93DE1838 deleted successfully.
ADS D:\ProgramData\TEMP:0B9176C0 deleted successfully.
ADS D:\ProgramData\TEMP:ABE89FFE deleted successfully.
ADS D:\ProgramData\TEMP:4CF61E54 deleted successfully.
========== FILES ==========
D:\Users\lanze090860\M-1-52-5782-8752-5245 folder moved successfully.
D:\Windows\tasks\GoogleUpdateTaskMachineCore.job moved successfully.
D:\Windows\tasks\GoogleUpdateTaskMachineUA.job moved successfully.
D:\Windows\tasks\Norton Security Scan for lanze090860.job moved successfully.
D:\Windows\tasks\RegClean Pro_DEFAULT.job moved successfully.
D:\Windows\tasks\RegClean Pro_UPDATES.job moved successfully.
D:\Windows\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully.
D:\Windows\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job moved successfully.
========== COMMANDS ==========
D:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTLPE by OldTimer - Version 3.1.48.0 log created on 10172011_053418


Leider wieder ohne Erfolg! Windows startet immer noch nicht. Immer noch das gleiche Problem. :-(

cosinus 17.10.2011 16:42
Dann bereite dich schon mal auf eine Neuinstallation von Windows vor. Jedes System kann man nämlich nicht retten.

Mach bitte ein neues Log mit OTLPE und poste es.

superchrisi 17.10.2011 21:19
Hi,
hier der neue Logfile:OTL Logfile:
Code:
OTL logfile created on: 10/18/2011 7:12:43 AM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.86 Mb Free Space | 75.87% Space Free | Partition Type: NTFS
Drive D: | 3.77 Gb Total Space | 1.59 Gb Free Space | 42.23% Space Free | Partition Type: FAT
Drive E: | 285.99 Gb Total Space | 191.29 Gb Free Space | 66.89% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009/09/30 17:44:58 | 000,844,320 | ---- | M] (Acer Incorporated) [Auto] -- E:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2009/07/03 21:47:12 | 000,240,160 | ---- | M] (Acer) [Auto] -- E:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV - [2011/06/28 15:10:24 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/01 17:17:08 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/11/21 05:49:24 | 000,247,608 | ---- | M] () [Auto] -- E:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010/10/19 08:29:03 | 002,011,944 | ---- | M] (TeamViewer GmbH) [Auto] -- E:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/08/28 05:38:58 | 001,150,496 | ---- | M] (Acer Incorporated) [Auto] -- E:\Program Files (x86)\Acer\Registration\GregHSRW.exe -- (Greg_Service)
SRV - [2009/07/10 05:54:44 | 000,253,952 | ---- | M] (Acer Incorporated) [Auto] -- E:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009/06/04 22:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2008/01/16 03:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2007/07/24 14:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- E:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/01/04 22:48:50 | 000,112,152 | ---- | M] (InterVideo) [Auto] -- E:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/06/28 15:10:24 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/06/28 15:10:24 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2011/05/10 02:06:14 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2011/05/10 02:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009/10/04 21:34:00 | 001,542,656 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2009/09/15 00:40:00 | 006,952,960 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2009/08/11 00:59:50 | 000,686,080 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009/07/27 03:04:36 | 000,058,880 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\L1C62x64.sys -- (L1C) NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20)
DRV:64bit: - [2009/06/23 23:00:18 | 000,216,576 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\netw5v64.sys -- (netw5v64) Intel(R)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2008/03/28 11:25:30 | 000,017,952 | ---- | M] (Acer, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\OEM\factory\int15.sys -- (int15.sys)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Kathrin_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKU\Kathrin_ON_E\Software\Microsoft\Internet Explorer\Main,First Home Page =
IE - HKU\Kathrin_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\Kathrin_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\lanze090860_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
IE - HKU\lanze090860_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\lanze090860_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKU\lanze090860_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs =
IE - HKU\lanze090860_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP =
IE - HKU\lanze090860_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\lanze090860_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
IE - HKU\NetworkService_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.7
FF - prefs.js..extensions.enabledItems: ""
 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: E:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: E:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: E:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: E:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@ngm.nexoneu.com/NxGame: E:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: E:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.22\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011/09/10 20:17:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 3.6.22\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011/09/10 20:17:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011/08/04 10:47:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Thunderbird 3.0.3\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2011/08/04 10:47:39 | 000,000,000 | ---D | M]
 
[2011/02/06 11:55:34 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions
[2010/01/18 05:26:47 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Kathrin\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/09/11 05:32:47 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
[2011/02/27 17:28:46 | 000,000,000 | ---D | M] (Skype extension) -- E:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011/09/11 05:32:47 | 000,000,000 | ---D | M] (Iminent WebBooster) -- E:\Program Files (x86)\Mozilla Firefox\extensions\webbooster@iminent.com
File not found (No name found) -- E:\USERS\KATHRIN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TB7QEFE7.DEFAULT\EXTENSIONS\{800B5000-A755-47E1-992B-48A1C1357F07}
[2011/08/30 02:51:57 | 000,001,392 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/08/30 02:51:57 | 000,002,344 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/30 02:51:57 | 000,006,805 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/08/21 18:09:52 | 000,002,157 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\SearchTheWeb.xml
[2011/08/30 02:51:57 | 000,001,178 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/08/30 02:51:57 | 000,001,105 | ---- | M] () -- E:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011/10/17 05:34:31 | 000,000,098 | ---- | M]) - E:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1      localhost
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg64.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\Kathrin_ON_E\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\lanze090860_ON_E\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - E:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O4:64bit: - HKLM..\Run: [Acer ePower Management] E:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] E:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [IAAnotif] E:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [PLFSetI] E:\Windows\PLFSetI.exe ()
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] E:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [IMBooster] E:\Program Files (x86)\Iminent\IMBooster\imbooster.exe (Iminent)
O4 - HKLM..\Run: [LManager] E:\Program Files (x86)\Launch Manager\LManager.EXE (Dritek System Inc.)
O4 - HKLM..\Run: [NortonOnlineBackupReminder] E:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe (Symantec Corporation)
O4 - HKU\Kathrin_ON_E..\Run: [ICQ] E:\Users\Kathrin\AppData\Roaming\ICQ\Application\ICQ7.4\ICQ.exe (ICQ, LLC.)
O4 - HKU\lanze090860_ON_E..\Run: [ICQ] E:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\lanze090860_ON_E..\Run: [Microsoft® Windows Update]  File not found
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - Startup: E:\Users\lanze090860\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\Kathrin_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Kathrin_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\Kathrin_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\lanze090860_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\lanze090860_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\lanze090860_ON_E\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8:64bit: - Extra context menu item: Google Sidewiki... - E:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - E:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll (Google Inc.)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - E:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - E:\Program Files (x86)\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - E:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/10/17 05:34:18 | 000,000,000 | ---D | C] -- E:\_OTL
[2011/10/14 15:24:22 | 000,000,000 | -HSD | C] -- E:\RECYCLER
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
[1 E:\Users\lanze090860\AppData\Local\*.tmp files -> E:\Users\lanze090860\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/10/05 04:31:39 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2011/10/05 04:30:15 | 000,001,426 | ---- | M] () -- E:\Users\lanze090860\Desktop\Registry kostenlos entrümpeln!.lnk
[2011/10/05 04:28:49 | 3143,299,072 | -HS- | M] () -- E:\hiberfil.sys
[2011/10/05 04:23:59 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/10/05 04:23:59 | 000,009,696 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/10/03 06:49:32 | 000,711,370 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2011/10/03 06:49:32 | 000,662,950 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2011/10/03 06:49:32 | 000,153,766 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2011/10/03 06:49:32 | 000,124,144 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2011/09/28 14:30:40 | 000,000,184 | ---- | M] () -- E:\Windows\WININIT.INI
[2011/09/24 04:01:17 | 000,011,226 | ---- | M] () -- E:\Users\lanze090860\Documents\TVG Nettelstedt-Hüttenberg.ods
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
[1 E:\Users\lanze090860\AppData\Local\*.tmp files -> E:\Users\lanze090860\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/09/28 14:30:36 | 000,000,184 | ---- | C] () -- E:\Windows\WININIT.INI
[2011/06/16 11:28:44 | 000,000,193 | ---- | C] () -- E:\Windows\WORDPAD.INI
[2010/08/25 14:34:30 | 000,982,240 | ---- | C] () -- E:\Windows\SysWow64\igkrng500.bin
[2010/08/25 14:34:30 | 000,439,308 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng500.bin
[2010/08/25 14:34:30 | 000,092,356 | ---- | C] () -- E:\Windows\SysWow64\igfcg500m.bin
[2010/08/25 13:52:00 | 000,208,896 | ---- | C] () -- E:\Windows\SysWow64\iglhsip32.dll
[2010/08/25 13:52:00 | 000,143,360 | ---- | C] () -- E:\Windows\SysWow64\iglhcp32.dll
[2010/03/12 09:49:19 | 000,000,056 | -H-- | C] () -- E:\ProgramData\ezsidmv.dat
[2010/01/18 04:27:02 | 000,000,000 | ---- | C] () -- E:\Windows\nsreg.dat
[2009/10/19 20:01:07 | 000,134,592 | ---- | C] () -- E:\Windows\SysWow64\igfcg500.bin
[2009/08/02 18:21:54 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2009/08/02 18:21:54 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2009/08/02 18:21:52 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2009/08/02 18:21:52 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/07/06 09:50:51 | 001,526,948 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2009/07/06 09:42:37 | 000,626,688 | ---- | C] () -- E:\Windows\Image.dll
[2009/07/06 09:42:37 | 000,200,704 | ---- | C] () -- E:\Windows\PLFSetI.exe
[2009/07/06 09:42:37 | 000,020,480 | ---- | C] () -- E:\Windows\USB_VIDEO_REG.exe
[2009/07/06 09:42:37 | 000,000,323 | ---- | C] () -- E:\Windows\PidList.ini
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2009/10/19 19:48:07 | 000,000,000 | ---D | M] -- E:\ProgramData\Acer
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- E:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2010/03/02 04:50:36 | 000,000,000 | ---D | M] -- E:\ProgramData\Arcade Lab
[2010/01/28 13:33:44 | 000,000,000 | -H-D | M] -- E:\ProgramData\CanonBJ
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- E:\ProgramData\Dokumente
[2011/07/04 17:13:54 | 000,000,000 | ---D | M] -- E:\ProgramData\Easybits GO
[2009/10/19 20:03:03 | 000,000,000 | ---D | M] -- E:\ProgramData\eSobi
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2010/01/20 13:20:45 | 000,000,000 | ---D | M] -- E:\ProgramData\Friends Games
[2011/05/21 07:21:09 | 000,000,000 | ---D | M] -- E:\ProgramData\ICQ
[2011/09/11 05:33:03 | 000,000,000 | ---D | M] -- E:\ProgramData\IMinent
[2010/01/18 04:19:48 | 000,000,000 | ---D | M] -- E:\ProgramData\McQcModifier-5c47-a7b0
[2010/05/09 12:30:10 | 000,000,000 | ---D | M] -- E:\ProgramData\NexonEU
[2010/01/18 05:38:39 | 000,000,000 | ---D | M] -- E:\ProgramData\Oberon Media
[2010/01/17 14:07:32 | 000,000,000 | ---D | M] -- E:\ProgramData\OEM
[2010/02/16 12:33:36 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2010/04/09 07:18:31 | 000,000,000 | ---D | M] -- E:\ProgramData\PlayFirst
[2010/06/09 08:37:53 | 000,000,000 | ---D | M] -- E:\ProgramData\PMB Files
[2010/07/19 16:25:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Sandlot Games
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- E:\ProgramData\Startmenü
[2011/08/28 04:59:57 | 000,000,000 | ---D | M] -- E:\ProgramData\TEMP
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2010/01/17 14:07:18 | 000,000,000 | -HSD | M] -- E:\ProgramData\Vorlagen
[2011/04/16 04:51:59 | 000,000,000 | ---D | M] -- E:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
[2011/10/05 04:29:19 | 000,032,632 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

cosinus 18.10.2011 19:27
Ich fürchte das System lässt sich so nicht mehr retten. Evtl noch wenn du in den abgesicherten Modus kommst. Oder geht das immer noch nicht?

superchrisi 18.10.2011 20:44
Hi Arne,
ja das glaube ich langsam auch! Nein der abgesicherte Modus geht immer noch net!

Habe noch eine frage ich weis aber net ob du mir die beantworten kannst!

Bekomme ich z.b. bei Microsoft oder bei Acer (Laptop Hersteller) Windows 7 Dvds wenn ich die Recovery DVDs net mehr finde?

Gruß

Christian

cosinus 19.10.2011 16:12
Soweit ich weiß nur gegen Aufpreis. Acer will AFAIK 50 EUR dafür :mad:
Du kannst aber Windows7 runterladen und auf DVD brennen => Windows 7 – Home Premium und Professional Direkt Download Links


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:27 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19