| Tischsalat | 28.12.2011 23:33 |
95p/Mediashifting.com Virus
Hallo Trojaner-Board!
Seit heute morgen plagt mich ein nerviger Virus. Ich habe das selbe Problem, wie in diesem Thread: Wenn ich googlen möchte, werde ich automatisch zu einer 95p.com oder Mediashifting.com Seite weitergeleitet. Beispiel: Ich klicke von Google aus auf de.wikipedia.org/wiki/Salat und gerate hierhin: hxxp://95p.com/?search=salat&subid=193&key=9e1874360d27e99eb749
Außerdem geht mein Sound seit heut morgen nicht mehr (Keine Ahnung ob das etwas damit zu tun hat) und meine Windows Firewall fragt mich bei jedem Programm ob es zugelassen werden soll. Dabei waren auch "isomob.exe" und "kbsetup.exe" welche sich im Autostart befanden und sich in jeweiligen Verzeichnis name/anwendungsdaten/isomob.exe
ALL users/kbsetup.exe
befanden. Hab die dann direkt aus dem Autostart entfernt und die beiden gelöscht, ich weiß aber nicht ob das überhaupt irgendwas gebracht hat.
Danke schonmal im vorraus :)
Hier meine OTL Logfiles:
OTL.txt Code:
OTL logfile created on: 28.12.2011 20:39:30 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\BAKU\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,28 Gb Available Physical Memory | 63,90% Memory free
2,85 Gb Paging File | 2,27 Gb Available in Paging File | 79,53% Paging File free
Paging file location(s): C:\pagefile.sys 1024 3070 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 36,77 Gb Total Space | 16,17 Gb Free Space | 43,99% Space Free | Partition Type: NTFS
Drive D: | 29,29 Gb Total Space | 13,65 Gb Free Space | 46,61% Space Free | Partition Type: NTFS
Drive E: | 45,72 Gb Total Space | 12,97 Gb Free Space | 28,36% Space Free | Partition Type: NTFS
Drive J: | 492,06 Gb Total Space | 1,18 Gb Free Space | 0,24% Space Free | Partition Type: NTFS
Drive M: | 439,45 Gb Total Space | 282,57 Gb Free Space | 64,30% Space Free | Partition Type: NTFS
Computer Name: KI-1 | User Name: BAKU | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Dokumente und Einstellungen\BAKU\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - J:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
========== Modules (No Company Name) ==========
MOD - c:\Programme\Gemeinsame Dateien\Akamai\netsession_win_b427739.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\NVIDIA Corporation\nView\nvShell.dll ()
MOD - \\?\globalroot\systemroot\system32\mswsock.dll ()
MOD - C:\Programme\Messenger Plus! Live\Detoured.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
========== Win32 Services (SafeList) ==========
SRV - (HidServ) -- File not found
SRV - (AppMgmt) -- File not found
SRV - (Akamai) -- c:\programme\gemeinsame dateien\akamai/netsession_win_b427739.dll ()
SRV - (Hamachi2Svc) -- J:\Programme\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (Steam Client Service) -- C:\Programme\Gemeinsame Dateien\Steam\SteamService.exe (Valve Corporation)
SRV - (npggsvc) -- C:\WINDOWS\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (DTNetService) -- C:\Programme\DAEMON Tools Net\DTNetSrv.exe (DT Soft Ltd)
SRV - (LBTServ) -- C:\Programme\Gemeinsame Dateien\LogiShrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
========== Driver Services (SafeList) ==========
DRV - (xpsec) -- File not found
DRV - (xcpip) -- File not found
DRV - (sptd) -- C:\WINDOWS\System32\Drivers\sptd.sys ()
DRV - (dtcdrom) -- C:\WINDOWS\system32\drivers\dtcdrom.sys (Disc-Soft)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (xfilt) -- C:\WINDOWS\system32\DRIVERS\xfilt.sys (VIA Technologies,Inc)
DRV - (videX32) -- C:\WINDOWS\system32\DRIVERS\videX32.sys (VIA Technologies, Inc.)
DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\WINDOWS\system32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (PID_0928) Logitech QuickCam Express(PID_0928) -- C:\WINDOWS\system32\drivers\LV561AV.SYS (Logitech Inc.)
DRV - (hamachi) -- C:\WINDOWS\system32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (mcdbus) -- C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {5601B994-0E9B-4ce2-8AB9-AD1155F2ABBD}:1.0.0.14
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.81
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Programme\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Programme\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\WINDOWS\system32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.09 17:00:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.12.25 20:56:20 | 000,000,000 | ---D | M]
[2010.08.21 18:13:22 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Extensions
[2011.12.27 13:31:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\extensions
[2010.11.03 17:56:49 | 000,000,000 | ---D | M] (NeffyPlugin Launcher) -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\extensions\{5601B994-0E9B-4ce2-8AB9-AD1155F2ABBD}
[2011.07.01 12:52:28 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.12.24 23:26:28 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.11.12 14:08:28 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.12.08 11:52:34 | 000,002,321 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\searchplugins\dictcc.xml
[2011.12.14 01:05:25 | 000,002,393 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\searchplugins\suche-anhand-von-bildern.xml
[2011.12.08 11:52:17 | 000,002,057 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\Mozilla\Firefox\Profiles\hwnt6xjs.default\searchplugins\youtube-videosuche.xml
[2011.11.09 17:00:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\{AE93811A-5C9A-4D34-8462-F7B864FC4696}.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\ADD-TO-SEARCHBOX@MALTEKRAUS.DE.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\SAVEFILETO@MOZDEV.ORG.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\SKIPSCREEN@SKIPSCREEN.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\BAKU\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\HWNT6XJS.DEFAULT\EXTENSIONS\YOUTUBE2MP3@MONDAYX.DE.XPI
[2010.08.21 20:09:49 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.11.09 17:00:37 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.09.08 16:52:08 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.09.08 16:52:08 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011.09.08 16:52:08 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.09.08 16:52:08 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.09.08 16:52:08 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.09.08 16:52:08 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
O1 HOSTS File: ([2011.07.29 23:32:10 | 000,002,148 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 hxxp://www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 14 more lines...
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\system32\Boot\boot.exe
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - d:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - d:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Dokumente und Einstellungen\BAKU\Desktop\PartyPoker.lnk File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Dokumente und Einstellungen\BAKU\Desktop\PartyPoker.lnk File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - mswsock.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - mswsock.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{02C2A049-F221-4F9E-B9C5-6B5FFA64A9F4}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\X) -C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\X ()
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Gemeinsame Dateien\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.08.21 18:07:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011.03.25 12:49:15 | 000,011,043 | ---- | M] () - D:\auto_hero_rebirth.honmod -- [ NTFS ]
O32 - AutoRun File - [2011.03.20 01:22:07 | 019,965,525 | ---- | M] () - M:\Autogenes Training - Phantasiereise - traumhafte Insel - Entspannungsmusik - erholsamer Schlaf.mp3 -- [ NTFS ]
O32 - AutoRun File - [2011.03.20 01:09:36 | 005,300,369 | ---- | M] () - M:\Autogenes Training vor dem Einschlafen - Anleitung.mp3 -- [ NTFS ]
O32 - AutoRun File - [2011.04.08 17:05:07 | 000,011,060 | ---- | M] () - M:\auto_hero_rebirth.honmod -- [ NTFS ]
O33 - MountPoints2\{65d6252b-a966-11e0-a28e-00196601c266}\Shell - "" = AutoRun
O33 - MountPoints2\{65d6252b-a966-11e0-a28e-00196601c266}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{65d6252b-a966-11e0-a28e-00196601c266}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
File not found -- C:\WINDOWS\System32\
[2011.12.28 20:38:33 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BAKU\Desktop\OTL.exe
[2011.12.28 20:23:43 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\BAKU\Desktop\Neuer Ordner
[2011.12.28 20:20:36 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\BAKU\Recent
[2011.12.28 08:46:02 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Sun
[2011.12.28 08:45:09 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe
[2011.12.28 08:39:30 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b
[2011.12.22 13:34:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\LogMeIn Hamachi
[2011.12.20 11:42:48 | 000,000,000 | ---D | C] -- C:\4c5ed3455f15beefe63d56e9d7
[2011.12.20 11:42:45 | 000,000,000 | ---D | C] -- C:\216102857c9d206bd24f
[2011.12.18 23:26:05 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 6.0
[2011.12.18 23:12:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles
[2011.12.18 23:12:04 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2011.12.18 23:11:39 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2011.12.18 20:57:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot_bak
[2011.12.18 20:48:15 | 000,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys
[2011.12.18 20:47:43 | 000,454,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys
[2011.12.18 20:46:58 | 002,060,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe
[2011.12.18 20:46:58 | 002,019,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe
[2011.12.18 20:46:57 | 002,183,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe
[2011.12.18 20:46:56 | 002,139,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe
[2011.12.18 20:45:27 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll
[2011.12.18 20:45:27 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll
[2011.12.18 20:45:24 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2011.12.18 20:45:23 | 001,985,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll
[2011.12.18 20:45:21 | 011,076,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll
[2011.12.18 20:44:54 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe
[2011.12.18 20:33:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall
[2011.12.18 19:53:22 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2011.12.18 19:44:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IObit
[2011.12.18 19:44:53 | 000,000,000 | ---D | C] -- C:\Programme\IObit
[2011.12.10 19:33:04 | 000,000,000 | ---D | C] -- C:\Banks
[2011.04.17 01:49:41 | 001,654,869 | ---- | C] (Dynu Systems Inc.) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DynuEncrypt.dll
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
File not found -- C:\WINDOWS\System32\
[2011.12.28 20:38:33 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\BAKU\Desktop\OTL.exe
[2011.12.28 20:28:34 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.12.28 20:21:05 | 000,195,072 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.28 08:46:01 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.12.27 21:30:36 | 002,511,542 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\swag.mp3
[2011.12.27 21:29:06 | 041,523,134 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\swag.wav
[2011.12.27 13:24:57 | 000,079,908 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\wacom_bamboo.jpg
[2011.12.26 22:09:02 | 000,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.12.25 20:55:26 | 002,454,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.12.24 01:05:27 | 000,023,760 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\raus.veg
[2011.12.23 22:32:24 | 000,116,416 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.mp3.sfk
[2011.12.23 21:47:34 | 001,350,870 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.mp3
[2011.12.23 21:41:41 | 022,327,508 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.wav
[2011.12.22 13:34:12 | 000,000,551 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\LogMeIn Hamachi.lnk
[2011.12.22 07:40:40 | 000,448,470 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.12.22 07:40:40 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.12.22 07:40:40 | 000,079,910 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.12.22 07:40:40 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.12.21 20:00:33 | 000,000,199 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\Dota 2.url
[2011.12.18 20:46:42 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2011.12.13 00:59:43 | 014,745,654 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\Desktop-Hintergrund.bmp
[2011.12.09 16:27:48 | 001,792,905 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\IMG_09122011_162638.png
[2011.12.08 23:01:02 | 005,588,270 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\stencil.psd
[2011.12.08 21:53:22 | 000,685,243 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\m9z608eo.psd
[2011.12.08 13:58:48 | 000,021,664 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\zach_hill_band_medium.jpg
[2011.12.08 13:57:03 | 000,017,015 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\1300044776986.jpg
[2011.11.30 20:29:34 | 000,265,256 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\moramora.veg
[2011.11.30 20:23:46 | 000,266,760 | ---- | M] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\moramora.veg.bak
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.12.28 08:46:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011.12.27 21:30:08 | 002,511,542 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\swag.mp3
[2011.12.27 21:29:05 | 041,523,134 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\swag.wav
[2011.12.27 13:24:57 | 000,079,908 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\wacom_bamboo.jpg
[2011.12.24 01:05:27 | 000,023,760 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\raus.veg
[2011.12.23 22:32:00 | 000,116,416 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.mp3.sfk
[2011.12.23 21:47:18 | 001,350,870 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.mp3
[2011.12.23 21:41:40 | 022,327,508 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\RAUS.wav
[2011.12.21 20:00:33 | 000,000,199 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\Dota 2.url
[2011.12.09 16:26:58 | 001,792,905 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\IMG_09122011_162638.png
[2011.12.08 23:01:00 | 005,588,270 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\stencil.psd
[2011.12.08 21:53:21 | 000,685,243 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Eigene Dateien\m9z608eo.psd
[2011.12.08 13:58:47 | 000,021,664 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\zach_hill_band_medium.jpg
[2011.12.08 13:57:02 | 000,017,015 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Desktop\1300044776986.jpg
[2011.10.22 08:48:43 | 000,059,856 | ---- | C] () -- C:\WINDOWS\System32\midiio.dll
[2011.08.09 23:24:00 | 000,082,289 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2011.06.09 17:56:43 | 000,080,896 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011.05.24 13:48:10 | 000,027,760 | ---- | C] () -- C:\WINDOWS\DIIUnin.dat
[2011.05.06 15:37:53 | 000,495,104 | ---- | C] () -- C:\Programme\lame_enc.dll
[2011.04.29 07:51:14 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2011.04.29 07:51:14 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2011.04.29 07:51:14 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2011.04.25 07:06:18 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2011.04.25 07:06:18 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010.11.20 22:44:01 | 000,000,096 | -H-- | C] () -- C:\WINDOWS\System32\HsInfo.dat
[2010.11.07 15:00:34 | 000,000,757 | ---- | C] () -- C:\WINDOWS\Thps3.INI
[2010.08.22 04:35:53 | 000,195,072 | ---- | C] () -- C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.08.21 18:57:43 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010.08.21 18:56:33 | 002,454,360 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.08.21 18:28:19 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2010.08.21 18:28:15 | 000,232,968 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2010.08.21 18:28:15 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2010.08.21 18:27:31 | 002,195,030 | ---- | C] () -- C:\WINDOWS\System32\nvdata.bin
[2010.08.21 18:22:13 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2010.08.21 18:22:13 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2010.08.21 18:20:54 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\vuins32.dll
[2010.08.21 18:13:20 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010.08.21 18:09:19 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010.08.21 18:04:26 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2009.10.07 00:46:36 | 000,025,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2009.10.07 00:23:08 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLFT2.dll
[2005.04.08 03:16:43 | 000,113,061 | -H-- | C] () -- C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\BAKUlog.dat
[2004.08.04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 13:00:00 | 000,448,470 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.04 13:00:00 | 000,432,356 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 13:00:00 | 000,079,910 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.04 13:00:00 | 000,067,312 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
[2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004.08.04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002.06.28 10:43:44 | 000,438,272 | ---- | C] () -- C:\WINDOWS\System32\xvid.dll
[2002.05.16 00:38:40 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll
[2002.05.04 14:19:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\avisynthEx.dll
[2001.10.08 12:37:32 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001.10.08 12:36:40 | 000,004,516 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
========== Alternate Data Streams ==========
@Alternate Data Stream - 164 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:21F11E8D
@Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:F63A059B
< End of report >
Extras.txt Code:
OTL Extras logfile created on: 28.12.2011 20:39:30 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\BAKU\Desktop
Windows XP Home Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,28 Gb Available Physical Memory | 63,90% Memory free
2,85 Gb Paging File | 2,27 Gb Available in Paging File | 79,53% Paging File free
Paging file location(s): C:\pagefile.sys 1024 3070 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 36,77 Gb Total Space | 16,17 Gb Free Space | 43,99% Space Free | Partition Type: NTFS
Drive D: | 29,29 Gb Total Space | 13,65 Gb Free Space | 46,61% Space Free | Partition Type: NTFS
Drive E: | 45,72 Gb Total Space | 12,97 Gb Free Space | 28,36% Space Free | Partition Type: NTFS
Drive J: | 492,06 Gb Total Space | 1,18 Gb Free Space | 0,24% Space Free | Partition Type: NTFS
Drive M: | 439,45 Gb Total Space | 282,57 Gb Free Space | 64,30% Space Free | Partition Type: NTFS
Computer Name: KI-1 | User Name: BAKU | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56335:TCP" = 56335:TCP:*:Enabled:Pando Media Booster
"56335:UDP" = 56335:UDP:*:Enabled:Pando Media Booster
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"56335:TCP" = 56335:TCP:*:Disabled:Pando Media Booster
"56335:UDP" = 56335:UDP:*:Disabled:Pando Media Booster
"4253:TCP" = 4253:TCP:*:Disabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Disabled:Akamai NetSession Interface
"3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop
"65533:TCP" = 65533:TCP:*:Enabled:Services
"52344:TCP" = 52344:TCP:*:Enabled:Services
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"D:\Programme\ICQ7.2\ICQ.exe" = D:\Programme\ICQ7.2\ICQ.exe:*:Enabled:ICQ7.2 -- (ICQ, LLC.)
"D:\Programme\ICQ7.2\aolload.exe" = D:\Programme\ICQ7.2\aolload.exe:*:Enabled:aolload.exe -- (AOL LLC)
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"J:\zsnesw142\zsnesw.exe" = J:\zsnesw142\zsnesw.exe:*:Enabled:zsnesw -- ()
"J:\Programme\Heroes of Newerth\hon.exe" = J:\Programme\Heroes of Newerth\hon.exe:*:Enabled:Heroes of Newerth -- (S2 Games)
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Logitech\Logitech Vid\Vid.exe" = C:\Programme\Logitech\Logitech Vid\Vid.exe:*:Enabled:Logitech Vid -- (Logitech Inc.)
"J:\steam\Steam.exe" = J:\steam\Steam.exe:*:Enabled:Steam -- (Valve Corporation)
"J:\Programme\beanfun!\BrightShadow\BrightShadow\BrightShadow.exe" = J:\Programme\beanfun!\BrightShadow\BrightShadow\BrightShadow.exe:*:Enabled:Gamania Patch Client
"J:\steam\SteamApps\common\dota 2 beta\dota.exe" = J:\steam\SteamApps\common\dota 2 beta\dota.exe:*:Enabled:Dota 2 -- ()
"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\WINDOWS\explorer.exe" = C:\WINDOWS\explorer.exe:*:Disabled:Windows Explorer -- (Microsoft Corporation)
"C:\Programme\Last.fm\LastFM.exe" = C:\Programme\Last.fm\LastFM.exe:*:Enabled:Last.fm -- (Last.fm)
"C:\Programme\foobar2000\foobar2000.exe" = C:\Programme\foobar2000\foobar2000.exe:*:Enabled:foobar2000 -- ()
"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Disabled:Firefox -- (Mozilla Corporation)
"J:\Programme\uTorrent\uTorrent.exe" = J:\Programme\uTorrent\uTorrent.exe:*:Disabled:µTorrent -- (BitTorrent, Inc.)
"C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe" = C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\Akamai\netsession_win.exe:*:Disabled:Akamai NetSession Interface
"D:\Programme\ICQ7.2\aolload.exe" = D:\Programme\ICQ7.2\aolload.exe:*:Disabled:aolload.exe -- (AOL LLC)
"D:\Programme\ICQ7.2\ICQ.exe" = D:\Programme\ICQ7.2\ICQ.exe:*:Disabled:ICQ7.2 -- (ICQ, LLC.)
"C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\isomob.exe" = C:\Dokumente und Einstellungen\BAKU\Anwendungsdaten\isomob.exe:*:Disabled:isomob
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Disabled:Pando Media Booster -- ()
"D:\Programme\Audiosurf\engine\QuestViewer.exe" = D:\Programme\Audiosurf\engine\QuestViewer.exe:*:Disabled:QuestViewer -- ()
"J:\AeriaGames\WolfTeam-DE\Wolfteam.bin" = J:\AeriaGames\WolfTeam-DE\Wolfteam.bin:*:Disabled:WolfTeam -- (Softnyx Co., Ltd.)
"C:\Programme\CCleaner\CCleaner.exe" = C:\Programme\CCleaner\CCleaner.exe:*:Enabled:CCleaner -- (Piriform Ltd)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP560_series" = Canon MP560 series MP Drivers
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{24508D50-EB8F-4FE6-B69D-B4935D8745EF}_is1" = Warsow 0.61
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 26
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{491DF203-7B61-4F0E-BDCB-A1218C4DAFE9}" = Native Instruments Massive
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FBCEA31-5D18-4212-9231-DE7CF1BE7DBB}" = Logitech Vid
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{55422856-42AF-4251-91FF-0349F2D14DF3}" = Korg Kontrol Editor
"{561968FD-56A1-49FD-9ED0-F55482C7C5BC}" = Adobe Media Encoder CS4 Exporter
"{56415658-366E-4E28-A6BD-68EC63E560E0}" = Vegas Pro 9.0
"{5866520C-8857-4986-833A-039F4584C3F7}" = Toontrack solo
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}" = Adobe After Effects CS4 Third Party Content
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{8186FF34-D389-4B7E-9A2F-C197585BCFBD}" = Adobe Media Encoder CS4 Importer
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{8A809006-C25A-4A3A-9DAB-94659BCDB107}" = NVIDIA PhysX
"{8BBB5E4C-3F5E-4C07-BFBE-33B34600783A}" = LogMeIn Hamachi
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{993A94A9-DCE3-4774-B35D-D8C74FC1E0BE}" = Royale Remixed Theme
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B55759D-424F-4CB1-B84E-AAE83CC1D20A}_is1" = Nitronic Rush (2011-11-11) version 20111111.0
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X (10.0.1) - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}" = Adobe MotionPicture Color Files CS4
"{B15381DD-FF97-4FCD-A881-ED4DB0975500}" = Adobe Color Video Profiles AE CS4
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C576C82C-EE87-11D6-B031-0000CB597465}" = A.F.7 Merge your files 1.3
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D801B39E-CE01-409F-8E7C-B7976EA3C9DC}_is1" = Audiosurf
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"ABC Amber Audio Converter" = ABC Amber Audio Converter
"Abe's Oddysee" = Abe's Oddysee
"AC3File_is1" = AC3File 0.7b
"AC3Filter" = AC3Filter (remove only)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Akamai" = Akamai NetSession Interface Service
"ASIO4ALL" = ASIO4ALL
"Audacity_is1" = Audacity 1.2.6
"AutoItv3" = AutoIt v3.3.6.1
"Avidemux 2.5" = Avidemux 2.5 (32-bit)
"CamStudio" = CamStudio
"Canon MP560 series Benutzerregistrierung" = Canon MP560 series Benutzerregistrierung
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DAEMON Tools Net" = DAEMON Tools Net
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"Easy-Shutdown" = Easy-Shutdown 1.3
"Emsisoft HiJackFree_is1" = Emsisoft HiJackFree 4.5
"Exif-Viewer" = Exif-Viewer 2.50
"ffdshow_is1" = ffdshow v1.1.3800 [2011-03-28]
"FL Studio 9" = FL Studio 9
"foobar2000" = foobar2000 v1.0.3
"Foxit Reader_is1" = Foxit Reader 5.0
"Fraps" = Fraps (remove only)
"Freecorder5" = Freecorder 5
"GlaceVerb_is1" = GlaceVerb 1.01
"Hardcore" = Hardcore
"hon" = Heroes of Newerth
"ie8" = Windows Internet Explorer 8
"IL Download Manager" = IL Download Manager
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platform Device Manager
"JDownloader" = JDownloader
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"LastFM_is1" = Last.fm 1.5.4.27091
"Live 8.2.1" = Live 8.2.1
"LogMeIn Hamachi" = LogMeIn Hamachi
"lvdrivers_12.10" = Logitech Webcam Software-Treiberpaket
"Magic ISO Maker v5.5 (build 0281)" = Magic ISO Maker v5.5 (build 0281)
"MagicDisc 2.7.106" = MagicDisc 2.7.106
"Memory_is1" = Memory 1.0
"Messenger Plus! Live" = Messenger Plus! Live
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"MP Navigator EX 3.0" = Canon MP Navigator EX 3.0
"Native Instruments Massive" = Native Instruments Massive
"NewBlue 3D Explosions for Windows" = NewBlue 3D Explosions for Windows
"NewBlue 3D Transformations for Windows" = NewBlue 3D Transformations for Windows
"NewBlue Art Blends for Windows" = NewBlue Art Blends for Windows
"NewBlue Art Effects for Windows" = NewBlue Art Effects for Windows
"NewBlue Film Effects for Windows" = NewBlue Film Effects for Windows
"NewBlue Motion Blends for Windows" = NewBlue Motion Blends for Windows
"NewBlue Motion Effects for Windows" = NewBlue Motion Effects for Windows
"NewBlue Video Essentials for Windows" = NewBlue Video Essentials for Windows
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Opera 11.60.1185" = Opera 11.60
"PartyPoker" = PartyPoker
"Phoenix Fastload Advanced 2" = Phoenix Fastload Advanced 2
"PokerStars.net" = PokerStars.net
"QPang" = QPang
"Reason5_is1" = Reason 5.0
"Sawer" = Sawer
"shortcircuit2" = shortcircuit²
"SP6" = Logitech SetPoint 6.15
"ST6UNST #1" = Hero Editor V0.96
"Steam App 570" = Dota 2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Tony Hawk's Pro Skater 3®" = Tony Hawk's Pro Skater 3®
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.3
"VMLoad" = VMLoad
"VN_VUIns_Rhine_VIA" = VIA Rhine-Family Fast Ethernet Adapter
"Waves SSL Collection v1.2" = Waves SSL Collection v1.2
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"WolfTeam-DE" = WolfTeam-DE
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"Xvid_is1" = Xvid 1.2.2 final uninstall
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"I-Doser v4" = I-Doser v4
"Lumines - Puzzle Fusion" = Lumines - Puzzle Fusion
< End of report >
MBAM LOG Code:
Malwarebytes Anti-Malware 1.60.0.1800
www.malwarebytes.org
Datenbank Version: v2011.12.28.03
Windows XP Service Pack 2 x86 NTFS
Internet Explorer 8.0.6001.18702
BAKU :: KI-1 [Administrator]
28.12.2011 20:52:12
mbam-log-2011-12-28 (20-52-12).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 376172
Laufzeit: 2 Stunde(n), 3 Minute(n), 40 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Policies (Backdoor.HMCPol.Gen) -> Daten: C:\WINDOWS\system32\Boot\boot.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 1
HKCR\regfile\shell\open\command| (Broken.OpenCommand) -> Bösartig: ("regedit.exe" "%1") Gut: (regedit.exe "%1") -> Erfolgreich ersetzt und in Quarantäne gestellt.
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 16
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\U\00000001.@ (Backdoor.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\U\80000000.@ (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\U\800000cb.@ (Backdoor.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Anwendungsdaten\2d29b15b\U\800000cf.@ (Backdoor.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Temp\comphost.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Dokumente und Einstellungen\BAKU\Lokale Einstellungen\Temp\208.tmp (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\_restore{51A7B86A-8BAE-4CE7-82BE-988813652ACD}\RP1\A0000683.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\_restore{51A7B86A-8BAE-4CE7-82BE-988813652ACD}\RP1\A0000684.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\System Volume Information\_restore{51A7B86A-8BAE-4CE7-82BE-988813652ACD}\RP1\A0000689.ini (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\WINDOWS\assembly\GAC_MSIL\Desktop.ini (Rootkit.0Access) -> Löschen bei Neustart.
D:\IZDRMVSTRASV173KYGN\Izotope.iDrum.VSTi.RTAS.v1.7.3.Incl.Keygen-AiR\a-id173\keygen.exe (Trojan.Agent.ck) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Fantasy Tennis Fish-Hack\Starter.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
D:\Poly\Uninstall.exe (Malware.Packer.Krunchy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\JDownloader\KEYGEN.EXE (RiskWare.Tool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
M:\MultiHack\MultiHack.exe (HackTool.GamesCheat.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Programme\lame_enc.dll (Spyware.OnlineGames) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende)
MBR Check Log Code:
MBRCheck, version 1.2.3
(c) 2010, AD
Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 2 (build 2600)
Logical Drives Mask: 0x000013dc
Kernel Drivers (total 122):
0x804D7000 \WINDOWS\system32\ntoskrnl.exe
0x806FE000 \WINDOWS\system32\hal.dll
0xF7987000 \WINDOWS\system32\KDCOM.DLL
0xF7897000 \WINDOWS\system32\BOOTVID.dll
0xF75F7000 dhgarnbu.sys
0xF7443000 spyk.sys
0xF7989000 \WINDOWS\System32\Drivers\WMILIB.SYS
0xF742B000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xF7868000 ACPI.sys
0xF741A000 pci.sys
0xF7607000 isapnp.sys
0xF7707000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xF7617000 MountMgr.sys
0xF7849000 ftdisk.sys
0xF770F000 PartMgr.sys
0xF7717000 videX32.sys
0xF7627000 VolSnap.sys
0xF7402000 atapi.sys
0xF7637000 disk.sys
0xF7647000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF782A000 fltMgr.sys
0xF7975000 sr.sys
0xF771F000 xfilt.sys
0xF795E000 KSecDD.sys
0xF7B52000 Ntfs.sys
0xF7A22000 NDIS.sys
0xF7657000 uagp35.sys
0xF7B37000 Mup.sys
0xF76D7000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB7CDF000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB7CCB000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF776F000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB7CA8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF7777000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7787000 \SystemRoot\system32\DRIVERS\fdc.sys
0xF7933000 \SystemRoot\system32\DRIVERS\gameenum.sys
0xF7A5E000 \SystemRoot\system32\drivers\msmpu401.sys
0xB7C86000 \SystemRoot\system32\drivers\portcls.sys
0xF76E7000 \SystemRoot\system32\drivers\drmk.sys
0xB7C3B000 \SystemRoot\system32\drivers\ks.sys
0xF76F7000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF793B000 \SystemRoot\system32\DRIVERS\L8042Kbd.sys
0xF77A7000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB7B79000 \SystemRoot\system32\DRIVERS\serial.sys
0xB87EC000 \SystemRoot\system32\DRIVERS\serenum.sys
0xF7556000 \SystemRoot\system32\DRIVERS\fetnd5bv.sys
0xB7B40000 \SystemRoot\System32\Drivers\ay1ugovg.SYS
0xB7B1B000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF7AAF000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7546000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB87D8000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB7B04000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7536000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB87A0000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF77DF000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB7ACB000 \SystemRoot\system32\DRIVERS\psched.sys
0xB8790000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF77EF000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF77FF000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF780F000 \SystemRoot\system32\DRIVERS\hamachi.sys
0xB8780000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF7817000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xB7A5E000 \SystemRoot\system32\DRIVERS\mcdbus.sys
0xF799B000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB7A2A000 \SystemRoot\system32\DRIVERS\update.sys
0xB87C4000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB75D6000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xB8770000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB8760000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB8750000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB8730000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF79A5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF79A9000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7A95000 \SystemRoot\System32\Drivers\Null.SYS
0xF79AD000 \SystemRoot\System32\Drivers\Beep.SYS
0xF77C7000 \SystemRoot\System32\drivers\vga.sys
0xB7AF0000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xB8710000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xF77D7000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xF79B1000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF79B5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB7ABB000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0xB7AEC000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xB7AAB000 \SystemRoot\System32\Drivers\Msfs.SYS
0xB7A9B000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB7AE4000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB5381000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB52D9000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB52B1000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB5290000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xF76C7000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xB526E000 \SystemRoot\System32\drivers\afd.sys
0xB7C1A000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB5242000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB51D3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xB7BFA000 \SystemRoot\System32\Drivers\Fips.SYS
0xB519E000 \??\C:\WINDOWS\system32\drivers\dtcdrom.sys
0xB7BDA000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB3021000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xF79BF000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB53E4000 \SystemRoot\System32\drivers\Dxapi.sys
0xB5379000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xF7A98000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xB2F44000 \SystemRoot\system32\drivers\xpsec.sys
0xB2EEC000 \SystemRoot\system32\drivers\xcpip.sys
0xBFFA0000 \SystemRoot\System32\ATMFD.DLL
0xB2C80000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB2A4F000 \SystemRoot\system32\drivers\wdmaud.sys
0xB2D1C000 \SystemRoot\system32\drivers\sysaudio.sys
0xF7A74000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xB1237000 \SystemRoot\system32\DRIVERS\srv.sys
0xF7797000 \SystemRoot\System32\Drivers\TDTCP.SYS
0xB119D000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xB7A83000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0xB5359000 \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys
0xB1062000 \SystemRoot\System32\Drivers\HTTP.sys
0xB0E58000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll
0x10000000 \Programme\DAEMON Tools Lite\Engine.dll
Processes (total 30):
0 System Idle Process
4 System
700 C:\WINDOWS\system32\smss.exe
752 csrss.exe
776 C:\WINDOWS\system32\winlogon.exe
992 C:\WINDOWS\system32\services.exe
1004 C:\WINDOWS\system32\lsass.exe
1240 C:\WINDOWS\system32\nvsvc32.exe
1372 C:\WINDOWS\system32\svchost.exe
1464 svchost.exe
1824 C:\WINDOWS\system32\svchost.exe
1936 svchost.exe
196 svchost.exe
732 C:\WINDOWS\system32\spoolsv.exe
1648 C:\WINDOWS\explorer.exe
540 C:\Programme\Messenger\msmsgs.exe
2136 C:\Programme\Mozilla Firefox\firefox.exe
2476 C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
2520 C:\WINDOWS\system32\notepad.exe
2556 C:\WINDOWS\system32\svchost.exe
2808 J:\Programme\LogMeIn Hamachi\hamachi-2.exe
2840 C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
2872 C:\WINDOWS\system32\svchost.exe
3652 C:\WINDOWS\system32\wuauclt.exe
2264 alg.exe
908 wmiprvse.exe
3948 C:\WINDOWS\system32\svchost.exe
1668 C:\WINDOWS\system32\notepad.exe
2132 C:\WINDOWS\system32\svchost.exe
2096 C:\Dokumente und Einstellungen\BAKU\Desktop\MBRCheck.exe
\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000009`3145fe00 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x00000010`840bde00 (NTFS)
\\.\J: --> \\.\PhysicalDrive1 at offset 0x0000006d`dd072c00 (NTFS)
\\.\M: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)
PhysicalDrive0 Model Number: WDCWD1200BB-00DAA3, Rev: 75.13B75
PhysicalDrive1 Model Number: WDC WD10EARS-00MVWB0, Rev:
Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 MBR Code Faked (known infection: Whistler / Black Internet)!
SHA1: F2D69AC1D2BB63F5714B514748C7EBBD7C6A806B
931 GB \\.\PhysicalDrive1 RE: Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
[1] Dump the MBR of a physical disk to file.
[2] Restore the MBR of a physical disk with a standard boot code.
[3] Exit.
Enter your choice:
Done!
|
