Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   System musste blockiert werden. 50€ Trjoaner/Virus (https://www.trojaner-board.de/107882-system-musste-blockiert-50-trjoaner-virus.html)

Willow1989 10.01.2012 13:58
System musste blockiert werden. 50€ Trjoaner/Virus
 
Hallo meine lieben Helfer :),

so nun habe ich mir OTL runtergeladen und nun hier die OTL. txt datei


Code:
OTL logfile created on: 10.01.2012 13:32:17 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Dani\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free
5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS
Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS
 
Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
PRC - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () -- C:\Program Files\Guard-ICQ\GuardICQ.exe
PRC - [2011.12.15 15:00:00 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.12.15 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.12.14 12:23:34 | 001,212,224 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesApp32.exe
PRC - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) -- D:\Tuneup\TuneUpUtilitiesService32.exe
PRC - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) -- C:\Program Files\System Control Manager\MSIService.exe
PRC - [2008.08.20 11:35:20 | 006,265,376 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2006.09.14 08:20:24 | 000,126,464 | ---- | M] () -- C:\Program Files\WinRAR 3.61 Multi\rarext.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.27 14:39:30 | 001,564,368 | ---- | M] () [Auto | Running] -- C:\Program Files\Guard-ICQ\GuardICQ.exe -- (Guard.Mail.ru)
SRV - [2011.12.15 14:59:48 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.12.15 14:59:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.12.14 12:23:32 | 001,514,304 | ---- | M] (TuneUp Software) [Auto | Running] -- D:\Tuneup\TuneUpUtilitiesService32.exe -- (TuneUp.UtilitiesSvc)
SRV - [2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\System32\uxtuneup.dll -- (UxTuneUp)
SRV - [2011.02.28 17:13:56 | 000,247,096 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008.11.05 18:21:04 | 000,159,744 | ---- | M] (Micro-Star Int'l Co., Ltd.) [Auto | Running] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011.12.12 19:31:38 | 000,010,064 | ---- | M] (TuneUp Software) [Kernel | On_Demand | Running] -- D:\Tuneup\TuneUpUtilitiesDriver32.sys -- (TuneUpUtilitiesDrv)
DRV - [2010.06.23 09:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.01.13 09:45:00 | 000,954,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.08.23 02:28:32 | 000,333,824 | ---- | M] (Realtek Semiconductor Corporation                          ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187Se.sys -- (RTL8187Se)
DRV - [2008.08.07 10:01:44 | 000,097,536 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR)
DRV - [2008.07.19 20:53:00 | 007,545,824 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008.06.10 01:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
DRV - [2008.04.01 14:42:36 | 000,014,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2008.02.29 23:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2007.03.19 16:00:14 | 000,031,616 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RLVrtAuCbl.sys -- (ReallusionVirtualAudio)
DRV - [2006.11.02 08:41:49 | 001,010,560 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = ICQ.com Suche
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/ig"
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\firejump@firejump.net: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net [2011.12.27 14:48:26 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mail@gutscheinrausch.de: C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de [2011.12.27 14:48:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Users\Dani\components [2011.12.23 14:24:12 | 000,000,000 | ---D | M]
 
[2011.12.21 17:00:10 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Extensions
[2012.01.05 18:11:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions
[2012.01.05 16:36:15 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.12.27 14:48:26 | 000,000,000 | ---D | M] (FireJump) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\firejump@firejump.net
[2011.12.27 14:48:35 | 000,000,000 | ---D | M] (Gutscheinrausch.de) -- C:\Users\Dani\AppData\Roaming\mozilla\Firefox\Profiles\9uddmkkq.default\extensions\mail@gutscheinrausch.de
[2012.01.03 18:58:45 | 000,001,048 | ---- | M] () -- C:\Users\Dani\AppData\Roaming\Mozilla\Firefox\Profiles\9uddmkkq.default\searchplugins\icqplugin.xml
() (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{1FC895A6-2042-46EC-A61B-233165B4C218}.XPI
() (No name found) -- C:\USERS\DANI\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\9UDDMKKQ.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Guard.Mail.ru.gui] C:\Program Files\Guard-ICQ\GuardICQ.exe ()
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International  CO., LTD.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org)
O4 - HKCU..\Run: [EPSON SX218 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIGDE.EXE (SEIKO EPSON CORPORATION)
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - C:\Program Files\ICQ7.7\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{69392199-458C-42AD-B6BC-728C723712B3}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F682A9C3-252C-4710-8AFB-98221359DD31}: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Shockwave Flash
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: UxTuneUp - C:\Windows\System32\uxtuneup.dll (TuneUp Software)
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.10 13:25:39 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
[2012.01.10 13:23:51 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{648E6D91-1BCF-4FE5-BDAE-6777BD7917FE}
[2012.01.10 13:23:30 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{5173D77C-D270-4016-921F-B51E57C0D86F}
[2012.01.09 19:32:43 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\GTA Vice City User Files
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.01.09 19:29:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield Installation Information
[2012.01.09 14:55:57 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{483C0C77-9B4A-4832-9E17-D00F0C41CEEF}
[2012.01.09 14:55:36 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{DD268440-8875-43E0-B750-D36001316736}
[2012.01.09 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{86CFB256-CD44-4169-B015-A0E0A4A27ECB}
[2012.01.08 12:31:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F15A13D5-0B80-49D1-8722-492714A003C1}
[2012.01.07 19:02:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9E4C8377-579D-4F8F-AF42-466078873D79}
[2012.01.05 12:33:27 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{77D8518A-BE6E-4176-969D-16E1F9889ABA}
[2012.01.05 12:33:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{9599849E-C1AE-408D-989C-184055158D1C}
[2012.01.04 17:53:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\EPSON
[2012.01.04 17:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Xerox
[2012.01.04 13:01:24 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{29C0D372-F898-471F-9E40-BE58B56F4E7F}
[2012.01.04 13:01:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{C2E9B22A-B731-4554-A790-7E94ABC0EC6C}
[2012.01.03 13:18:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{264BC785-2A52-4B93-A67D-E93C7C5F8C95}
[2012.01.03 13:17:49 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{136D686E-C663-4A64-A32B-3E76A1820EB9}
[2012.01.02 10:59:17 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\EPSON
[2012.01.02 10:57:24 | 000,000,000 | ---D | C] -- C:\ProgramData\EPSON
[2012.01.02 10:57:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
[2012.01.02 10:57:06 | 000,000,000 | ---D | C] -- C:\Program Files\epson
[2012.01.02 10:37:59 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{2DB0CA50-BB90-446E-86AE-CEF92D171830}
[2012.01.02 10:37:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{57FA067B-1B5A-4EB1-8048-3EA0FD848FBA}
[2012.01.01 14:34:58 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{519BCA38-E62C-42AE-9825-23A18DCF100B}
[2012.01.01 14:34:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{4D298421-D036-4C55-A654-4B90B1C5B342}
[2011.12.30 13:46:47 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org
[2011.12.30 13:44:17 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3
[2011.12.30 13:42:38 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3
[2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2011.12.30 13:42:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2011.12.30 13:41:37 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2011.12.30 11:38:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{23AEC93C-592B-43B7-8BFC-DF33806CD7D3}
[2011.12.30 11:38:20 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{95BAD371-73A0-42A9-8510-A91FB2312E93}
[2011.12.29 21:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\Lavalys
[2011.12.27 15:09:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\ICQ
[2011.12.27 14:49:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ-Banner-Remover
[2011.12.27 14:48:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon
[2011.12.27 14:48:26 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\Windows\System32\dhRichClient3.dll
[2011.12.27 14:40:54 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ6Toolbar
[2011.12.27 14:40:52 | 000,000,000 | ---D | C] -- C:\ProgramData\ICQ
[2011.12.27 14:39:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.7
[2011.12.27 14:39:30 | 000,000,000 | ---D | C] -- C:\Program Files\Guard-ICQ
[2011.12.27 14:39:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\ICQ
[2011.12.27 14:39:03 | 000,000,000 | ---D | C] -- C:\Program Files\ICQ7.7
[2011.12.27 14:07:25 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{3FE3CBE6-09F2-452B-91AC-82DAE19EE321}
[2011.12.27 14:07:14 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{18DC6E01-3EE7-4956-B2C9-5C3C533F8558}
[2011.12.27 14:07:13 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{F36BE284-F332-4FBB-A58A-47060C4B52BC}
[2011.12.24 23:43:09 | 000,028,992 | ---- | C] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Reallusion
[2011.12.24 21:33:33 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\CamSuite Gallery
[2011.12.23 19:44:45 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{A9DC22AE-1A88-4810-837D-439AD9E15D08}
[2011.12.23 19:44:35 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{98CB93AE-8609-46CA-B957-68CA22D4FE83}
[2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer
[2011.12.23 14:26:09 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live Writer
[2011.12.22 23:54:55 | 000,000,000 | ---D | C] -- C:\Users\Dani\updates
[2011.12.22 00:52:55 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2011.12.22 00:47:54 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011.12.22 00:08:53 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH
[2011.12.22 00:08:13 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2011.12.22 00:06:18 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Windows Live
[2011.12.21 23:50:55 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Portable Devices
[2011.12.21 23:11:10 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{ADB0B6D3-CEB3-4253-B7A7-808FFEF1B4C1}
[2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2011.12.21 22:55:01 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2011.12.21 22:54:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2011.12.21 22:21:51 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011.12.21 22:15:47 | 000,000,000 | --SD | C] -- C:\Users\Dani\AppData\Roaming\Microsoft
[2011.12.21 21:28:44 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft Games
[2011.12.21 21:21:50 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{408070E9-A3E0-410B-9D5E-CC681A8A7B65}
[2011.12.21 20:18:44 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2011.12.21 20:18:22 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\{BD52F1DC-2973-42FB-9D62-C819F7A05AC1}
[2011.12.21 20:16:17 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Avira
[2011.12.21 20:10:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011.12.21 20:10:27 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011.12.21 20:10:26 | 000,134,856 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.21 20:10:26 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.21 20:10:26 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011.12.21 20:10:25 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.12.21 19:29:41 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Skype
[2011.12.21 19:26:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.12.21 19:26:51 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011.12.21 19:26:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011.12.21 17:37:32 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2011.12.21 17:37:32 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[2011.12.21 17:37:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012
[2011.12.21 17:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2011.12.21 17:21:38 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Macromedia
[2011.12.21 17:01:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\TuneUp Software
[2011.12.21 17:00:27 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software
[2011.12.21 17:00:21 | 000,000,000 | -HSD | C] -- C:\ProgramData\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Mozilla
[2011.12.21 17:00:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Mozilla
[2011.12.21 17:00:01 | 016,096,216 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xul.dll
[2011.12.21 17:00:01 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\updater.exe
[2011.12.21 17:00:01 | 000,170,968 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll
[2011.12.21 17:00:01 | 000,154,584 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll
[2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll
[2011.12.21 17:00:01 | 000,105,432 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll
[2011.12.21 17:00:01 | 000,021,976 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll
[2011.12.21 17:00:01 | 000,020,440 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll
[2011.12.21 17:00:01 | 000,019,928 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll
[2011.12.21 17:00:01 | 000,016,856 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe
[2011.12.21 17:00:01 | 000,000,000 | ---D | C] -- C:\Users\Dani\searchplugins
[2011.12.21 17:00:00 | 002,106,216 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll
[2011.12.21 17:00:00 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll
[2011.12.21 17:00:00 | 000,924,632 | ---- | C] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe
[2011.12.21 17:00:00 | 000,814,040 | ---- | C] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.21 17:00:00 | 000,646,104 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll
[2011.12.21 17:00:00 | 000,626,688 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll
[2011.12.21 17:00:00 | 000,548,864 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll
[2011.12.21 17:00:00 | 000,486,360 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll
[2011.12.21 17:00:00 | 000,479,232 | ---- | C] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll
[2011.12.21 17:00:00 | 000,371,672 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll
[2011.12.21 17:00:00 | 000,269,272 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll
[2011.12.21 17:00:00 | 000,187,352 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll
[2011.12.21 17:00:00 | 000,125,912 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe
[2011.12.21 17:00:00 | 000,109,528 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll
[2011.12.21 17:00:00 | 000,097,240 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll
[2011.12.21 17:00:00 | 000,043,992 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll
[2011.12.21 17:00:00 | 000,019,416 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll
[2011.12.21 17:00:00 | 000,015,832 | ---- | C] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\uninstall
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\hyphenation
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\extensions
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\defaults
[2011.12.21 17:00:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\components
[2011.12.21 16:51:47 | 000,917,504 | ---- | C] (Atheros Communications, Inc.) -- C:\Windows\System32\athr.sys
[2011.12.21 16:51:47 | 000,376,832 | ---- | C] (Atheros) -- C:\Windows\System32\S64CPA.exe
[2011.12.21 16:51:47 | 000,053,248 | ---- | C] (Atheros) -- C:\Windows\System32\athihvui.dll
[2011.12.21 16:51:47 | 000,000,000 | ---D | C] -- C:\Windows\System32\nn-NO
[2011.12.21 16:51:45 | 000,393,216 | ---- | C] (Atheros) -- C:\Windows\System32\athihvs.dll
[2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Cisco
[2011.12.21 16:51:22 | 000,000,000 | ---D | C] -- C:\Program Files\Atheros
[2011.12.21 16:50:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Atheros
[2011.12.21 16:31:07 | 000,000,000 | ---D | C] -- C:\Users\Dani\Documents\Ulead Burn.Now
[2011.12.21 16:31:06 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Ulead Systems
[2011.12.21 16:10:37 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Toshiba
[2011.12.21 16:10:34 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Symantec
[2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Adobe
[2011.12.21 16:10:15 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Adobe
[2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\Searches
[2011.12.21 16:10:09 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011.12.21 16:10:00 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Identities
[2011.12.21 16:09:58 | 000,000,000 | R--D | C] -- C:\Users\Dani\Contacts
[2011.12.21 16:09:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ulead Burn.Now 4.5 SE
[2011.12.21 16:08:50 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Ulead Systems
[2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Ulead Systems
[2011.12.21 16:08:49 | 000,000,000 | ---D | C] -- C:\Program Files\Ulead Systems
[2011.12.21 16:07:32 | 005,632,000 | ---- | C] (Reallusion Inc.) -- C:\Windows\System32\RLVirtualCamera.ocx
[2011.12.21 16:07:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reallusion
[2011.12.21 16:07:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Reallusion
[2011.12.21 16:07:15 | 000,000,000 | ---D | C] -- C:\Program Files\Reallusion
[2011.12.21 16:06:26 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\InstallShield
[2011.12.21 16:04:05 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\VirtualStore
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Videos
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Saved Games
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Pictures
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Music
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Links
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Favorites
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Downloads
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Documents
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\Desktop
[2011.12.21 16:04:02 | 000,000,000 | R--D | C] -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Vorlagen
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Verlauf
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Temporary Internet Files
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Startmenü
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\SendTo
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Recent
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Netzwerkumgebung
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Lokale Einstellungen
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Videos
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Musik
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Eigene Dateien
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Documents\Eigene Bilder
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Druckumgebung
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Cookies
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\AppData\Local\Anwendungsdaten
[2011.12.21 16:04:02 | 000,000,000 | -HSD | C] -- C:\Users\Dani\Anwendungsdaten
[2011.12.21 16:04:02 | 000,000,000 | -H-D | C] -- C:\Users\Dani\AppData
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Temp
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Local\Microsoft
[2011.12.21 16:04:02 | 000,000,000 | ---D | C] -- C:\Users\Dani\AppData\Roaming\Media Center Programs
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.10 13:26:15 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.01.10 13:25:43 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Dani\Desktop\OTL.exe
[2012.01.10 13:03:10 | 000,618,442 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.10 13:03:10 | 000,587,178 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.10 13:03:10 | 000,122,842 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.10 13:03:10 | 000,101,250 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.10 12:57:28 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.10 12:57:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.10 12:57:15 | 2951,798,784 | -HS- | M] () -- C:\hiberfil.sys
[2012.01.09 20:10:01 | 000,042,464 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.01.09 14:54:07 | 000,648,194 | ---- | M] () -- C:\Users\Dani\Documents\weber006.jpg
[2012.01.09 14:53:33 | 000,527,575 | ---- | M] () -- C:\Users\Dani\Documents\niermann005.jpg
[2012.01.09 14:52:56 | 000,467,510 | ---- | M] () -- C:\Users\Dani\Documents\kreuzer004.jpg
[2012.01.09 14:52:16 | 000,570,189 | ---- | M] () -- C:\Users\Dani\Documents\avitea003.jpg
[2012.01.09 14:50:28 | 000,730,926 | ---- | M] () -- C:\Users\Dani\Documents\berufsberatung002.jpg
[2012.01.09 14:49:46 | 000,601,006 | ---- | M] () -- C:\Users\Dani\Documents\harz4001.jpg
[2012.01.09 14:48:31 | 000,449,126 | ---- | M] () -- C:\Users\Dani\Documents\schulabsage002.jpg
[2012.01.04 17:54:37 | 000,494,619 | ---- | M] () -- C:\Users\Dani\Documents\Zeugnis.jpg
[2012.01.04 17:26:34 | 000,000,775 | ---- | M] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.01.01 04:38:43 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.12.30 22:06:51 | 000,284,520 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml
[2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini
[2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk
[2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar
[2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll
[2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete
[2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk
[2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini
[2011.12.22 00:55:54 | 000,060,826 | ---- | M] () -- C:\Windows\System32\license.rtf
[2011.12.21 17:37:29 | 000,000,616 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini
[2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale
[2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini
[2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml
[2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list
[2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files
[2011.12.15 15:00:00 | 000,134,856 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011.12.15 15:00:00 | 000,074,640 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011.12.15 15:00:00 | 000,036,000 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys
[2011.12.14 12:23:40 | 000,031,552 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe
[2011.12.14 12:23:22 | 000,028,992 | ---- | M] (TuneUp Software) -- C:\Windows\System32\uxtuneup.dll
[2011.12.14 12:23:22 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.09 14:54:07 | 000,648,194 | ---- | C] () -- C:\Users\Dani\Documents\weber006.jpg
[2012.01.09 14:53:32 | 000,527,575 | ---- | C] () -- C:\Users\Dani\Documents\niermann005.jpg
[2012.01.09 14:52:56 | 000,467,510 | ---- | C] () -- C:\Users\Dani\Documents\kreuzer004.jpg
[2012.01.09 14:52:15 | 000,570,189 | ---- | C] () -- C:\Users\Dani\Documents\avitea003.jpg
[2012.01.09 14:50:28 | 000,730,926 | ---- | C] () -- C:\Users\Dani\Documents\berufsberatung002.jpg
[2012.01.09 14:49:45 | 000,601,006 | ---- | C] () -- C:\Users\Dani\Documents\harz4001.jpg
[2012.01.09 14:48:31 | 000,449,126 | ---- | C] () -- C:\Users\Dani\Documents\schulabsage002.jpg
[2012.01.04 17:54:37 | 000,494,619 | ---- | C] () -- C:\Users\Dani\Documents\Zeugnis.jpg
[2012.01.04 17:26:34 | 000,000,775 | ---- | C] () -- C:\Users\Public\Desktop\EPSON Scan.lnk
[2012.01.01 04:38:43 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdFs_01_07_00.Wdf
[2011.12.27 14:48:27 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2011.12.23 14:24:17 | 000,001,457 | ---- | C] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:17 | 000,000,057 | ---- | C] () -- C:\Users\Dani\active-update.xml
[2011.12.22 00:47:59 | 2951,798,784 | -HS- | C] () -- C:\hiberfil.sys
[2011.12.22 00:10:22 | 000,001,047 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
[2011.12.21 23:08:40 | 000,000,925 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
[2011.12.21 22:16:05 | 000,130,008 | ---- | C] () -- C:\Windows\System32\systemsf.ebd
[2011.12.21 22:16:01 | 000,009,239 | ---- | C] () -- C:\Windows\System32\spcinstrumentation.man
[2011.12.21 22:15:47 | 000,442,788 | ---- | C] () -- C:\Windows\System32\dot3.tmf
[2011.12.21 22:15:43 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2011.12.21 22:15:43 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2011.12.21 22:15:39 | 000,392,170 | ---- | C] () -- C:\Windows\System32\onex.tmf
[2011.12.21 22:15:33 | 000,344,698 | ---- | C] () -- C:\Windows\System32\eaphost.tmf
[2011.12.21 22:15:10 | 000,208,966 | ---- | C] () -- C:\Windows\System32\WFP.TMF
[2011.12.21 22:15:05 | 000,092,918 | ---- | C] () -- C:\Windows\System32\slmgr.vbs
[2011.12.21 22:14:04 | 000,009,212 | ---- | C] () -- C:\Windows\System32\RacUR.xml
[2011.12.21 21:02:56 | 000,000,959 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011.12.21 20:31:51 | 000,057,667 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.12.21 17:46:12 | 002,501,921 | ---- | C] () -- C:\Windows\System32\wlan.tmf
[2011.12.21 17:37:29 | 000,000,616 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk
[2011.12.21 17:37:28 | 000,000,608 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk
[2011.12.21 17:00:01 | 005,642,801 | ---- | C] () -- C:\Users\Dani\omni.jar
[2011.12.21 17:00:01 | 000,034,427 | ---- | C] () -- C:\Users\Dani\removed-files
[2011.12.21 17:00:01 | 000,002,723 | ---- | C] () -- C:\Users\Dani\precomplete
[2011.12.21 17:00:01 | 000,000,701 | ---- | C] () -- C:\Users\Dani\updater.ini
[2011.12.21 17:00:01 | 000,000,478 | ---- | C] () -- C:\Users\Dani\softokn3.chk
[2011.12.21 17:00:01 | 000,000,141 | ---- | C] () -- C:\Users\Dani\platform.ini
[2011.12.21 17:00:01 | 000,000,003 | ---- | C] () -- C:\Users\Dani\update.locale
[2011.12.21 17:00:00 | 002,124,760 | ---- | C] () -- C:\Users\Dani\mozjs.dll
[2011.12.21 17:00:00 | 000,011,263 | ---- | C] () -- C:\Users\Dani\blocklist.xml
[2011.12.21 17:00:00 | 000,004,284 | ---- | C] () -- C:\Users\Dani\crashreporter.ini
[2011.12.21 17:00:00 | 000,002,153 | ---- | C] () -- C:\Users\Dani\application.ini
[2011.12.21 17:00:00 | 000,000,706 | ---- | C] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.21 17:00:00 | 000,000,478 | ---- | C] () -- C:\Users\Dani\freebl3.chk
[2011.12.21 17:00:00 | 000,000,130 | ---- | C] () -- C:\Users\Dani\dependentlibs.list
[2011.12.21 16:51:47 | 000,116,863 | ---- | C] () -- C:\Windows\System32\netathr.inf
[2011.12.21 16:51:47 | 000,038,711 | ---- | C] () -- C:\Windows\System32\athrext.cat
[2011.12.21 16:10:08 | 000,000,954 | ---- | C] () -- C:\Users\Dani\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
[2011.12.21 16:07:31 | 000,031,616 | ---- | C] () -- C:\Windows\System32\drivers\RLVrtAuCbl.sys
[2011.12.21 16:03:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009.12.03 09:27:30 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2009.02.24 10:57:02 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2009.02.23 20:08:46 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.02.23 18:20:20 | 000,618,442 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.02.23 18:20:20 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.02.23 18:20:20 | 000,122,842 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.02.23 18:20:20 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.01.05 08:31:24 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2009.01.05 08:31:24 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008.12.31 11:06:55 | 000,042,464 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008.12.31 10:38:39 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
[2006.11.02 13:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:47:37 | 000,284,520 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,587,178 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,101,250 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.12.27 14:48:34 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\DesktopIconForAmazon
[2012.01.04 17:53:55 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\EPSON
[2012.01.06 12:46:29 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\ICQ
[2011.12.30 13:46:47 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\OpenOffice.org
[2011.12.24 23:42:37 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\TuneUp Software
[2011.12.21 16:31:06 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Ulead Systems
[2012.01.02 10:40:09 | 000,000,000 | ---D | M] -- C:\Users\Dani\AppData\Roaming\Windows Live Writer
[2012.01.10 12:56:25 | 000,026,208 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.12.21 16:10:14 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.12.21 23:07:50 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 14:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.01.21 03:32:31 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.01.02 10:57:06 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.04 17:20:37 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.01.10 13:33:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.12.21 16:04:02 | 000,000,000 | R--D | M] -- C:\Users
[2012.01.10 12:55:14 | 000,000,000 | ---D | M] -- C:\Windows
[2009.02.24 11:25:44 | 000,000,000 | ---D | M] -- C:\works8.5_dutch
[2009.02.24 11:31:15 | 000,000,000 | ---D | M] -- C:\works8.5_english
[2009.02.24 11:39:00 | 000,000,000 | ---D | M] -- C:\works8.5_french
[2009.02.24 11:47:28 | 000,000,000 | ---D | M] -- C:\works8.5_german
[2009.02.24 11:19:35 | 000,000,000 | ---D | M] -- C:\works8.5_polish
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\drivers\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_51b95d75\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.21 03:23:01 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 10:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_b12d8e84\atapi.sys
[2009.04.11 07:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.21 03:23:00 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 10:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2008.01.21 03:24:24 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\drivers\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.21 03:23:23 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 10:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\System32\netlogon.dll
[2009.04.11 07:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.21 03:24:05 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 10:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\drivers\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.21 03:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: NVSTOR32.SYS  >
[2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\drivers\nvstor32.sys
[2008.06.07 18:13:10 | 000,145,440 | ---- | M] (NVIDIA Corporation) MD5=D05F6E26AC960474494356FE703D61BE -- C:\Windows\System32\DriverStore\FileRepository\nvstor32.inf_2ced8b81\nvstor32.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:24:50 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\System32\scecli.dll
[2009.04.11 07:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:24:21 | 000,627,200 | ---- | M] (Microsoft Corporation) MD5=B974D9F06DC7D1908E825DC201681269 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2009.04.11 07:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.21 03:24:49 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 07:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:24:49 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.21 03:24:47 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2008.01.21 04:14:18 | 016,846,848 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2008.01.21 04:14:08 | 000,106,496 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2008.01.21 04:14:18 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 11:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 11:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2011.12.23 14:24:12 | 000,019,416 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\AccessibleMarshal.dll
[2011.12.23 14:24:17 | 000,000,057 | ---- | M] () -- C:\Users\Dani\active-update.xml
[2011.12.23 14:24:12 | 000,002,153 | ---- | M] () -- C:\Users\Dani\application.ini
[2011.12.17 02:19:04 | 000,011,263 | ---- | M] () -- C:\Users\Dani\blocklist.xml
[2011.12.17 02:33:26 | 000,000,036 | ---- | M] () -- C:\Users\Dani\chrome.manifest
[2011.12.17 02:32:55 | 000,000,706 | ---- | M] () -- C:\Users\Dani\crashreporter-override.ini
[2011.12.23 14:24:12 | 000,125,912 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\crashreporter.exe
[2011.12.17 02:32:56 | 000,004,284 | ---- | M] () -- C:\Users\Dani\crashreporter.ini
[2011.12.17 02:19:09 | 002,106,216 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\D3DCompiler_43.dll
[2011.12.17 02:19:09 | 001,998,168 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\d3dx9_43.dll
[2011.12.17 02:19:00 | 000,000,130 | ---- | M] () -- C:\Users\Dani\dependentlibs.list
[2011.12.23 14:24:12 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\firefox.exe
[2011.12.23 14:24:12 | 000,000,478 | ---- | M] () -- C:\Users\Dani\freebl3.chk
[2011.12.23 14:24:12 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\freebl3.dll
[2011.12.21 17:00:02 | 000,022,338 | ---- | M] () -- C:\Users\Dani\install.log
[2011.12.23 14:24:12 | 000,097,240 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libEGL.dll
[2011.12.23 14:24:12 | 000,486,360 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\libGLESv2.dll
[2011.12.17 02:19:03 | 000,001,869 | ---- | M] () -- C:\Users\Dani\Microsoft.VC80.CRT.manifest
[2011.12.23 14:24:11 | 000,015,832 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozalloc.dll
[2011.12.23 14:24:11 | 002,124,760 | ---- | M] () -- C:\Users\Dani\mozjs.dll
[2011.12.23 14:24:11 | 000,814,040 | ---- | M] (sqlite.org) -- C:\Users\Dani\mozsqlite3.dll
[2011.12.23 14:24:11 | 000,043,992 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\mozutils.dll
[2011.12.17 02:19:03 | 000,479,232 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcm80.dll
[2011.12.17 02:19:03 | 000,548,864 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcp80.dll
[2011.12.17 02:19:03 | 000,626,688 | ---- | M] (Microsoft Corporation) -- C:\Users\Dani\msvcr80.dll
[2011.12.23 14:24:11 | 000,187,352 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nspr4.dll
[2011.12.23 14:24:11 | 000,646,104 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nss3.dll
[2011.12.23 14:24:11 | 000,371,672 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssckbi.dll
[2011.12.23 14:24:11 | 000,000,478 | ---- | M] () -- C:\Users\Dani\nssdbm3.chk
[2011.12.23 14:24:11 | 000,109,528 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssdbm3.dll
[2011.12.23 14:24:11 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\nssutil3.dll
[2012.01.10 13:45:40 | 001,310,720 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT
[2012.01.10 13:45:40 | 000,262,144 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG1
[2011.12.21 16:04:02 | 000,000,000 | -H-- | M] () -- C:\Users\Dani\ntuser.dat.LOG2
[2012.01.10 12:56:29 | 000,065,536 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf
[2012.01.10 12:56:29 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms
[2011.12.21 16:11:09 | 000,524,288 | -HS- | M] () -- C:\Users\Dani\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000002.regtrans-ms
[2011.12.21 16:04:02 | 000,000,020 | -HS- | M] () -- C:\Users\Dani\ntuser.ini
[2011.12.23 14:24:11 | 005,642,801 | ---- | M] () -- C:\Users\Dani\omni.jar
[2011.12.23 14:24:10 | 000,000,141 | ---- | M] () -- C:\Users\Dani\platform.ini
[2011.12.23 14:24:10 | 000,021,976 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plc4.dll
[2011.12.23 14:24:10 | 000,020,440 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\plds4.dll
[2011.12.23 14:24:10 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Users\Dani\plugin-container.exe
[2011.12.23 14:24:10 | 000,002,723 | ---- | M] () -- C:\Users\Dani\precomplete
[2011.12.17 00:42:10 | 000,034,427 | ---- | M] () -- C:\Users\Dani\removed-files
[2011.12.23 14:24:10 | 000,105,432 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\smime3.dll
[2011.12.23 14:24:10 | 000,000,478 | ---- | M] () -- C:\Users\Dani\softokn3.chk
[2011.12.23 14:24:10 | 000,170,968 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\softokn3.dll
[2011.12.23 14:24:10 | 000,154,584 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\ssl3.dll
[2011.12.17 02:33:21 | 000,000,003 | ---- | M] () -- C:\Users\Dani\update.locale
[2011.12.23 14:24:10 | 000,269,272 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\updater.exe
[2011.12.17 02:33:22 | 000,000,701 | ---- | M] () -- C:\Users\Dani\updater.ini
[2011.12.23 14:24:18 | 000,001,457 | ---- | M] () -- C:\Users\Dani\updates.xml
[2011.12.23 14:24:10 | 000,019,928 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xpcom.dll
[2011.12.23 14:24:10 | 016,096,216 | ---- | M] (Mozilla Foundation) -- C:\Users\Dani\xul.dll
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
<          >

< End of report >



und die Extras.txt datei.




Code:
OTL Extras logfile created on: 10.01.2012 13:32:17 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Dani\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19170)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,75 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 66,54% Memory free
5,73 Gb Paging File | 4,75 Gb Available in Paging File | 82,95% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 117,18 Gb Total Space | 75,28 Gb Free Space | 64,24% Space Free | Partition Type: NTFS
Drive D: | 160,07 Gb Total Space | 127,34 Gb Free Space | 79,55% Space Free | Partition Type: NTFS
 
Computer Name: DANI-LAPTOP | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Users\Dani\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E555093-4A6A-486C-99F7-EE088F62E15E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{28AFFCC5-50B4-468B-9576-44B0CE78BAB2}" = rport=137 | protocol=17 | dir=out | app=system |
"{31C47179-2452-4111-AF2F-26B32701D3D3}" = rport=139 | protocol=6 | dir=out | app=system |
"{4E8054E0-1813-4488-BC12-EC8769096DDD}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{536A78E0-F512-45B8-A4C0-80A4D41F9CF9}" = lport=138 | protocol=17 | dir=in | app=system |
"{9C54A3AF-B4E3-4625-9F81-8E05E46E366F}" = lport=139 | protocol=6 | dir=in | app=system |
"{AF7B4B2D-91F1-4F32-954A-D19BABC785B2}" = lport=137 | protocol=17 | dir=in | app=system |
"{B3D93FBB-ACAA-416C-90C0-3F4B2AFC2785}" = rport=445 | protocol=6 | dir=out | app=system |
"{D7135758-6D82-47D2-82CF-E91651C2C4B4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{E177A86B-BE9A-4901-A9EB-D7E40C04FBF5}" = lport=445 | protocol=6 | dir=in | app=system |
"{E3D44108-8F0B-41A8-97E7-366CA48513BA}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{F79AEBFD-0BC8-44D3-A8BC-296E8E78B4AE}" = rport=138 | protocol=17 | dir=out | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0352013A-D4D4-4477-8B6A-8E174C624B43}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{06346BB0-1067-4DDC-8238-2EA398C0536F}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{1671EF7E-F980-4F87-87BF-6A23E455994F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{1914A68E-4B00-4BEB-B1B4-B3D2CA4533CE}" = protocol=6 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{1C7111FC-37E0-4D11-9389-52D95048FDCD}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{64DB1840-E22A-44DD-9905-E575F563EE9C}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{8172F516-4DFB-4770-B928-95120A9A961E}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{8EFA82F5-64A1-4FBA-9249-962E345B7212}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{AF643D27-7E94-46DA-B44A-80BC81784B07}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{B8335073-989A-498F-A3A8-D0AE8FAB7F54}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E00204C6-C11A-43D4-82AE-4BD835339E44}" = protocol=17 | dir=in | app=c:\program files\icq7.7\icq.exe |
"{E7FDC54A-A88B-4652-A031-80268216450B}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{0A35B15C-9CCD-4C0C-BD5B-34ABF8C95813}_is1" = ICQ 7.6 Build #5618 Banner Remover 1.0
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Atheros Client Installation Program
"{2B11BA9C-7F97-4C16-970F-1491FD77969B}_is1" = GutscheinRausch.de - AddOn für Firefox
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = USB 2.0 Camera
"{415B2719-AD3A-4944-B404-C472DB6085B3}" = Cisco EAP-FAST Module
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{669C7BD8-DAA2-49B6-966C-F1E2AAE6B17E}" = Cisco PEAP Module
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}" = ICQ7.7
"{83770D14-21B9-44B3-8689-F7B523F94560}" = Cisco LEAP Module
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1504C77-1B19-4AF0-8DEC-946666123B55}" = CrazyTalk Cam Suite
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump 1.0.1.8
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Avira AntiVir Desktop" = Avira Free Antivirus
"DesktopIconAmazon" = Desktop Icon für Amazon
"EPSON Scanner" = EPSON Scan
"EPSON SX218 Series" = Druckerdeinstallation für EPSON SX218 Series
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Guard.Mail.ru" = Guard.ICQ
"ICQToolbar" = ICQ Toolbar
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 9.0 (x86 de)" = Mozilla Firefox 9.0 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4B35F00C-E63D-40DC-9839-DF15A33EAC46}" = Grand Theft Auto Vice City
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 23.12.2011 14:40:40 | Computer Name = Dani-Laptop | Source = Avira Antivirus | ID = 4122
Description = Die Datei avreg.dll konnte nicht geladen werden.  Fehlercode: 0x2
 
Error - 23.12.2011 14:41:38 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 24.12.2011 15:35:45 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 25.12.2011 16:49:33 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 27.12.2011 09:03:23 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 29.12.2011 08:46:46 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 30.12.2011 06:35:48 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 30.12.2011 17:07:17 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 31.12.2011 05:48:40 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
Error - 31.12.2011 08:04:35 | Computer Name = Dani-Laptop | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 07.01.2012 13:21:47 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description =
 
Error - 07.01.2012 19:26:24 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 07.01.2012 20:19:21 | Computer Name = Dani-Laptop | Source = Service Control Manager | ID = 7011
Description =
 
Error - 08.01.2012 07:20:01 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 08.01.2012 13:52:03 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 09.01.2012 08:35:45 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 09.01.2012 11:20:06 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 09.01.2012 11:22:07 | Computer Name = Dani-Laptop | Source = DCOM | ID = 10010
Description =
 
Error - 10.01.2012 07:55:18 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
Error - 10.01.2012 07:58:33 | Computer Name = Dani-Laptop | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
 
 
< End of report >


ich hoffe ihr könnt mir weiterhelfen :)

Willow1989 10.01.2012 15:51
Kann mir den keiner Helfen? :(

markusg 10.01.2012 16:17
hi
bist du der einzige hier?
sieht nicht so aus oder...
wir machen das hier alles komplett kostenlos für euch, also sollte man sich evtl. auch mal gedulden, oder du musst in ein geschäft gehen und geld für schnellere hilfe zahlen.
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [{2AF18ADA-2C2E-11E1-AD9B-806E6F6E6963}] C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe (Xiph.Org)
 :Files
C:\Users\Dani\AppData\Roaming\Microsoft\loadhst.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

Willow1989 16.01.2012 10:28
vielen dank aber da ich so verzweifelt war da ich den Laptop auch für die Arbeit brauchte hab ich alle themen durch gelesen bezüglich dieses virus und hab das nun so gelöst.


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:18 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131