Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Auf www.Downloads.de reingefallen (https://www.trojaner-board.de/108723-www-downloads-de-reingefallen.html)

Blackside 29.01.2012 11:25
Auf www.Downloads.de reingefallen
 
Hallo zusammen. Ich habe mir gestern was bei Downloads.de runtergeladen. Als ich es ausführen wollte ist nichts passiert ausser das der Rechner stark gearbeitet hat. Ich habe bereits mein Avast, Anti malwarebytes (Quick Scan) , Blacklight laufen lassen ohne Erfolg. Im Forum habe ich dann Gmer gefunden und wenn ich das laufen lasse kommt mit einmal der Bluescreen auch im abgesicherten Modus. Was kann ich noch tun?

Blackside 29.01.2012 12:44
OTL Extras logfile created on: 29.01.2012 11:53:29 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Blackside\Downloads
Windows Vista Ultimate Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

1014,63 Mb Total Physical Memory | 496,54 Mb Available Physical Memory | 48,94% Memory free
2,23 Gb Paging File | 1,44 Gb Available in Paging File | 64,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 79,99 Gb Total Space | 25,31 Gb Free Space | 31,64% Space Free | Partition Type: NTFS
Drive D: | 61,20 Gb Total Space | 24,49 Gb Free Space | 40,02% Space Free | Partition Type: NTFS
Drive F: | 61,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS

Computer Name: BLACKSIDE-PC | User Name: Blackside | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DisabledInterfaces" = {34122C24-ED60-4B0C-A042-DFF966CEF195}

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

========== Authorized Applications List ==========


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{281FA940-D7B6-4C83-A614-9B216F58941C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{695CD87C-94F5-4E70-93A1-F80343013AFA}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{80114C69-7792-406D-963B-4F0122BAC66C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{82C95B15-0715-4FAB-9BE0-112C86EBD3A7}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{9F1EB90D-CF0E-455C-9203-2F739786E503}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{A9D065BF-2363-4BDE-83C3-432AF494055C}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{AF9BC516-B45C-43CE-B2C3-5FC1558EA142}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{B04E0102-80D6-46D3-B90F-5F2C22DA9B11}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{C695D830-2AF3-462F-8EAA-641D10DD9CC3}" = rport=2869 | protocol=6 | dir=out | app=system |
"{C8FBF176-050E-4039-986B-D90A6F5E0BB0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DA4D01A6-B503-4187-B3A3-2952BD578DDA}" = lport=9089 | protocol=6 | dir=in | name=vmware vcenter converter standalone - agent |
"{EC3B1C63-C400-4051-A16B-AC7C3E62CC10}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{FB322CA7-23AF-4378-96E8-AB3E0F82876C}" = lport=2869 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{28BBCA87-AA70-40CF-B12D-9C3C4199D831}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{2FCD85D8-65DB-45E9-80BD-54FCF7DE64BC}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{3B78178C-7DC1-491B-A155-9AA774AFA427}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer.exe |
"{9221F71D-1520-493F-ADC0-2A5B7B9482F8}" = protocol=17 | dir=in | app=c:\windows\system32\muzapp.exe |
"{9BBE9086-5B3C-4DB2-9DA8-E076A7AC3920}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AA851C8E-E49C-4D39-A938-CE4FFEBBA5F2}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{B2CD06E2-342B-40D1-AB2A-206EB94B2F71}" = protocol=17 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{C2D76771-AE8C-481A-A40E-3C1139F4717A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D973C7EC-8DD4-4E3E-AF28-E471B24E04C3}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{F11DF7E0-C989-42E5-87FC-D5CF7A136A6F}" = protocol=6 | dir=in | app=c:\program files\bittorrent\bittorrent.exe |
"{F3982F26-2769-477D-BB09-2CC3D93BAB7C}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version7\teamviewer_service.exe |
"{FF407E48-4B09-46C3-B840-1EB5128FC3B6}" = protocol=6 | dir=in | app=c:\windows\system32\muzapp.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02BFF1A3-A0D5-4F64-8558-A22682BCDA58}" = ActivePerl 5.14.2 Build 1402
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216030FF}" = Java(TM) 6 Update 30
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{C656142F-EFE1-44CD-BFAD-6CBC6DCB9860}" = Vodafone Mobile Connect Lite
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}" = COMODO Internet Security
"{EDF0C1D5-D980-48F9-BA19-0ECEDEF8C5D4}" = VMware vCenter Converter Standalone
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"avast" = avast! Free Antivirus
"BitTorrent" = BitTorrent
"Comodo Dragon" = Comodo Dragon
"COMODO GeekBuddy" = COMODO GeekBuddy
"ie7" = Windows Internet Explorer 7
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)
"NoIPDUC" = No-IP DUC
"TeamViewer 7" = TeamViewer 7
"Trojan Remover_is1" = Trojan Remover 6.8.2
"VLC media player" = VLC media player 1.1.11
"WinRAR archiver" = WinRAR 4.01 (32-Bit)

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 28.01.2012 05:59:01 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 07:18:48 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 07:55:12 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 08:23:40 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 09:12:34 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 11:02:51 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 28.01.2012 15:23:24 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 29.01.2012 03:48:06 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

Error - 29.01.2012 06:10:00 | Computer Name = Blackside-PC | Source = EventSystem | ID = 4609
Description =

Error - 29.01.2012 06:13:34 | Computer Name = Blackside-PC | Source = VMCService | ID = 0
Description = conflictManagerTypeValue

[ System Events ]
Error - 29.01.2012 06:09:28 | Computer Name = Blackside-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 29.01.2012 um 11:07:16 unerwartet heruntergefahren.

Error - 29.01.2012 06:09:51 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:00 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:02 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:02 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:02 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:36 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:10:36 | Computer Name = Blackside-PC | Source = DCOM | ID = 10005
Description =

Error - 29.01.2012 06:12:26 | Computer Name = Blackside-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 29.01.2012 um 11:10:50 unerwartet heruntergefahren.

Error - 29.01.2012 06:16:04 | Computer Name = Blackside-PC | Source = ipnathlp | ID = 31004
Description = 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet
werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner

Blackside 29.01.2012 12:45
OTL Logfile:
Code:
OTL logfile created on: 29.01.2012 11:53:29 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Blackside\Downloads
Windows Vista Ultimate Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,63 Mb Total Physical Memory | 496,54 Mb Available Physical Memory | 48,94% Memory free
2,23 Gb Paging File | 1,44 Gb Available in Paging File | 64,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 79,99 Gb Total Space | 25,31 Gb Free Space | 31,64% Space Free | Partition Type: NTFS
Drive D: | 61,20 Gb Total Space | 24,49 Gb Free Space | 40,02% Space Free | Partition Type: NTFS
Drive F: | 61,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: BLACKSIDE-PC | User Name: Blackside | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.29 11:49:39 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Blackside\Downloads\OTL.exe
PRC - [2012.01.29 11:46:15 | 000,050,477 | ---- | M] () -- C:\Users\Blackside\Downloads\Defogger.exe
PRC - [2011.12.21 00:41:44 | 006,676,808 | ---- | M] (COMODO) -- C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
PRC - [2011.12.19 18:59:00 | 001,960,584 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2011.12.09 18:06:13 | 010,979,712 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer.exe
PRC - [2011.12.09 18:06:13 | 002,983,808 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2011.12.09 17:45:46 | 000,116,608 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\tv_w32.exe
PRC - [2011.11.28 19:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011.11.23 11:27:04 | 001,052,472 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
PRC - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
PRC - [2011.08.19 20:32:40 | 000,423,536 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe
PRC - [2011.07.13 09:38:22 | 000,224,680 | ---- | M] () -- C:\Windows\System32\AsusService.exe
PRC - [2009.09.11 11:34:22 | 002,403,840 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2009.09.11 11:33:54 | 000,009,216 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2008.09.02 19:28:14 | 000,106,496 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsTray.exe
PRC - [2008.05.21 00:56:24 | 000,094,208 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsEPCMon.exe
PRC - [2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2006.11.02 10:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.29 11:46:15 | 000,050,477 | ---- | M] () -- C:\Users\Blackside\Downloads\Defogger.exe
MOD - [2011.10.03 11:11:23 | 000,815,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\8fbca0140921ed343cb511595869a0ed\System.Runtime.Remoting.ni.dll
MOD - [2006.11.02 16:45:45 | 000,430,080 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2006.11.02 16:45:39 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2006.11.02 14:07:01 | 001,060,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\3fe3f7ba542ab78e52e49d19640a7e64\System.Management.ni.dll
MOD - [2006.11.02 13:55:54 | 000,684,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\b9588344b72703e9c361bd47d87cccf9\System.Transactions.ni.dll
MOD - [2006.11.02 13:55:53 | 006,656,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\7812c95c325062211532c560b59da6b3\System.Data.ni.dll
MOD - [2006.11.02 13:55:20 | 013,148,160 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\35a9f19f21aac42b979be321f1bb5fd4\System.Windows.Forms.ni.dll
MOD - [2006.11.02 13:55:03 | 001,617,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\70c145ed25af403aa899ffcb633350b1\System.Drawing.ni.dll
MOD - [2006.11.02 13:55:01 | 000,729,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\957e7148d00445fc475dd31923bb271d\System.Security.ni.dll
MOD - [2006.11.02 13:54:55 | 005,619,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f76a7622c73e26e4d2daf54068d7ff79\System.Xml.ni.dll
MOD - [2006.11.02 13:54:48 | 001,003,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\d7b63c1d2ab17ac3cc24881c4ff78b63\System.Configuration.ni.dll
MOD - [2006.11.02 13:54:47 | 000,229,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\61b951bd03727a096c1c02cb18d5ce30\System.ServiceProcess.ni.dll
MOD - [2006.11.02 13:53:55 | 008,151,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\fcc712bc5da45a672e7f1ad176dbd5a5\System.ni.dll
MOD - [2006.11.02 13:53:45 | 011,628,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7fe79782947b85d961fd55cb5e02a129\mscorlib.ni.dll
MOD - [2006.11.02 10:46:09 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2006.10.20 02:14:53 | 000,260,096 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2006.10.20 02:14:47 | 002,894,336 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.19 18:59:00 | 001,960,584 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2011.12.09 18:06:13 | 002,983,808 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.11.23 11:27:04 | 001,052,472 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
SRV - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe -- (vmware-converter-worker)
SRV - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe -- (vmware-converter-server)
SRV - [2011.08.19 20:32:40 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe -- (vmware-converter-agent)
SRV - [2011.07.13 09:38:22 | 000,224,680 | ---- | M] () [Auto | Running] -- C:\Windows\System32\AsusService.exe -- (AsusService)
SRV - [2008.07.04 12:52:18 | 000,014,336 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2007.07.11 04:17:02 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.01.17 22:00:31 | 000,491,816 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2011.12.19 18:59:06 | 000,082,400 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)
DRV - [2011.12.19 18:59:06 | 000,038,616 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2011.12.19 14:12:00 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011.10.27 02:25:54 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011.10.27 02:25:54 | 000,078,136 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2011.07.12 09:36:28 | 000,022,768 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vstor2-mntapi10-shared.sys -- (vstor2-mntapi10-shared) Vstor2 MntApi 1.0 Driver (shared)
DRV - [2011.03.15 01:38:14 | 000,054,384 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bmdrvr.sys -- (bmdrvr)
DRV - [2011.02.09 15:03:00 | 000,011,832 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)
DRV - [2008.03.17 10:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.07.26 20:00:38 | 000,011,264 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASUSACPI.SYS -- (AsusACPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.01.22 20:25:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.10 09:28:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.01.10 09:29:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blackside\AppData\Roaming\mozilla\Extensions
[2012.01.10 09:54:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blackside\AppData\Roaming\mozilla\Firefox\Profiles\pm240uoo.default\extensions
[2012.01.10 14:54:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.10 14:54:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2012.01.22 20:25:29 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
() (No name found) -- C:\USERS\BLACKSIDE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PM240UOO.DEFAULT\EXTENSIONS\UACONTROL@QZ.TSUGUMI.ORG.XPI
[2011.12.21 08:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.12.21 06:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.21 06:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.12.21 06:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.21 06:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 06:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.21 06:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Blackside\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: avast! WebRep = C:\Users\Blackside\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1374_0\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Blackside\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
 
O1 HOSTS File: ([2012.01.28 14:16:43 | 000,000,894 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [AsusACPIServer] C:\Programme\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Programme\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Programme\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34122C24-ED60-4B0C-A042-DFF966CEF195}: NameServer = 139.7.30.125 139.7.30.126
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) -C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Blackside\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Blackside\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.07.07 19:45:59 | 000,000,113 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{47fa26d4-ed0e-11e0-ac0e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{47fa26d4-ed0e-11e0-ac0e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{47fa277d-ed0e-11e0-ac0e-c6e3a63591ae}\Shell - "" = AutoRun
O33 - MountPoints2\{47fa277d-ed0e-11e0-ac0e-c6e3a63591ae}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.14 23:36:11 | 000,323,584 | R--- | M] (Vodafone)
O33 - MountPoints2\{75666955-f812-11e0-b521-da84024150b7}\Shell - "" = AutoRun
O33 - MountPoints2\{75666955-f812-11e0-b521-da84024150b7}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{aff7ec7e-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = H:\PMBP_Win.exe
O33 - MountPoints2\{aff7ec92-eda2-11e0-9ce2-86093c6cc5b3}\Shell - "" = AutoRun
O33 - MountPoints2\{aff7ec92-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{aff7ec94-eda2-11e0-9ce2-86093c6cc5b3}\Shell - "" = AutoRun
O33 - MountPoints2\{aff7ec94-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.14 23:36:11 | 000,323,584 | R--- | M] (Vodafone)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.29 11:09:16 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.29 09:03:33 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Malwarebytes
[2012.01.29 09:03:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.28 14:46:22 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Vitalwerks
[2012.01.28 14:45:49 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC
[2012.01.28 14:45:45 | 000,000,000 | ---D | C] -- C:\Program Files\No-IP
[2012.01.28 14:15:47 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.01.28 14:08:09 | 000,000,000 | ---D | C] -- C:\Users\Blackside\Documents\Simply Super Software
[2012.01.28 14:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Simply Super Software
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.01.28 13:26:47 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\TeamViewer
[2012.01.28 13:14:57 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Comodo
[2012.01.28 12:55:46 | 000,000,000 | ---D | C] -- C:\ProgramData\CPA_VA
[2012.01.28 12:54:34 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2012.01.28 12:47:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012.01.28 12:47:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2012.01.28 12:47:40 | 000,000,000 | ---D | C] -- C:\Program Files\Comodo
[2012.01.27 19:16:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
[2012.01.27 19:13:38 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\VMware
[2012.01.27 19:13:37 | 000,000,000 | ---D | C] -- C:\Program Files\VMware
[2012.01.27 19:11:15 | 000,000,000 | ---D | C] -- C:\ProgramData\VMware
[2012.01.23 01:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\BitTorrent
[2012.01.23 01:46:57 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\BitTorrent
[2012.01.22 20:12:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.01.22 20:11:59 | 000,314,456 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.01.22 20:11:59 | 000,020,568 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.01.22 20:11:56 | 000,052,952 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.01.22 20:11:56 | 000,034,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2012.01.22 20:11:55 | 000,435,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.01.22 20:11:54 | 000,055,128 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.01.22 20:11:24 | 000,199,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.01.22 20:11:24 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.01.16 17:50:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Vodafone
[2012.01.16 17:50:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vodafone
[2012.01.16 17:49:43 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone
[2012.01.16 03:01:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.01.10 14:55:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.01.10 14:55:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.01.10 14:53:51 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.01.10 09:29:05 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Mozilla
[2012.01.10 09:29:05 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Mozilla
[2012.01.10 09:28:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.01.07 09:07:01 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2012.01.06 17:27:56 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoft
[2012.01.06 17:27:42 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.01.02 18:04:17 | 000,000,000 | ---D | C] -- C:\Users\Blackside\VirtualBox VMs
[2012.01.02 17:52:46 | 000,000,000 | ---D | C] -- C:\Backtrack5
[2012.01.02 17:52:23 | 000,000,000 | ---D | C] -- C:\Users\Blackside\.VirtualBox
[2012.01.02 17:43:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.29 11:48:15 | 000,000,000 | ---- | M] () -- C:\Users\Blackside\defogger_reenable
[2012.01.29 11:22:02 | 000,001,136 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-808284525-1462833005-2160499395-1000UA.job
[2012.01.29 11:13:46 | 000,000,439 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.01.29 11:12:47 | 000,000,680 | ---- | M] () -- C:\Users\Blackside\AppData\Local\d3d9caps.dat
[2012.01.29 11:12:38 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.29 11:12:37 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.29 11:12:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.29 11:12:14 | 112,106,737 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.01.28 21:31:48 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.28 14:16:43 | 000,000,894 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.01.28 12:48:36 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.01.28 12:47:58 | 000,001,040 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.01.28 12:47:45 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.01.28 12:23:21 | 000,013,312 | ---- | M] () -- C:\Users\Blackside\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.28 12:21:32 | 000,002,582 | ---- | M] () -- C:\Users\Blackside\Documents\Sybille.pfx
[2012.01.27 19:16:28 | 000,001,166 | ---- | M] () -- C:\Users\Public\Desktop\VMware vCenter Converter Standalone Client.lnk
[2012.01.27 19:16:27 | 000,001,024 | ---- | M] () -- C:\.rnd
[2012.01.23 07:22:00 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-808284525-1462833005-2160499395-1000Core.job
[2012.01.22 20:25:30 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.01.22 10:25:17 | 000,650,896 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.22 10:25:17 | 000,618,548 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.22 10:25:17 | 000,119,940 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.22 10:25:17 | 000,106,332 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.17 22:00:31 | 000,491,816 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdGuard.sys
[2012.01.16 06:07:27 | 000,029,528 | ---- | M] () -- C:\Users\Blackside\Documents\cc_20120116_060656.reg
[2012.01.16 05:22:58 | 000,000,000 | ---- | M] () -- C:\Windows\Path.idx
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.29 11:48:15 | 000,000,000 | ---- | C] () -- C:\Users\Blackside\defogger_reenable
[2012.01.29 11:08:52 | 112,106,737 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.01.28 14:07:48 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2012.01.28 14:07:47 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2012.01.28 14:07:47 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2012.01.28 14:07:47 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2012.01.28 12:48:36 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.01.28 12:47:58 | 000,001,040 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.01.28 12:47:45 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.01.28 12:21:18 | 000,002,582 | ---- | C] () -- C:\Users\Blackside\Documents\Sybille.pfx
[2012.01.27 19:16:28 | 000,001,166 | ---- | C] () -- C:\Users\Public\Desktop\VMware vCenter Converter Standalone Client.lnk
[2012.01.27 19:16:17 | 000,001,024 | ---- | C] () -- C:\.rnd
[2012.01.16 06:07:03 | 000,029,528 | ---- | C] () -- C:\Users\Blackside\Documents\cc_20120116_060656.reg
[2012.01.16 05:22:27 | 000,000,000 | ---- | C] () -- C:\Windows\Path.idx
[2012.01.07 09:07:28 | 000,000,974 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7.lnk
[2011.11.27 16:37:47 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2011.11.27 15:12:28 | 000,011,832 | ---- | C] () -- C:\Windows\System32\drivers\AsUpIO.sys
[2011.11.27 15:12:27 | 000,224,680 | ---- | C] () -- C:\Windows\System32\AsusService.exe
[2011.10.22 09:36:45 | 000,013,312 | ---- | C] () -- C:\Users\Blackside\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.02 12:45:44 | 000,000,552 | ---- | C] () -- C:\Users\Blackside\AppData\Local\d3d8caps.dat
[2011.10.02 12:37:13 | 000,000,680 | ---- | C] () -- C:\Users\Blackside\AppData\Local\d3d9caps.dat
[2011.09.16 10:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 10:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.09.16 10:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.09.16 10:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.09.16 10:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2008.07.30 19:31:52 | 000,021,864 | ---- | C] () -- C:\Windows\AsAcpiSvrLang.ini
[2008.06.23 13:02:02 | 000,097,410 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2008.05.23 17:48:50 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml
[2008.03.17 15:54:36 | 000,012,208 | ---- | C] () -- C:\Windows\AsTrayLang.ini
[2006.11.02 16:48:52 | 000,650,896 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:48:52 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:48:52 | 000,119,940 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:48:52 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:55:52 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:46:27 | 000,228,840 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:34:29 | 000,063,488 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2006.11.02 13:34:23 | 000,080,010 | ---- | C] () -- C:\Windows\System32\manage-bde.ini.en
[2006.11.02 13:34:20 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,618,548 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,106,332 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 08:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 08:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
 
========== LOP Check ==========
 
[2011.11.29 15:25:54 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\ActiveState
[2012.01.23 01:59:04 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\BitTorrent
[2012.01.06 17:28:01 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoft
[2012.01.06 17:27:42 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.22 09:09:27 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Samsung
[2012.01.28 14:07:21 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Simply Super Software
[2012.01.28 13:26:47 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\TeamViewer
[2011.10.02 16:56:44 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Vodafone
[2012.01.28 21:31:46 | 000,032,590 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.10.02 12:37:45 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.01.02 18:06:57 | 000,000,000 | ---D | M] -- C:\Backtrack5
[2009.08.08 10:17:37 | 000,000,000 | ---D | M] -- C:\bb0c208a7f0f032f2b742c7d
[2011.10.02 12:51:08 | 000,000,000 | -HSD | M] -- C:\Boot
[2012.01.28 12:51:26 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2006.11.02 14:00:38 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.10.02 02:06:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2010.11.15 22:15:53 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft
[2008.08.11 16:57:31 | 000,000,000 | ---D | M] -- C:\Intel
[2011.11.29 15:07:49 | 000,000,000 | ---D | M] -- C:\Perl
[2012.01.29 11:08:06 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.29 09:03:18 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.01.22 07:37:30 | 000,000,000 | R--D | M] -- C:\Programme
[2010.10.16 16:37:35 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012.01.29 11:58:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.10.22 09:33:49 | 000,000,000 | ---D | M] -- C:\Temp
[2011.10.02 12:37:09 | 000,000,000 | R--D | M] -- C:\Users
[2009.09.03 10:39:54 | 000,000,000 | -HSD | M] -- C:\USMT.TMP
[2012.01.29 11:12:14 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2006.11.02 09:58:43 | 000,270,336 | ---- | M] (Microsoft Corporation) MD5=5D24CAF8EFD924A875698FF28384DB8B -- C:\Windows\System32\drivers\afd.sys
[2006.11.02 09:58:43 | 000,270,336 | ---- | M] (Microsoft Corporation) MD5=5D24CAF8EFD924A875698FF28384DB8B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6000.16386_none_d5b1809661820e7c\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\regedit.exe
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
--- --- ---

Blackside 29.01.2012 12:47
OTL Logfile:
Code:
OTL logfile created on: 29.01.2012 11:53:29 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Users\Blackside\Downloads
Windows Vista Ultimate Edition  (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,63 Mb Total Physical Memory | 496,54 Mb Available Physical Memory | 48,94% Memory free
2,23 Gb Paging File | 1,44 Gb Available in Paging File | 64,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 79,99 Gb Total Space | 25,31 Gb Free Space | 31,64% Space Free | Partition Type: NTFS
Drive D: | 61,20 Gb Total Space | 24,49 Gb Free Space | 40,02% Space Free | Partition Type: NTFS
Drive F: | 61,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: BLACKSIDE-PC | User Name: Blackside | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.01.29 11:49:39 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Blackside\Downloads\OTL.exe
PRC - [2012.01.29 11:46:15 | 000,050,477 | ---- | M] () -- C:\Users\Blackside\Downloads\Defogger.exe
PRC - [2011.12.21 00:41:44 | 006,676,808 | ---- | M] (COMODO) -- C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
PRC - [2011.12.19 18:59:00 | 001,960,584 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2011.12.09 18:06:13 | 010,979,712 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer.exe
PRC - [2011.12.09 18:06:13 | 002,983,808 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe
PRC - [2011.12.09 17:45:46 | 000,116,608 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version7\tv_w32.exe
PRC - [2011.11.28 19:01:24 | 003,744,552 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2011.11.23 11:27:04 | 001,052,472 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe
PRC - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe
PRC - [2011.08.19 20:32:40 | 000,423,536 | ---- | M] (VMware, Inc.) -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe
PRC - [2011.07.13 09:38:22 | 000,224,680 | ---- | M] () -- C:\Windows\System32\AsusService.exe
PRC - [2009.09.11 11:34:22 | 002,403,840 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe
PRC - [2009.09.11 11:33:54 | 000,009,216 | ---- | M] (Vodafone) -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe
PRC - [2008.09.02 19:28:14 | 000,106,496 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsTray.exe
PRC - [2008.05.21 00:56:24 | 000,094,208 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Programme\EeePC\ACPI\AsEPCMon.exe
PRC - [2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2006.11.02 10:44:59 | 000,068,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.01.29 11:46:15 | 000,050,477 | ---- | M] () -- C:\Users\Blackside\Downloads\Defogger.exe
MOD - [2011.10.03 11:11:23 | 000,815,104 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\8fbca0140921ed343cb511595869a0ed\System.Runtime.Remoting.ni.dll
MOD - [2006.11.02 16:45:45 | 000,430,080 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2006.11.02 16:45:39 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2006.11.02 14:07:01 | 001,060,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\3fe3f7ba542ab78e52e49d19640a7e64\System.Management.ni.dll
MOD - [2006.11.02 13:55:54 | 000,684,032 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\b9588344b72703e9c361bd47d87cccf9\System.Transactions.ni.dll
MOD - [2006.11.02 13:55:53 | 006,656,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\7812c95c325062211532c560b59da6b3\System.Data.ni.dll
MOD - [2006.11.02 13:55:20 | 013,148,160 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\35a9f19f21aac42b979be321f1bb5fd4\System.Windows.Forms.ni.dll
MOD - [2006.11.02 13:55:03 | 001,617,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\70c145ed25af403aa899ffcb633350b1\System.Drawing.ni.dll
MOD - [2006.11.02 13:55:01 | 000,729,088 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Security\957e7148d00445fc475dd31923bb271d\System.Security.ni.dll
MOD - [2006.11.02 13:54:55 | 005,619,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\f76a7622c73e26e4d2daf54068d7ff79\System.Xml.ni.dll
MOD - [2006.11.02 13:54:48 | 001,003,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\d7b63c1d2ab17ac3cc24881c4ff78b63\System.Configuration.ni.dll
MOD - [2006.11.02 13:54:47 | 000,229,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\61b951bd03727a096c1c02cb18d5ce30\System.ServiceProcess.ni.dll
MOD - [2006.11.02 13:53:55 | 008,151,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\fcc712bc5da45a672e7f1ad176dbd5a5\System.ni.dll
MOD - [2006.11.02 13:53:45 | 011,628,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\7fe79782947b85d961fd55cb5e02a129\mscorlib.ni.dll
MOD - [2006.11.02 10:46:09 | 000,364,544 | ---- | M] () -- C:\Windows\System32\msjetoledb40.dll
MOD - [2006.10.20 02:14:53 | 000,260,096 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
MOD - [2006.10.20 02:14:47 | 002,894,336 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.12.19 18:59:00 | 001,960,584 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2011.12.09 18:06:13 | 002,983,808 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011.11.28 19:01:23 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2011.11.23 11:27:04 | 001,052,472 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLS.exe -- (CLPSLS)
SRV - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe -- (vmware-converter-worker)
SRV - [2011.08.19 20:51:48 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter.exe -- (vmware-converter-server)
SRV - [2011.08.19 20:32:40 | 000,423,536 | ---- | M] (VMware, Inc.) [Auto | Running] -- C:\Program Files\VMware\VMware vCenter Converter Standalone\vmware-converter-a.exe -- (vmware-converter-agent)
SRV - [2011.07.13 09:38:22 | 000,224,680 | ---- | M] () [Auto | Running] -- C:\Windows\System32\AsusService.exe -- (AsusService)
SRV - [2008.07.04 12:52:18 | 000,014,336 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2007.07.11 04:17:02 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.01.17 22:00:31 | 000,491,816 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2011.12.19 18:59:06 | 000,082,400 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)
DRV - [2011.12.19 18:59:06 | 000,038,616 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2011.12.19 14:12:00 | 000,104,752 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV - [2011.11.28 18:53:53 | 000,435,032 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2011.11.28 18:53:35 | 000,314,456 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2011.11.28 18:52:19 | 000,034,392 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2011.11.28 18:52:16 | 000,052,952 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2011.11.28 18:52:07 | 000,055,128 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2011.11.28 18:51:50 | 000,020,568 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2011.10.27 02:25:54 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011.10.27 02:25:54 | 000,078,136 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2011.07.12 09:36:28 | 000,022,768 | ---- | M] (VMware, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vstor2-mntapi10-shared.sys -- (vstor2-mntapi10-shared) Vstor2 MntApi 1.0 Driver (shared)
DRV - [2011.03.15 01:38:14 | 000,054,384 | ---- | M] (VMware, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bmdrvr.sys -- (bmdrvr)
DRV - [2011.02.09 15:03:00 | 000,011,832 | ---- | M] () [Kernel | System | Running] -- C:\Windows\System32\drivers\AsUpIO.sys -- (AsUpIO)
DRV - [2008.03.17 10:05:30 | 000,101,632 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2007.07.26 20:00:38 | 000,011,264 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASUSACPI.SYS -- (AsusACPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.01.22 20:25:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.10 09:28:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.01.10 09:29:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blackside\AppData\Roaming\mozilla\Extensions
[2012.01.10 09:54:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Blackside\AppData\Roaming\mozilla\Firefox\Profiles\pm240uoo.default\extensions
[2012.01.10 14:54:58 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.01.10 14:54:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
[2012.01.22 20:25:29 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
() (No name found) -- C:\USERS\BLACKSIDE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PM240UOO.DEFAULT\EXTENSIONS\UACONTROL@QZ.TSUGUMI.ORG.XPI
[2011.12.21 08:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.12.21 06:08:50 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.12.21 06:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.12.21 06:08:50 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.12.21 06:08:50 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.12.21 06:08:50 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.12.21 06:08:50 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Blackside\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U30 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Blackside\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Blackside\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: avast! WebRep = C:\Users\Blackside\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\6.0.1374_0\
CHR - Extension: Google Chrome to Phone Extension = C:\Users\Blackside\AppData\Local\Google\Chrome\User Data\Default\Extensions\oadboiipflhobonjjffjbfekfjcgkhco\2.3.1_0\
 
O1 HOSTS File: ([2012.01.28 14:16:43 | 000,000,894 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [AsusACPIServer] C:\Programme\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Programme\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Programme\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe (COMODO)
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)
O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe (COMODO)
O4 - HKLM..\Run: [MobileConnect] C:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34122C24-ED60-4B0C-A042-DFF966CEF195}: NameServer = 139.7.30.125 139.7.30.126
O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) -C:\Windows\System32\guard32.dll (COMODO)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Blackside\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Blackside\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2008.07.07 19:45:59 | 000,000,113 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{47fa26d4-ed0e-11e0-ac0e-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{47fa26d4-ed0e-11e0-ac0e-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{47fa277d-ed0e-11e0-ac0e-c6e3a63591ae}\Shell - "" = AutoRun
O33 - MountPoints2\{47fa277d-ed0e-11e0-ac0e-c6e3a63591ae}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.14 23:36:11 | 000,323,584 | R--- | M] (Vodafone)
O33 - MountPoints2\{75666955-f812-11e0-b521-da84024150b7}\Shell - "" = AutoRun
O33 - MountPoints2\{75666955-f812-11e0-b521-da84024150b7}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{aff7ec7e-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = H:\PMBP_Win.exe
O33 - MountPoints2\{aff7ec92-eda2-11e0-9ce2-86093c6cc5b3}\Shell - "" = AutoRun
O33 - MountPoints2\{aff7ec92-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\{aff7ec94-eda2-11e0-9ce2-86093c6cc5b3}\Shell - "" = AutoRun
O33 - MountPoints2\{aff7ec94-eda2-11e0-9ce2-86093c6cc5b3}\Shell\AutoRun\command - "" = E:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe -- [2008.07.14 23:36:11 | 000,323,584 | R--- | M] (Vodafone)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.01.29 11:09:16 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.01.29 09:03:33 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Malwarebytes
[2012.01.29 09:03:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.01.28 14:46:22 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Vitalwerks
[2012.01.28 14:45:49 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\No-IP DUC
[2012.01.28 14:15:47 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2012.01.28 14:08:09 | 000,000,000 | ---D | C] -- C:\Users\Blackside\Documents\Simply Super Software
[2012.01.28 14:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trojan Remover
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\Program Files\Trojan Remover
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Simply Super Software
[2012.01.28 14:07:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Simply Super Software
[2012.01.28 13:26:47 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\TeamViewer
[2012.01.28 13:14:57 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Comodo
[2012.01.28 12:55:46 | 000,000,000 | ---D | C] -- C:\ProgramData\CPA_VA
[2012.01.28 12:54:34 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\COMODO
[2012.01.28 12:47:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2012.01.28 12:47:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo
[2012.01.28 12:47:40 | 000,000,000 | ---D | C] -- C:\Program Files\Comodo
[2012.01.27 19:16:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VMware
[2012.01.27 19:13:38 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\VMware
[2012.01.27 19:13:37 | 000,000,000 | ---D | C] -- C:\Program Files\VMware
[2012.01.27 19:11:15 | 000,000,000 | ---D | C] -- C:\ProgramData\VMware
[2012.01.23 01:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\BitTorrent
[2012.01.23 01:46:57 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\BitTorrent
[2012.01.22 20:12:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2012.01.22 20:11:59 | 000,314,456 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSP.sys
[2012.01.22 20:11:59 | 000,020,568 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswFsBlk.sys
[2012.01.22 20:11:56 | 000,052,952 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswTdi.sys
[2012.01.22 20:11:56 | 000,034,392 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswRdr.sys
[2012.01.22 20:11:55 | 000,435,032 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswSnx.sys
[2012.01.22 20:11:54 | 000,055,128 | ---- | C] (AVAST Software) -- C:\Windows\System32\drivers\aswMonFlt.sys
[2012.01.22 20:11:24 | 000,199,816 | ---- | C] (AVAST Software) -- C:\Windows\System32\aswBoot.exe
[2012.01.22 20:11:24 | 000,041,184 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2012.01.16 17:50:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Vodafone
[2012.01.16 17:50:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vodafone
[2012.01.16 17:49:43 | 000,000,000 | ---D | C] -- C:\Program Files\Vodafone
[2012.01.16 03:01:11 | 000,000,000 | ---D | C] -- C:\Windows\System32\appmgmt
[2012.01.10 14:55:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.01.10 14:55:21 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2012.01.10 14:53:51 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2012.01.10 09:29:05 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\Mozilla
[2012.01.10 09:29:05 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Local\Mozilla
[2012.01.10 09:28:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.01.07 09:07:01 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2012.01.06 17:27:56 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoft
[2012.01.06 17:27:42 | 000,000,000 | ---D | C] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.01.02 18:04:17 | 000,000,000 | ---D | C] -- C:\Users\Blackside\VirtualBox VMs
[2012.01.02 17:52:46 | 000,000,000 | ---D | C] -- C:\Backtrack5
[2012.01.02 17:52:23 | 000,000,000 | ---D | C] -- C:\Users\Blackside\.VirtualBox
[2012.01.02 17:43:07 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.01.29 11:48:15 | 000,000,000 | ---- | M] () -- C:\Users\Blackside\defogger_reenable
[2012.01.29 11:22:02 | 000,001,136 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-808284525-1462833005-2160499395-1000UA.job
[2012.01.29 11:13:46 | 000,000,439 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts.ics
[2012.01.29 11:12:47 | 000,000,680 | ---- | M] () -- C:\Users\Blackside\AppData\Local\d3d9caps.dat
[2012.01.29 11:12:38 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.01.29 11:12:37 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.01.29 11:12:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.01.29 11:12:14 | 112,106,737 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.01.28 21:31:48 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.01.28 14:16:43 | 000,000,894 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.01.28 12:48:36 | 000,001,753 | ---- | M] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.01.28 12:47:58 | 000,001,040 | ---- | M] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.01.28 12:47:45 | 000,000,910 | ---- | M] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.01.28 12:23:21 | 000,013,312 | ---- | M] () -- C:\Users\Blackside\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.28 12:21:32 | 000,002,582 | ---- | M] () -- C:\Users\Blackside\Documents\Sybille.pfx
[2012.01.27 19:16:28 | 000,001,166 | ---- | M] () -- C:\Users\Public\Desktop\VMware vCenter Converter Standalone Client.lnk
[2012.01.27 19:16:27 | 000,001,024 | ---- | M] () -- C:\.rnd
[2012.01.23 07:22:00 | 000,001,084 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-808284525-1462833005-2160499395-1000Core.job
[2012.01.22 20:25:30 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2012.01.22 10:25:17 | 000,650,896 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.01.22 10:25:17 | 000,618,548 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.01.22 10:25:17 | 000,119,940 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.01.22 10:25:17 | 000,106,332 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.01.17 22:00:31 | 000,491,816 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdGuard.sys
[2012.01.16 06:07:27 | 000,029,528 | ---- | M] () -- C:\Users\Blackside\Documents\cc_20120116_060656.reg
[2012.01.16 05:22:58 | 000,000,000 | ---- | M] () -- C:\Windows\Path.idx
[2 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.01.29 11:48:15 | 000,000,000 | ---- | C] () -- C:\Users\Blackside\defogger_reenable
[2012.01.29 11:08:52 | 112,106,737 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.01.28 14:07:48 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2012.01.28 14:07:47 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2012.01.28 14:07:47 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2012.01.28 14:07:47 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2012.01.28 12:48:36 | 000,001,753 | ---- | C] () -- C:\Users\Public\Desktop\COMODO Firewall.lnk
[2012.01.28 12:47:58 | 000,001,040 | ---- | C] () -- C:\Users\Public\Desktop\COMODO GeekBuddy.lnk
[2012.01.28 12:47:45 | 000,000,910 | ---- | C] () -- C:\Users\Public\Desktop\Comodo Dragon.lnk
[2012.01.28 12:21:18 | 000,002,582 | ---- | C] () -- C:\Users\Blackside\Documents\Sybille.pfx
[2012.01.27 19:16:28 | 000,001,166 | ---- | C] () -- C:\Users\Public\Desktop\VMware vCenter Converter Standalone Client.lnk
[2012.01.27 19:16:17 | 000,001,024 | ---- | C] () -- C:\.rnd
[2012.01.16 06:07:03 | 000,029,528 | ---- | C] () -- C:\Users\Blackside\Documents\cc_20120116_060656.reg
[2012.01.16 05:22:27 | 000,000,000 | ---- | C] () -- C:\Windows\Path.idx
[2012.01.07 09:07:28 | 000,000,974 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 7.lnk
[2011.11.27 16:37:47 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2011.11.27 15:12:28 | 000,011,832 | ---- | C] () -- C:\Windows\System32\drivers\AsUpIO.sys
[2011.11.27 15:12:27 | 000,224,680 | ---- | C] () -- C:\Windows\System32\AsusService.exe
[2011.10.22 09:36:45 | 000,013,312 | ---- | C] () -- C:\Users\Blackside\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.10.02 12:45:44 | 000,000,552 | ---- | C] () -- C:\Users\Blackside\AppData\Local\d3d8caps.dat
[2011.10.02 12:37:13 | 000,000,680 | ---- | C] () -- C:\Users\Blackside\AppData\Local\d3d9caps.dat
[2011.09.16 10:54:48 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2011.09.16 10:54:44 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll
[2011.09.16 10:54:44 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll
[2011.09.16 10:54:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll
[2011.09.16 10:54:44 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll
[2008.07.30 19:31:52 | 000,021,864 | ---- | C] () -- C:\Windows\AsAcpiSvrLang.ini
[2008.06.23 13:02:02 | 000,097,410 | R--- | C] () -- C:\ProgramData\DeviceManager.xml.rc4
[2008.05.23 17:48:50 | 000,020,270 | ---- | C] () -- C:\ProgramData\DeviceInstaller.xml
[2008.03.17 15:54:36 | 000,012,208 | ---- | C] () -- C:\Windows\AsTrayLang.ini
[2006.11.02 16:48:52 | 000,650,896 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 16:48:52 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 16:48:52 | 000,119,940 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 16:48:52 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 13:55:52 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 13:46:27 | 000,228,840 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 13:34:29 | 000,063,488 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2006.11.02 13:34:23 | 000,080,010 | ---- | C] () -- C:\Windows\System32\manage-bde.ini.en
[2006.11.02 13:34:20 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 11:33:01 | 000,618,548 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 11:33:01 | 000,106,332 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.11.02 08:22:43 | 000,099,999 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2006.11.02 08:22:43 | 000,018,271 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
 
========== LOP Check ==========
 
[2011.11.29 15:25:54 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\ActiveState
[2012.01.23 01:59:04 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\BitTorrent
[2012.01.06 17:28:01 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoft
[2012.01.06 17:27:42 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.10.22 09:09:27 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Samsung
[2012.01.28 14:07:21 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Simply Super Software
[2012.01.28 13:26:47 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\TeamViewer
[2011.10.02 16:56:44 | 000,000,000 | ---D | M] -- C:\Users\Blackside\AppData\Roaming\Vodafone
[2012.01.28 21:31:46 | 000,032,590 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.10.02 12:37:45 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.01.02 18:06:57 | 000,000,000 | ---D | M] -- C:\Backtrack5
[2009.08.08 10:17:37 | 000,000,000 | ---D | M] -- C:\bb0c208a7f0f032f2b742c7d
[2011.10.02 12:51:08 | 000,000,000 | -HSD | M] -- C:\Boot
[2012.01.28 12:51:26 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2006.11.02 14:00:38 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.10.02 02:06:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen
[2010.11.15 22:15:53 | 000,000,000 | ---D | M] -- C:\DVDVideoSoft
[2008.08.11 16:57:31 | 000,000,000 | ---D | M] -- C:\Intel
[2011.11.29 15:07:49 | 000,000,000 | ---D | M] -- C:\Perl
[2012.01.29 11:08:06 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.01.29 09:03:18 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.01.22 07:37:30 | 000,000,000 | R--D | M] -- C:\Programme
[2010.10.16 16:37:35 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2012.01.29 11:58:42 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.10.22 09:33:49 | 000,000,000 | ---D | M] -- C:\Temp
[2011.10.02 12:37:09 | 000,000,000 | R--D | M] -- C:\Users
[2009.09.03 10:39:54 | 000,000,000 | -HSD | M] -- C:\USMT.TMP
[2012.01.29 11:12:14 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
 
 
< MD5 for: AFD.SYS  >
[2006.11.02 09:58:43 | 000,270,336 | ---- | M] (Microsoft Corporation) MD5=5D24CAF8EFD924A875698FF28384DB8B -- C:\Windows\System32\drivers\afd.sys
[2006.11.02 09:58:43 | 000,270,336 | ---- | M] (Microsoft Corporation) MD5=5D24CAF8EFD924A875698FF28384DB8B -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.0.6000.16386_none_d5b1809661820e7c\afd.sys
 
< MD5 for: EXPLORER.EXE  >
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\explorer.exe
[2006.11.02 10:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\regedit.exe
[2006.11.02 10:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\System32\userinit.exe
[2006.11.02 10:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\System32\wininit.exe
[2006.11.02 10:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\System32\winlogon.exe
[2006.11.02 10:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >
--- --- ---


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:04 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131