| SunnyFace | 28.10.2012 11:24 |
Skype-Wurm 2012
Hallo! Zu erst möchte ich mich entschuldigen, da ich nicht genau gewusst habe in welchem Subforum ich dieses Thema erstellen sollte.
Mein Problem ist folgendes (Symptome: Nachricht "moin, kaum zu glauben was für schöne fotos von dir auf deinem profil? hxxp://goo.gl/FYA9t?foto=SKYPENAME" an alle meine Skypekontakte. Mehr eigentlich nicht. Ich habe mich aber ein bisschen umgehört und die Meinungen gehen auseinander. Die Einen sagen er sei NOCH harmlos, die anderen dass dieser Virus deine Tasten.. mir fällt das Wort nicht ein, dass er jedenfalls sehen kann was du schreibst und so eine Passwörter herausfinden kann. Ich habe mich deswegen nur in Yahoo.de eingeloggt um mich in diesem Forum zu registrieren.)
Ich habe mir gestern aus Versehen den Skype-Wurm, der gerade in Umlauf ist, heruntergeladen. Ich bin dann sofort ins Netz und habe gegoogelt wie man den denn entfernen kann. Ich bin dann auf folgendes gestoßen (Quelle: www.stern.de): Man sollte zuerst in Skype selber unter Aktionen - Optionen - Erweitert - Zugriffsverwaltung alle entfernen, was ich auch gemacht habe. Danach sollte ich mit "Malwarebytes" einen Scan durchführen, was ich dann auch gemacht habe. Herausgekommen ist: Code:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org
Datenbank Version: v2012.10.27.06
Windows 7 x64 NTFS
Internet Explorer 9.0.8112.16421
Margareth :: MARGARETH-PC [Administrator]
27.10.2012 21:53:16
mbam-log-2012-10-27 (21-53-16).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 394444
Laufzeit: 1 Stunde(n), 22 Minute(n), 49 Sekunde(n)
Infizierte Speicherprozesse: 1
C:\Program Files (x86)\BrowserCompanion\BCHelper.exe (PUP.Blabbers) -> 8600 -> Löschen bei Neustart.
Infizierte Speichermodule: 1
C:\Program Files (x86)\BrowserCompanion\sqlite3.dll (PUP.Blabbers) -> Löschen bei Neustart.
Infizierte Registrierungsschlüssel: 23
HKCR\CLSID\{00cbb66b-1d3b-46d3-9577-323a336acb50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{8830DDF0-3042-404D-A62C-384A85E34833} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wit4ie.WitBHO.2 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\wit4ie.WitBHO (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00CBB66B-1D3B-46D3-9577-323A336ACB50} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{830B56CB-FD22-44AA-9887-7898F4F4158D} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\tdataprotocol.CTData.1 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\tdataprotocol.CTData (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\updatebho.TimerBHO.1 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\updatebho.TimerBHO (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{963B125B-8B21-49A2-A3A8-E37092276531} (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BrowserCompanion (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\BASE64 (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\CHROME (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\PROTOCOLS\HANDLER\PROX (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Registrierungswerte: 4
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Browser companion helper (PUP.Blabbers) -> Daten: C:\Program Files (x86)\BrowserCompanion\BCHelper.exe /T=3 /CHI=ibgfbdggapddbjjbopabhlhianklajie -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\base64|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\chrome|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\protocols\Handler\prox|CLSID (PUP.Blabbers) -> Daten: {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -> Erfolgreich gelöscht und in Quarantäne gestellt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 1
C:\Program Files (x86)\BrowserCompanion (PUP.Blabbers) -> Löschen bei Neustart.
Infizierte Dateien: 17
C:\Program Files (x86)\BrowserCompanion\BCHelper.exe (PUP.Blabbers) -> Löschen bei Neustart.
C:\Program Files (x86)\BrowserCompanion\jsloader.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\HappyCloud\Application\hcwebwindow.exe (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\Local\Temp\coupish.exe (PUP.Blabbers.H) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\Local\Temp\coupondropdown.exe (PUP.CrossRider.CDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\AppData\LocalLow\bbrs_002.tb\content\BCHelper.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Margareth\Desktop\Terraria 1.1.2\TDU.exe (Packer.ModifiedUPX) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\blabbers-ff-full.xpi (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\blabbers-ch.crx (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\logo.ico (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\sqlite3.dll (PUP.Blabbers) -> Löschen bei Neustart.
C:\Program Files (x86)\BrowserCompanion\toolbar.dll (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\uninstall.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\updater.ini (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BrowserCompanion\widgetserv.exe (PUP.Blabbers) -> Erfolgreich gelöscht und in Quarantäne gestellt.
Ich habe alle in die Quarantäne verschoben und sie nicht endgültig gelöscht.
Ein Freund hat mir dann empfohlen das Programm "HiJackThis204" zu benutzen, was ich auch getan habe. (Leider kein Logfile vorhanden)! Dieser Freund sagte mir dann, dass ich alles mit "(no name)" löschen sollte. Er sagte er kennt sich ein bisschen damit aus, und so habe ich das auch gemacht.
Zur Info, ich habe ein 64bit System. Bei der Hilfe zum erstellen eines Themas, stand dass ich noch die Logfiles von "OTL" ins Thema schreiben sollte:
OTL.txt Code:
OTL logfile created on: 28.10.2012 10:52:13 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Margareth\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001407 | Country: Liechtenstein | Language: DEC | Date Format: dd.MM.yyyy
3.86 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.54% Memory free
7.73 Gb Paging File | 5.28 Gb Available in Paging File | 68.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 225.33 Gb Total Space | 37.22 Gb Free Space | 16.52% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 225.24 Gb Free Space | 99.96% Space Free | Partition Type: NTFS
Computer Name: MARGARETH-PC | User Name: Margareth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Margareth\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.)
PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Samsung\Samsung Recovery Solution 4\WCScheduler.exe (SEC)
PRC - C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (SAMSUNG Electronics)
PRC - C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Windows\SysWOW64\Rezip.exe ()
PRC - C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
========== Modules (No Company Name) ==========
MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avcodec-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\chromehtml.DLL ()
MOD - C:\Program Files (x86)\Steam\bin\avformat-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avutil-51.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\libglesv2.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\libegl.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avutil-51.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avformat-54.dll ()
MOD - C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\avcodec-54.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
MOD - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf ()
MOD - C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Rezip) -- C:\Windows\SysWOW64\Rezip.exe ()
SRV - (IJPLMSVC) -- C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE ()
========== Driver Services (SafeList) ==========
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:64bit: - (SynTP) -- C:\Windows\SysNative\drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (Impcd) -- C:\Windows\SysNative\drivers\Impcd.sys (Intel Corporation)
DRV:64bit: - (athr) -- C:\Windows\SysNative\drivers\athrx.sys (Atheros Communications, Inc.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys ()
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (SABI) -- C:\Windows\SysNative\drivers\SABI.sys (SAMSUNG ELECTRONICS)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (scramby_out) -- C:\Windows\SysNative\drivers\scramby_out.sys (RapidSolution Software AG)
DRV:64bit: - (scramby) -- C:\Windows\SysNative\drivers\scramby.sys (RapidSolution Software AG)
DRV - (rtport) -- C:\Windows\SysWOW64\drivers\rtport.sys (Windows (R) 2003 DDK 3790 provider)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&AF=110000&babsrc=SP_ss&mntrId=26a5f3b60000000000004c0f6e67113a
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Search"
FF - prefs.js..browser.search.defaultthis.engineName: "DVDVideoSoftTB Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:3.5.0.12
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}:7.0.01
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..extensions.enabledItems: ffxtlbr@funmoods.com:1.5.0
FF - prefs.js..extensions.enabledItems: bbrs_002@blabbers.com:1.0.5
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.0: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.0: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.0: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Margareth\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Margareth\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll File not found
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Margareth\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\thehappycloud.com/HappyCloudPlugin: C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.08.29 11:38:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.20\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.02.09 21:47:09 | 000,000,000 | ---D | M]
[2011.03.10 16:55:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Extensions
[2011.03.10 16:55:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Extensions\contact@callgraph.in
[2012.10.22 19:55:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions
[2011.07.23 21:28:15 | 000,000,000 | ---D | M] (DVDVideoSoftTB Community Toolbar) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2011.02.17 22:16:32 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.07.19 09:13:10 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2012.06.06 16:54:07 | 000,000,000 | ---D | M] (Browser Companion Helper) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com
[2012.02.11 15:18:03 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\ffxtlbr@babylon.com
[2012.02.08 19:54:47 | 000,000,000 | ---D | M] (Funmoods.com) -- C:\Users\Margareth\AppData\Roaming\mozilla\Firefox\Profiles\uctw6efl.default\extensions\ffxtlbr@funmoods.com
[2012.10.22 19:56:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\0324adea3b6ec02af09ea4ae9424591b_expire
[2012.10.22 19:56:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\292124057d00cb0fa73db6b90d079658_expire
[2012.08.03 16:20:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2e74403c227112bec523796d5a77d77e_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\2fb0a694851c14e47b9ee5c9511cfaf5_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\35c5ead7c694459d2b46d88482247348_expire
[2012.08.24 18:33:25 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\4d3d10bd28ff623813254a49b26be41f_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\529625b7c75cf58a3cad03424e45f9cd_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\5496a80fec56909d677fa574ae75bd3d_expire
[2012.08.31 17:18:29 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\61e2ae11ba3d1cbe8887ea80f192e299_expire
[2012.10.22 19:56:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\79fb7d8c9c120c501ff74f2666f1ed76_expire
[2012.08.03 16:20:07 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\7cf04ffc65c19302872f4c23faa25a61_expire
[2012.08.31 17:18:30 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\96ca486780f97d365b7d374b46961f04_expire
[2012.08.03 16:20:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\9bde9efdf90ba55e6cf180b948c7e658_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ab78b9d1464f2721b3a46dd11838baaf_expire
[2012.08.31 17:18:28 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\c5538e5049ca9b04ad62d9a930947369_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\c73c08546fe29ea012835721d47970c4_expire
[2012.08.24 18:33:26 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e7215b147326809c45f6cf0952274624_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\e919434ec29526b28593c426e4264271_expire
[2012.10.22 19:56:08 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ee1ab4cb8e86769e288abaa46407a623_expire
[2012.08.31 17:18:27 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\f03527c67e08602d2e4c18ae7867300d_expire
[2012.08.24 18:33:24 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\fa74672918974682c82b8d91dfbe0d6b_expire
[2012.08.24 18:33:24 | 000,000,013 | ---- | M] () (No name found) -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\extensions\bbrs_002@blabbers.com\chrome\content\cache\ff4d692d5e7cccbc4b3e9ef4062b1c6f_expire
[2011.06.22 13:15:18 | 000,000,931 | ---- | M] () -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\searchplugins\conduit.xml
[2012.02.08 19:54:42 | 000,001,800 | ---- | M] () -- C:\Users\Margareth\AppData\Roaming\mozilla\firefox\profiles\uctw6efl.default\searchplugins\funmoods.xml
[2012.09.04 13:35:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.09.05 20:30:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.02.17 22:11:09 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\mozilla firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2011.11.23 21:20:39 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}
[2011.04.09 17:44:57 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.11 15:17:56 | 000,002,310 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2011.04.09 17:44:57 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.04.09 17:44:57 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.04.09 17:44:57 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.04.09 17:44:57 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - homepage: hxxp://www.google.de/
CHR - default_search_provider: Search the web (Babylon) (Enabled)
CHR - default_search_provider: search_url = hxxp://search.babylon.com/?q={searchTerms}&AF=110000&babsrc=SP_ss&mntrId=26a5f3b60000000000004c0f6e67113a
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.de/
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\PepperFlash\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\22.0.1229.94\pdf.dll
CHR - plugin: (Enabled) = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibgfbdggapddbjjbopabhlhianklajie\1.0.5_0\chromeNPAPI.dll
CHR - plugin: Skype Click to Call (Enabled) = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL
CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll
CHR - plugin: Windows Live\u00AE Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Happy Cloud Plugin (Enabled) = C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll
CHR - plugin: Unity Player (Enabled) = C:\Users\Margareth\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Java Deployment Toolkit 7.0.40.255 (Enabled) = C:\windows\SysWOW64\npDeployJava1.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Skype Click to Call = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.2.0.10687_0\
CHR - Extension: Google Mail = C:\Users\Margareth\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - No CLSID value found.
O4:64bit: - HKLM..\Run: [NvCplDaemon] C:\windows\SysNative\NvCpl.dll (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [APLangApp] C:\Program Files (x86)\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKCU..\Run: [Google Update] "C:\Users\Margareth\AppData\Local\Google\Update\GoogleUpdate.exe" /c File not found
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - res://C:\PROGRA~2\MICROS~2\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_01-windows-i586.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5EA4E7F6-1118-49BB-AEC5-38655195B26B}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{63406458-B492-4731-B533-D14ACCF1F96D}: DhcpNameServer = 192.168.105.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92D8A13D-4F94-466F-AAC1-EA1CF853EA42}: DhcpNameServer = 192.168.0.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O27:64bit: - HKLM IFEO\utilman.exe: Debugger - C:\Windows\SysNative\cmd.exe (Microsoft Corporation)
O27 - HKLM IFEO\utilman.exe: Debugger - C:\Windows\SysWOW64\cmd.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{28741ccc-53df-11e1-8676-002454c19d98}\Shell - "" = AutoRun
O33 - MountPoints2\{28741ccc-53df-11e1-8676-002454c19d98}\Shell\AutoRun\command - "" = G:\INSTALL.EXE
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.10.28 10:48:35 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Margareth\Desktop\OTL.exe
[2012.10.27 21:10:26 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Desktop\backups
[2012.10.27 20:43:16 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Users\Margareth\Desktop\HiJackThis204.exe
[2012.10.27 19:43:58 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Malwarebytes
[2012.10.27 19:42:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.10.27 19:42:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.10.27 19:42:32 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[2012.10.27 19:42:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.10.22 20:24:28 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.10.22 20:17:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2012.10.21 13:51:00 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Documents\GTA San Andreas User Files
[2012.10.21 13:43:12 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Desktop\fsace
[2012.10.03 20:04:13 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\TIPP10
[2012.10.03 20:04:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TIPP10
[2012.10.03 20:04:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tipp10
[2012.10.03 14:39:32 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\MTE
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft Texturepack Editor
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft Texturepack Editor
[2012.10.03 14:39:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Minecraft Texturepack Editor
[2012.10.02 17:30:37 | 000,000,000 | ---D | C] -- C:\Users\Margareth\Documents\The Lord of the Rings Online
[2012.10.02 17:30:37 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\The Lord of the Rings Online
[2012.10.02 17:23:52 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Happy Cloud
[2012.10.02 17:23:50 | 000,000,000 | ---D | C] -- C:\ProgramData\HappyCloud
[2012.10.01 20:58:49 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\Turbine
[2012.10.01 20:58:46 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Local\ApplicationHistory
[2012.10.01 20:21:12 | 000,000,000 | ---D | C] -- C:\windows\SysWow64\URTTEMP
[2012.10.01 15:29:01 | 000,000,000 | ---D | C] -- C:\Users\Margareth\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
[6 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.10.28 10:48:41 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Margareth\Desktop\OTL.exe
[2012.10.28 10:48:12 | 000,000,000 | ---- | M] () -- C:\Users\Margareth\defogger_reenable
[2012.10.28 10:23:15 | 000,014,144 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.10.28 10:23:15 | 000,014,144 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.10.28 10:22:09 | 001,528,340 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI
[2012.10.28 10:22:09 | 000,665,014 | ---- | M] () -- C:\windows\SysNative\perfh007.dat
[2012.10.28 10:22:09 | 000,625,156 | ---- | M] () -- C:\windows\SysNative\perfh009.dat
[2012.10.28 10:22:09 | 000,135,150 | ---- | M] () -- C:\windows\SysNative\perfc007.dat
[2012.10.28 10:22:09 | 000,110,794 | ---- | M] () -- C:\windows\SysNative\perfc009.dat
[2012.10.28 10:18:00 | 000,001,136 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1087647220-443236407-352421928-1000UA.job
[2012.10.28 10:15:25 | 000,001,112 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.10.28 10:15:13 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012.10.28 10:15:08 | 4148,744,192 | -HS- | M] () -- C:\hiberfil.sys
[2012.10.28 10:08:01 | 000,001,116 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.10.27 22:31:08 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.10.27 20:43:26 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Users\Margareth\Desktop\HiJackThis204.exe
[2012.10.27 20:18:00 | 000,001,084 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-1087647220-443236407-352421928-1000Core.job
[2012.10.27 16:28:14 | 000,000,572 | ---- | M] () -- C:\Users\Margareth\Desktop\gta_sa - Verknüpfung.lnk
[2012.10.22 20:17:24 | 000,002,247 | ---- | M] () -- C:\Users\Margareth\Desktop\Google Chrome.lnk
[2012.10.03 20:04:04 | 000,000,979 | ---- | M] () -- C:\Users\Margareth\Desktop\TIPP10.lnk
[2012.10.03 14:39:10 | 000,001,116 | ---- | M] () -- C:\Users\Margareth\Desktop\Minecraft Texturepack Editor.lnk
[2012.10.01 20:58:47 | 000,000,097 | ---- | M] () -- C:\Users\Margareth\AppData\Local\fusioncache.dat
[2012.10.01 20:23:36 | 001,555,638 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.09.29 18:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys
[6 C:\windows\SysWow64\*.tmp files -> C:\windows\SysWow64\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.10.28 10:48:12 | 000,000,000 | ---- | C] () -- C:\Users\Margareth\defogger_reenable
[2012.10.27 20:33:48 | 000,000,392 | ---- | C] () -- C:\Users\Margareth\Desktop\Utilman-System.reg
[2012.10.27 20:33:48 | 000,000,304 | ---- | C] () -- C:\Users\Margareth\Desktop\Utilman-System entfernen.reg
[2012.10.27 19:42:37 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.10.27 16:28:14 | 000,000,572 | ---- | C] () -- C:\Users\Margareth\Desktop\gta_sa - Verknüpfung.lnk
[2012.10.22 20:17:24 | 000,002,247 | ---- | C] () -- C:\Users\Margareth\Desktop\Google Chrome.lnk
[2012.10.03 20:04:04 | 000,000,979 | ---- | C] () -- C:\Users\Margareth\Desktop\TIPP10.lnk
[2012.10.03 14:39:10 | 000,001,116 | ---- | C] () -- C:\Users\Margareth\Desktop\Minecraft Texturepack Editor.lnk
[2012.10.01 20:58:47 | 000,000,097 | ---- | C] () -- C:\Users\Margareth\AppData\Local\fusioncache.dat
[2012.10.01 20:21:56 | 001,555,638 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI
[2012.06.04 20:15:49 | 000,001,487 | ---- | C] () -- C:\Users\Margareth\AppData\Local\RecConfig.xml
[2012.05.05 11:37:31 | 000,003,421 | ---- | C] () -- C:\Users\Margareth\AppData\Local\recently-used.xbel
[2011.08.26 11:45:01 | 000,004,096 | ---- | C] () -- C:\windows\d3dx.dat
[2011.02.17 22:12:01 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.02.17 20:08:15 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
========== ZeroAccess Check ==========
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:30:56 | 014,165,504 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2012.10.25 18:54:19 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\.minecraft
[2012.06.17 22:02:43 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Audacity
[2012.02.11 15:17:51 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Babylon
[2012.02.10 20:18:07 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DAEMON Tools Lite
[2011.07.23 21:28:27 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DVDVideoSoft
[2011.02.17 22:16:32 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.16 15:46:56 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Guitar Pro 6
[2011.08.07 15:23:54 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\LEGO Company
[2012.06.21 20:41:46 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\LolClient2
[2012.02.05 00:21:27 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Minemapper
[2011.02.28 22:07:05 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade
[2011.12.15 19:19:41 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade Warband
[2011.10.07 10:45:28 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Mount&Blade With Fire and Sword
[2012.10.03 14:39:35 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\MTE
[2012.07.03 17:28:12 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Origin
[2012.01.17 22:25:45 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Screaming Bee
[2011.11.27 15:39:07 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TeamViewer
[2012.10.03 20:05:38 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TIPP10
[2012.08.30 22:03:22 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\TS3Client
[2012.03.14 17:25:53 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\ts3overlay
[2011.02.19 13:41:15 | 000,000,000 | ---D | M] -- C:\Users\Margareth\AppData\Roaming\Unity
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:6FB93194
@Alternate Data Stream - 126 bytes -> C:\ProgramData\Temp:798A3728
@Alternate Data Stream - 125 bytes -> C:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 122 bytes -> C:\ProgramData\Temp:8530A643
< End of report >
Extras.txt: Code:
OTL Extras logfile created on: 28.10.2012 10:52:13 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Margareth\Desktop
64bit- Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001407 | Country: Liechtenstein | Language: DEC | Date Format: dd.MM.yyyy
3.86 Gb Total Physical Memory | 2.07 Gb Available Physical Memory | 53.54% Memory free
7.73 Gb Paging File | 5.28 Gb Available in Paging File | 68.31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 225.33 Gb Total Space | 37.22 Gb Free Space | 16.52% Space Free | Partition Type: NTFS
Drive D: | 225.33 Gb Total Space | 225.24 Gb Free Space | 99.96% Space Free | Partition Type: NTFS
Computer Name: MARGARETH-PC | User Name: Margareth | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09D771F1-06DE-4CB9-A216-71B3A460C0EF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0D227CED-4C3E-40DB-8123-EC3AB47112DD}" = rport=139 | protocol=6 | dir=out | app=system |
"{0D356886-7F68-4B89-88B2-97FA1F64F200}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{16B7FB56-4436-486D-9350-33D97B7DDDE2}" = rport=10243 | protocol=6 | dir=out | app=system |
"{16C75EFF-CC2E-47FE-ABF9-1DD40D9A0741}" = rport=2869 | protocol=6 | dir=out | app=system |
"{1706B488-C0CC-4F32-977F-0B0656D21C0D}" = lport=25565 | protocol=17 | dir=in | name=minecraft server 1 |
"{17531B1E-D06F-4777-829B-FC83C0D5C826}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2FC38466-1A7A-4C0B-8112-C22FEF180C8A}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{42162787-F4C3-4494-AC49-49A02F388AFF}" = lport=138 | protocol=17 | dir=in | app=system |
"{45B6635C-7FAD-469F-BE30-C9F941B3E281}" = rport=137 | protocol=17 | dir=out | app=system |
"{4C0252F9-8735-4926-991F-6B762C618058}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{52F7F83B-FC6A-40AC-B723-9F2CC338C9C7}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{56968EE8-F120-4555-8A73-1907E24A4815}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{5C7423B8-BC9D-4D99-838F-87E1F64890D3}" = lport=10243 | protocol=6 | dir=in | app=system |
"{5CA4E214-61C0-491E-9AD7-8B87A570F448}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{67A41746-2F07-4CA3-B793-CA2F409DC932}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{6A3CC717-FA15-4443-AD04-727FE8994021}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6B706B23-174A-49E8-8956-5FABCD984847}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{6B907028-FCF9-4E77-89F3-2E12684BAEEF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{726036DF-6209-4C61-98BE-A7F506C499FD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{728C1BBA-20F7-4214-8FE6-7F2B45A8B300}" = rport=445 | protocol=6 | dir=out | app=system |
"{73A2686E-A87C-4E32-9787-201488B370B9}" = lport=25565 | protocol=6 | dir=in | name=minecraft_server |
"{74E85873-6A1C-44CA-95A7-4DF6EA03EFDA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{820C5540-5392-4A13-B9A8-879EC35D0D59}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{82529585-402D-4446-8120-A3206A8ABBC2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{8572AE83-8BC4-4636-95BF-9DB636364A1B}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{85A336E0-EFE7-453C-9A6B-4D42C44EED6D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{86FD0180-32A7-4BB1-B5D1-46F6B6088801}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{888C9FB1-7C15-4671-9342-963E1D1588A1}" = lport=25565 | protocol=17 | dir=in | name=minecraft_server1 |
"{9DF5C29C-0BFC-4551-AE28-0831E2C94B46}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{A5CD5EED-EADE-489E-A183-AF81391FF4C9}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{B0A83FBA-011E-46F9-9796-0E6A02952E3A}" = lport=445 | protocol=6 | dir=in | app=system |
"{B44CCA61-4134-4638-BAF2-DAA5F8DBA84D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B5B7DFAF-A215-470D-AA6D-F893DDB57291}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{B86997BA-7193-4246-92CD-F3BB47CE1144}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B8725EAF-F639-47D0-AF2B-74525BBC9D86}" = lport=2869 | protocol=6 | dir=in | app=system |
"{C27AF3C7-E26A-4447-9512-68032488077D}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C41AB00C-D58B-4045-87D6-46DE8774BE91}" = lport=139 | protocol=6 | dir=in | app=system |
"{C5B749FC-6FDB-41C7-8A32-A410C9BB2F70}" = lport=137 | protocol=17 | dir=in | app=system |
"{CB799D32-7AAF-4DF9-9D57-A313E63A97A0}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D1F354FC-AF16-4136-BDBE-BAF60667306E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{DAE6F264-3FB0-4563-89CA-EA326068FB42}" = rport=138 | protocol=17 | dir=out | app=system |
"{ED1BC11E-85D9-4DA2-9E59-E44297404E0A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F1772043-DA60-41B9-B859-C0B8FACB4191}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F2B38E23-A803-433F-A8C4-6CC1CCA5EF90}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{081F8FB3-7D2E-4116-A209-450CD02BB6A3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{0AEA0A7C-1E17-4DC7-AB01-45844F445284}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{1279EC52-87F7-49BC-B690-C24C5E3024FF}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{16819A63-044C-4ACF-B1A9-8F6FC7F2EAC2}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{18BD60BA-DF0F-4720-9DB7-FC62F3C6EDD0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{1C0EC85B-4037-4D13-86B2-D60E2930C114}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{1FD0F53E-D34B-47F1-B03D-34D071FB49C9}" = protocol=58 | dir=in | app=system |
"{21FFED53-C485-478F-A8B3-36106D7E9120}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{22C77A34-8056-4F08-8B8D-452E924EB0F8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{24AFC90D-12F3-485E-A3C2-E97F9164E1A1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3911C9DC-2AC6-42B8-9F17-3BEB956A60A5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\turbineinvoker.exe |
"{3DEFB91B-BF59-45CE-88B4-CCEDB865487D}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{41D8AA01-BA03-44CE-BAAF-70C4FD7CD37F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\turbineinvoker.exe |
"{46323FE0-9940-44FF-96CD-1225217E6902}" = protocol=6 | dir=out | app=system |
"{46B02F0B-8AF9-401C-BBC2-9B63E4156FE7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4B3C933C-C57C-4C27-A756-684A21836CA5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mount & blade with fire and sword\mb_wfas.exe |
"{51A179CD-D24F-4C60-828E-29F1B79A2EE2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{53FAC91C-9173-4001-8E67-8B45D039CB0D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{5D48C1C7-70C7-49E9-A483-68ED08478795}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6C68C274-0782-4955-BD22-54FD6BE67DBE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6CDA8567-1BF8-4318-ACDB-59439AD4040C}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{6F17A09C-31AC-41A1-925E-85005000FCF1}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe |
"{72CF875C-1B15-4EDF-BE69-00016678DE7C}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{738F1BFB-3567-4EAE-ACE7-836FAB99E744}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{76C61C53-80A2-4E61-A3F8-BD4958139D47}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{7BEAB1CD-780B-4253-B417-0C0F7444EF6A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8110C62E-8438-4020-9B9D-64E1E9907B2A}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8801B9B7-7901-4072-9FBA-8126ADF35F33}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{88F9B3FA-3C4D-41E0-A2AB-F27CC67B39F5}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8C26345A-2855-41D5-A0DC-49B974D5623E}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{8CF7CCB8-5C8B-4EC9-B5A5-B4FBB04A4B07}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{91F59BF1-F955-4D9B-982B-157116D0CEAA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mount & blade with fire and sword\mb_wfas.exe |
"{A12D49A9-759E-4DA8-8B8B-CFFD5B10ED91}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{A1AAFA39-4774-4994-814C-5B830FCAF600}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{A26D4712-4981-4F9C-8B35-0698D98BBBC5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B6008E78-55B0-440F-95F4-D3EB5FB095FE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BB710319-5E67-4AD5-B083-9384889DE22B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe |
"{BC57A43A-94B5-4C86-B8F0-A433A6009BCD}" = protocol=6 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe |
"{BE4E0C01-5788-4ABB-B4C3-D361149E3D2D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C20E181A-73C5-438D-B49F-9F4DDE8DCD09}" = dir=in | app=c:\program files (x86)\windows live\sync\windowslivesync.exe |
"{C2C94DE6-8D10-4ED0-BC23-2987592804DF}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D77FD254-D975-49D5-8B2A-92C521D5B172}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{D9B2993A-D986-4214-9FB0-09240A118FFF}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe |
"{DBAE2C39-4439-4959-A576-D1A46047B700}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F043997A-D643-496A-8B3C-BCC7A6F2C88C}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F19DBBEC-6923-4B88-BE58-74DC0A0FB870}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F411B29C-C4BD-4047-AFAE-E806B9C5FB01}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{F78BDBD9-65D8-4F6A-BDAB-DD522B5BEB50}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{FA1C62FC-0759-4D59-85DF-9AB7727969C0}" = protocol=17 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe |
"{FAFC6FFB-2033-467C-9623-8C5E5F52B5AC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{FB5A713B-E128-4273-A299-1DCABEC9166A}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FDE0727D-DD74-47DB-9F4A-5F3BE377B77C}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"TCP Query User{33E4389F-E749-4D34-9330-24BA1770C44D}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{3A3B2A95-7EBB-4D50-B4FC-3644D576EBB8}C:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe" = protocol=6 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe |
"TCP Query User{68901C89-1533-4D3F-85B4-F0630EECA631}C:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe |
"TCP Query User{D2CA81DF-CBC3-4CDE-B8B5-48385CAC5860}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{02B94005-94EB-4E0E-852D-7F4627543C1D}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{1E252867-7A01-47BF-8DE4-537B1FA4FD51}C:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe" = protocol=17 | dir=in | app=c:\users\margareth\desktop\terraria 1.1.2\terrariaserver.exe |
"UDP Query User{8117B771-34E3-4E98-88E3-8E8AF8F67395}C:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\lord of the rings online\lotroclient.exe |
"UDP Query User{A4351C0A-5603-40E9-A32D-0844177E3E5F}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3500_series" = Canon iP3500 series
"{1493B2AE-0261-47D2-B1AA-F4DAD0F6C48B}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86417005FF}" = Java(TM) 7 Update 5 (64-bit)
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}" = Apple Mobile Device Support
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2010
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{F0A36649-873E-4832-A5F1-BF5DF8600BDB}" = Windows Live Family Safety
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"GIMP-2_is1" = GIMP 2.8.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"NVIDIA Drivers" = NVIDIA Drivers
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinRAR archiver" = WinRAR 4.01 (64-bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0A353130-D22C-41DD-8C67-1B02A05F2CE0}" = Samsung Support Center
"{0F796312-289C-40CA-856C-9FBCF5E83342}" = REALTEK Wireless LAN Software
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution 4
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{178EE5F4-0F86-4BF0-A0D1-9790AFF409D1}" = EasyBatteryManager
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1AFA1FEF-8CF9-4A51-AC46-64FAA7F3D9E2}" = AnyPC Client
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{34B76DCB-BF7C-440F-B058-C84172C1E338}" = Easy Network Manager
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EED7541-55F8-4DC6-B9CD-28762D71310E}" = Samsung R-Series
"{3EFEF049-23D4-4B46-8903-4592FEA51018}" = Windows Live Movie Maker
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853F8A41-A3C9-43FA-87FA-1AE74FC6F3F7}" = BatteryLifeExtender
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{967EF02C-5C7E-4718-8FCB-BDC050190CCF}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002A-0407-1000-0000000FF1CE}_Office14.PROPLUSR_{594128C9-2CDF-43CE-8103-DC100CF013B6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}" = Intel(R) Turbo Boost Technology Driver
"{E0A4805D-280A-4DD7-9E74-3A5F85E302A1}" = Windows Live Writer
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = The Lord of the Rings Online™ v03.07.01.8015
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon iP3500 series Benutzerregistrierung" = Canon iP3500 series Benutzerregistrierung
"CANONIJPLM100" = PIXMA Extended Survey Program
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.5.722
"Google Chrome" = Google Chrome
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Minecraft Texturepack Editor" = Minecraft Texturepack Editor
"Mount&Blade" = Mount&Blade
"Mozilla Firefox (3.6.20)" = Mozilla Firefox (3.6.20)
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Revo Uninstaller" = Revo Uninstaller 1.93
"Steam App 212500" = The Lord of the Rings Online™
"Steam App 48700" = Mount & Blade: Warband
"Steam App 48720" = Mount & Blade: With Fire and Sword
"TeamViewer 7" = TeamViewer 7
"TIPP10_is1" = TIPP10 Version 2.1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.7
"WinLiveSuite_Wave3" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"HappyCloud" = Happy Cloud Client
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 12.04.2012 09:12:45 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = DNS Message from «ZERO ADDRESS»:0 to «ZERO ADDRESS»:0 length 0
too short
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1139
Error - 12.04.2012 09:32:25 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1139
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 2153
Error - 12.04.2012 09:32:26 | Computer Name = Margareth-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 2153
Error - 12.04.2012 15:11:35 | Computer Name = Margareth-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,
Zeitstempel: 0x4d76255d Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0xf4977fd9 ID des fehlerhaften
Prozesses: 0x2434 Startzeit der fehlerhaften Anwendung: 0x01cd18dd0055ae83 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 52124eaf-84d3-11e1-9af7-8a7c5ddd869b
Error - 13.04.2012 16:33:04 | Computer Name = Margareth-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16421,
Zeitstempel: 0x4d76255d Name des fehlerhaften Moduls: Flash10x.ocx, Version: 10.3.183.10,
Zeitstempel: 0x4e764622 Ausnahmecode: 0xc0000005 Fehleroffset: 0x002b00e0 ID des fehlerhaften
Prozesses: 0x2da0 Startzeit der fehlerhaften Anwendung: 0x01cd19b11b35a742 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\windows\SysWOW64\Macromed\Flash\Flash10x.ocx Berichtskennung:
de16a4a9-85a7-11e1-9c16-8ebeeb3e5995
Error - 14.04.2012 04:26:06 | Computer Name = Margareth-PC | Source = SideBySide | ID = 16842787
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files
(x86)\windows live\photo gallery\MovieMaker.Exe". Fehler in Manifest- oder Richtliniendatei
"c:\program files (x86)\windows live\photo gallery\WLMFDS.DLL" in Zeile 8. Die
im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente
überein. Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition:
WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1". Verwenden Sie
das Programm "sxstrace.exe" für eine detaillierte Diagnose.
[ System Events ]
Error - 27.10.2012 17:25:33 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description =
Error - 27.10.2012 18:15:17 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description =
Error - 27.10.2012 18:15:21 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description =
Error - 28.10.2012 04:46:41 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 34001
Description =
Error - 28.10.2012 04:46:41 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description =
Error - 28.10.2012 04:47:52 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description =
Error - 28.10.2012 04:47:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description =
Error - 28.10.2012 04:59:13 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 31004
Description =
Error - 28.10.2012 05:16:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 34001
Description =
Error - 28.10.2012 05:16:53 | Computer Name = Margareth-PC | Source = ipnathlp | ID = 30013
Description =
< End of report >
Meine letztendliche Frage ist, ob der Virus/Wurm/Trojaner von meinem PC gelöscht ist, oder ob ich noch etwas tun muss.
Ich entschuldige mich noch einmal, falls ich etwas vergessen oder voreilige Schlüsse gezogen habe. Ich (14, weiblich) kann nicht von mir sagen, dass ich mich besonders gut auskenne, ich wollte ihn nur so schnell wie möglich loswerden.
Danke für die Hilfe!
Es reicht mir nur die Frage, ob ich ihn noch habe oder nicht.. Wenn möglich, bitte bald. Ich müsste mich nämlich bei einer Seite einloggen, aber mit der Angst, dass die "Macher" das Passwort herauskriegen, traue ich mich nicht ... |
