Sanctriell | 28.11.2009 02:55 | Zweite Teil Code:
========== Modules (SafeList) ==========
MOD - [2009.11.27 22:59:41 | 00,532,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\PorTed\Desktop\OTL.exe
MOD - [2006.05.03 21:53:54 | 00,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll
========== Win32 Services (SafeList) ==========
SRV - [2009.10.28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Programme\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009.08.17 17:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- E:\Programme\Avasthome\ashServ.exe -- (avast! Antivirus)
SRV - [2009.08.17 17:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- E:\Programme\Avasthome\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009.08.17 17:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- E:\Programme\Avasthome\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009.08.17 16:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- E:\Programme\Avasthome\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009.08.05 22:48:42 | 00,704,864 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2009.07.25 04:23:10 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2009.06.05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2009.03.05 14:21:54 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009.02.16 09:51:30 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
SRV - [2009.01.14 16:53:02 | 00,226,656 | ---- | M] (Microsoft Corp.) -- C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe -- (SeaPort)
SRV - [2008.12.12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Programme\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008.10.07 12:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
SRV - [2008.07.09 08:05:18 | 00,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\System32\ZoneLabs\vsmon.exe -- (vsmon)
SRV - [2008.05.07 20:43:09 | 00,297,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\termsrv32.dll -- (TermService)
SRV - [2008.05.01 23:40:44 | 03,032,360 | ---- | M] (Wacom Technology, Corp.) -- C:\WINDOWS\system32\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2007.08.24 05:59:20 | 00,068,464 | ---- | M] (Microsoft Corporation) -- E:\Programme\Microsoft Office 2007\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2007.08.24 02:19:12 | 00,443,776 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2007.01.15 16:14:38 | 00,774,144 | ---- | M] (Nero AG) -- E:\Programme\Nero 7\Nero BackItUp\NBService.exe -- (NBService)
SRV - [2007.01.15 15:01:56 | 00,266,240 | ---- | M] (Nero AG) -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
SRV - [2006.10.26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.04.01 18:51:48 | 00,217,600 | ---- | M] (Rocket Division Software) -- E:\Programme\Alcohol 120\StarWind\StarWindService.exe -- (StarWindService)
SRV - [2005.01.28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Live Search"
FF - prefs.js..browser.search.defaulturl: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - prefs.js..browser.search.selectedEngine: "Live Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://de.yahoo.com/"
FF - prefs.js..extensions.enabledItems: addictive_typing_lessons@tomkennedy.net:3.0
FF - prefs.js..extensions.enabledItems: {0545b830-f0aa-4d7e-8820-50a4629a56fe}:3.9.4
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}:6.0.05
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}:6.0.07
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: personas@christopher.beard:1.3.1
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 4
FF - prefs.js..extensions.enabledItems: 8
FF - prefs.js..extensions.enabledItems: 2
FF - prefs.js..extensions.enabledItems: foxmarks@kei.com:3.3.3
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.5.200812101546
FF - prefs.js..extensions.enabledItems: {e213bb8f-8ebd-11db-96b7-005056c00008}:3.0.0.62
FF - prefs.js..keyword.URL: "http://search.live.com/results.aspx?FORM=IEFM1&q="
FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\Programme\Java\jre6\lib\deploy\jqs\ff [2008.12.08 20:30:03 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Components: E:\Programme\firefox\components [2009.11.08 02:47:12 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.5\extensions\\Plugins: E:\Programme\firefox\plugins [2009.11.06 16:23:15 | 00,000,000 | ---D | M]
[2008.08.30 01:09:21 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Extensions
[2009.11.27 22:40:02 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions
[2009.09.29 09:14:04 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe}
[2009.02.14 23:52:28 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009.09.13 00:48:16 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\{e213bb8f-8ebd-11db-96b7-005056c00008}
[2009.09.03 09:52:38 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\addictive_typing_lessons@tomkennedy.net
[2009.10.30 09:47:51 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\firefox@tvunetworks.com
[2009.09.13 00:48:53 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\foxmarks@kei.com
[2009.10.30 09:47:46 | 00,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\extensions\personas@christopher.beard
[2009.04.30 09:29:13 | 00,001,632 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Mozilla\Firefox\Profiles\xx3746qi.default\searchplugins\live-search.xml
O1 HOSTS File: (856 bytes) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 serial.alcohol-soft.com
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\Programme\Microsoft Office 2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (Veoh Web Player Video Finder) - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Programme\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll (Veoh Networks Inc)
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Veoh Browser Plug-in) - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Programme\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll (Veoh Networks Inc)
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\alcwzrd.exe (RealTek Semicoductor Corp.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avast!] E:\Programme\Avasthome\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE (BIGDOG)
O4 - HKLM..\Run: [GrooveMonitor] E:\Programme\Microsoft Office 2007\Office12\GrooveMonitor.exe (Microsoft Corporation)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [iTunesHelper] E:\Programme\itunes\iTunesHelper.exe (Apple Inc.)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [mwavscan_autoscan] File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Programme\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SoundMan.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [ZoneAlarm Client] E:\Programme\ZoneAlarm\zlclient.exe (Zone Labs, LLC)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [Rainlendar2] E:\Programme\Rainlendar2\Rainlendar2.exe ()
O4 - HKCU..\Run: [rundll32.exe] File not found
O4 - HKCU..\Run: [WAB] C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\Macromedia\Common\34f1c00e19.exe ()
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Dokumente und Einstellungen\PorTed\Startmenü\Programme\Autostart\zipibn32.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 91 00 00 00 [binary data]
O8 - Extra context menu item: E&xport to Microsoft Excel - E:\Programme\Microsoft Office 2007\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\Programme\Microsoft Office 2007\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Programme\Microsoft Office 2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Programme\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/DE-DE/a-UNO1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1210258445382 (WUWebControl Class)
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} http://ca.com/de/securityadvisor/virusinfo/webscan.cab (WScanCtl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab (MSN Games - Installer)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\Programme\Microsoft Office 2007\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - E:\Programme\Microsoft Office 2007\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.05.07 20:47:22 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (*) - File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found
========== Files/Folders - Created Within 14 Days ==========
[2009.11.27 22:59:38 | 00,532,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\PorTed\Desktop\OTL.exe
[2009.11.27 22:40:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\VDLL.DLL
[2009.11.27 22:40:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\rundll16.exe
[2009.11.27 22:40:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\RUNDL132.EXE
[2009.11.27 22:40:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\logo1_.exe
[2009.11.27 22:40:58 | 00,000,000 | ---D | C] -- C:\WINDOWS\logo_1.exe
[2009.11.27 22:40:57 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\runouce.exe
[2009.11.27 22:35:21 | 00,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe
[2009.11.27 22:34:57 | 00,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\MicroWorld
[2009.11.27 22:34:46 | 00,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MicroWorld
[2009.11.27 20:20:11 | 00,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\PorTed\Recent
[2009.11.24 02:28:25 | 00,000,000 | ---D | C] -- C:\Programme\Microsoft Office Outlook Connector
[2009.04.17 18:40:47 | 00,047,360 | ---- | C] (VSO Software) -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\pcouffin.sys
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files - Modified Within 14 Days ==========
[2009.11.27 23:12:05 | 00,001,156 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Eigene Dateien\pinfect.zip
[2009.11.27 23:05:02 | 00,292,352 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Desktop\yonr32w8.exe
[2009.11.27 23:01:40 | 07,602,176 | -H-- | M] () -- C:\Dokumente und Einstellungen\PorTed\NTUSER.DAT
[2009.11.27 22:59:41 | 00,532,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\PorTed\Desktop\OTL.exe
[2009.11.27 22:37:24 | 00,000,028 | ---- | M] () -- C:\WINDOWS\Lic.xxx
[2009.11.27 22:35:19 | 00,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- C:\WINDOWS\System32\eEmpty.exe
[2009.11.27 22:14:10 | 00,192,832 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009.11.27 22:12:51 | 00,358,382 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml
[2009.11.27 22:11:32 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009.11.27 22:10:58 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009.11.27 22:09:22 | 11,030,1216 | ---- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat
[2009.11.27 22:09:22 | 01,288,784 | ---- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx
[2009.11.27 20:35:28 | 00,000,671 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Desktop\Rainlendar2.lnk
[2009.11.27 16:24:02 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2009.11.27 14:32:09 | 00,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009.11.27 14:22:41 | 00,000,004 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Anwendungsdaten\avdrn.dat
[2009.11.27 14:03:52 | 00,025,088 | ---- | M] () -- C:\Dokumente und Einstellungen\PorTed\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.11.26 13:27:04 | 00,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2009.11.26 00:32:39 | 00,002,047 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\iTunes.lnk
[2009.11.24 16:05:02 | 00,462,836 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2009.11.24 16:05:02 | 00,444,978 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009.11.24 16:05:02 | 00,086,076 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2009.11.24 16:05:02 | 00,072,602 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009.11.24 16:04:58 | 01,079,496 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009.11.23 02:22:23 | 00,081,920 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCFDRTM.VER
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
========== Files Created - No Company Name ========== |