Worm:Win32/Vobfus.G kommt jeden Tag wieder

		myGully.com > Computer & Technik > Sicherheit & Anonymität
Worm:Win32/Vobfus.G kommt jeden Tag wieder

Willkommen

myGully
Board Board Regeln Hilfe/FAQ Jetzt registrieren! Toplist Boerse.SX

Links

Forum

Ersten ungelesenen Beitrag anzeigen

Themen-Optionen

Ansicht

14.01.12, 15:35	#1
jjjuno Anfänger Registriert seit: Sep 2010 Beiträge: 24 Bedankt: 8	Worm:Win32/Vobfus.G kommt jeden Tag wieder Jeden Tag löscht MS Essentials diesen Worm, aber er kommt immer wieder. Kann mir da jemand sagen woher bzw. Wie ich ihn los werde? OTL logfile created on: 15.01.2012 11:48:15 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\***\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 \| Country: Deutschland \| Language: DEU \| Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory \| 1.79 Gb Available Physical Memory \| 59.67% Memory free 6.00 Gb Paging File \| 4.34 Gb Available in Paging File \| 72.36% Paging File free Paging file location(s): [Binary data over 100 bytes] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 465.66 Gb Total Space \| 292.26 Gb Free Space \| 62.76% Space Free \| Partition Type: NTFS Drive D: \| 83.15 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Drive F: \| 931.51 Gb Total Space \| 593.34 Gb Free Space \| 63.70% Space Free \| Partition Type: NTFS Computer Name: *-PC \| User Name: * \| Logged in as Administrator. Boot Mode: Normal \| Scan Mode: Current user Company Name Whitelist: Off \| Skip Microsoft Files: Off \| No Company Name Whitelist: On \| File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\*\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Users\*\Desktop\autoruns.exe (Sysinternals - [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]) PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) PRC - C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) PRC - C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Programme\LOLReplay\LOLRecorder.exe (LOL Replay) PRC - C:\Users\*\AppData\Roaming\Tiyv\wyled.exe () PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe (TuneUp Software) PRC - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software) PRC - C:\Programme\OO Software\Defrag\oodtray.exe (O&O Software GmbH) PRC - C:\Programme\OO Software\Defrag\oodag.exe (O&O Software GmbH) PRC - C:\Programme\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - C:\Programme\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis) PRC - C:\Programme\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) PRC - C:\Programme\Acronis\TrueImageHome\TrueImageMonito r.exe (Acronis) PRC - C:\Programme\Acronis\TrueImageHome\OnlineBackupSta ndalone\TrueImageMonitor.exe (Acronis) PRC - C:\Programme\Pando Networks\Media Booster\PMB.exe () PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.) PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\IVT Corporation\BlueSoleil\BtTray.exe (IVT Corporation) PRC - C:\Programme\IVT Corporation\BlueSoleil\BlueSoleilCS.exe (IVT Corporation) PRC - C:\Programme\IVT Corporation\BlueSoleil\BsHelpCS.exe (IVT Corporation) PRC - C:\Windows\System32\StikyNot.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll () MOD - C:\Programme\Mozilla Firefox\mozjs.dll () MOD - C:\Programme\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () MOD - C:\Programme\LOLReplay\LOLUtils.dll () MOD - C:\Users\*\AppData\Roaming\Tiyv\wyled.exe () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Core\dd56ffc9d534de278c79420dcce058a4\System.C ore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\07cdef1a740151932dcf161f3306bd9c \PresentationFramework.Aero.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Pre sentationFramewo#\70e2ca33ffa52c743285dc5b4910a229 \PresentationFramework.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Pre sentationCore\7c94a121334aeca7553c7f01290740f0\Pre sentationCore.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Win dowsBase\d7a64c28cf0c90e6c48af4f7d6f9ed41\WindowsB ase.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db \System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Drawing\3b2cfd85528a27eb71dc41d8067359a1\Syste m.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Xml\130ad4d9719e566ca933ac7158a04203\System.Xm l.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem.Configuration\2d5bcbeb9475ef62189f605bcca1cec6 \System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Sys tem\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\msc orlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni .dll () MOD - C:\Programme\Acronis\TrueImageHome\Common\ti_manag ers.dll () MOD - C:\Programme\Pando Networks\Media Booster\PMB.exe () MOD - C:\Programme\WinRAR\RarExt.dll () ========== Win32 Services (SafeList) ========== SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated) SRV - (afcdpsrv) -- C:\Programme\Common Files\Acronis\CDP\afcdpsrv.exe (Acronis) SRV - (nvUpdatusService) -- C:\Programme\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Programme\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (TuneUp.Defrag) -- C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (TuneUp Software) SRV - (UxTuneUp) -- C:\Windows\System32\uxtuneup.dll (TuneUp Software) SRV - (OODefragAgent) -- C:\Program Files\OO Software\Defrag\oodag.exe (O&O Software GmbH) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (SpeedBoosterSvc) -- C:\Programme\Common Files\MC Common\BoostService.exe (mobile concepts) SRV - (MCDefragService) -- C:\Programme\Common Files\MC Common\AMDSrv.exe (mobile concepts) SRV - (AcrSch2Svc) -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe (Acronis) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation) SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation) SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.) SRV - (BlueSoleilCS) -- C:\Programme\IVT Corporation\BlueSoleil\BlueSoleilCS.exe (IVT Corporation) SRV - (BsHelpCS) -- C:\Programme\IVT Corporation\BlueSoleil\BsHelpCS.exe (IVT Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (MpKsl71de2fc6) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{0929A04C-2A8B-42EA-8996-F090BC2676DA}\MpKsl71de2fc6.sys (Microsoft Corporation) DRV - (afcdp) -- C:\Windows\System32\drivers\afcdp.sys (Acronis) DRV - (tdrpman273) Acronis Try&Decide and Restore Points filter (build 273) -- C:\Windows\system32\DRIVERS\tdrpm273.sys (Acronis) DRV - (timounter) -- C:\Windows\system32\DRIVERS\timntr.sys (Acronis) DRV - (snapman) -- C:\Windows\system32\DRIVERS\snapman.sys (Acronis) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (dtsoftbus01) -- C:\Windows\System32\drivers\dtsoftbus01.sys (DT Soft Ltd) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys () DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys () DRV - (RSUSBSTOR) -- C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.) DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia) DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia) DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia) DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia) DRV - (iBtFltCoex) -- C:\Windows\System32\drivers\iBtFltCoex.sys (Intel Corporation) DRV - (btmhsf) -- C:\Windows\System32\drivers\btmhsf.sys (Intel Corporation) DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation) DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation) DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (NVNET) -- C:\Windows\System32\drivers\nvmf6232.sys (NVIDIA Corporation) DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys (TuneUp Software) DRV - (VcommMgr) -- C:\Windows\System32\drivers\VCommMgr.sys (IVT Corporation.) DRV - (Btcsrusb) -- C:\Windows\System32\drivers\btcusb.sys (IVT Corporation.) DRV - (btnetBUs) -- C:\Windows\System32\drivers\btnetBus.sys () DRV - (IvtBtBUs) -- C:\Windows\System32\drivers\IvtBtBus.sys (IVT Corporation.) DRV - (BtHidBus) -- C:\Windows\System32\Drivers\BtHidBus.sys (IVT Corporation.) DRV - (VComm) -- C:\Windows\System32\drivers\VComm.sys (IVT Corporation.) DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation) DRV - (BT) -- C:\Windows\System32\drivers\btnetdrv.sys (IVT Corporation.) DRV - (BlueletSCOAudio) -- C:\Windows\System32\drivers\BlueletSCOAudio.sys (IVT Corporation.) DRV - (RsFx0103) -- C:\Windows\System32\drivers\RsFx0103.sys (Microsoft Corporation) DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia) DRV - (nvstor32) -- C:\Windows\system32\DRIVERS\nvstor32.sys (NVIDIA Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddrnw&s={searchTerms}&f=4 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 28 7A 7C 29 2E 6B CC 01 [binary data] IE - HKCU\..\URLSearchHook: {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No CLSID value found IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings: "ProxyServer" = http=;ftp=;https=; ========== FireFox ========== FF - prefs.js..browser.search.defaultengine: "Ask.com" FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)" FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentBar_DE Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2851647&SearchSource=3&q={s earchTerms}" FF - prefs.js..browser.search.order.1: "Search the web (Babylon)" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "google.de" FF - prefs.js..keyword.URL: "http://search.babylon.com/?AF=108976&babsrc=adbartrp&mntrId=345ac53500000000 00000024818514d0&q=" FF - prefs.js..network.proxy.gopher: "" FF - prefs.js..network.proxy.gopher_port: 0 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.type: 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\*\AppData\Local\Google\Update\1.3.21. 79\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\*\AppData\Local\Google\Update\1.3.21. 79\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\[email protected]: C:\Program Files\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_7.0 [2011.11.05 13:40:26 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extens ions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2011.12.31 13:13:14 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.01.14 17:17:21 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.11.01 21:11:56 \| 000,000,000 \| ---D \| M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Ex tensions\\[email protected]: C:\Program Files\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_6.0 [2011.11.05 13:40:36 \| 000,000,000 \| ---D \| M] [2011.08.15 17:12:23 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Extensions [2012.01.14 17:27:34 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Pro files\5qotzg9g.default\extensions [2011.11.21 19:13:19 \| 000,000,000 \| ---D \| M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Pro files\5qotzg9g.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.01.14 17:27:09 \| 000,000,000 \| ---D \| M] (uTorrentBar_DE Community Toolbar) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Pro files\5qotzg9g.default\extensions\{c840e246-6b95-475e-9bd7-caa1c7eca9f2} [2011.11.12 21:12:21 \| 000,000,000 \| ---D \| M] (Greasemonkey) -- C:\Users\*\AppData\Roaming\mozilla\Firefox\Pro files\5qotzg9g.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2011.08.23 21:16:36 \| 000,002,333 \| ---- \| M] () -- C:\Users\*\AppData\Roaming\Mozilla\Firefox\Pro files\5qotzg9g.default\searchplugins\askcom.xml [2011.08.16 09:08:20 \| 000,000,931 \| ---- \| M] () -- C:\Users\*\AppData\Roaming\Mozilla\Firefox\Pro files\5qotzg9g.default\searchplugins\conduit.xml [2012.01.14 17:17:21 \| 000,000,000 \| ---D \| M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\USERS\*\APPDATA\ROAMING\MOZILLA\FIREFOX\PRO FILES\5QOTZG9G.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI () (No name found) -- C:\USERS\*\APPDATA\ROAMING\MOZILLA\FIREFOX\PRO FILES\5QOTZG9G.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\*\APPDATA\ROAMING\MOZILLA\FIREFOX\PRO FILES\5QOTZG9G.DEFAULT\EXTENSIONS\GUICONFIG@SLOSD. NET.XPI [2011.12.21 08:42:29 \| 000,121,816 \| ---- \| M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.12.21 06:08:50 \| 000,001,392 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.12.21 06:02:40 \| 000,002,252 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2011.12.21 06:08:50 \| 000,001,153 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.12.21 06:08:50 \| 000,006,805 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.12.21 06:08:50 \| 000,001,178 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.12.21 06:08:50 \| 000,001,105 \| ---- \| M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:accepte dSuggestion}{googleriginalQueryForSuggestion}{go ogle:searchFieldtrialParameter}{google:instantFiel dTrialGroupParameter}sourceid=chrome&ie={inputEnco ding}&q={searchTerms} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldt rialParameter}{google:instantFieldTrialGroupParame ter}client=chrome&hl={language}&q={searchTerms} CHR - plugin: Shockwave Flash (Enabled) = C:\Users\*\AppData\Local\Google\Chrome\Applica tion\16.0.912.63\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\*\AppData\Local\Google\Chrome\Applica tion\16.0.912.63\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\*\AppData\Local\Google\Chrome\Applica tion\16.0.912.63\pdf.dll CHR - plugin: Java(TM) Platform SE 7 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Windows Live Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: Google Update (Enabled) = C:\Users\*\AppData\Local\Google\Update\1.3.21. 69\npGoogleUpdate3.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: Angry Birds = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmg eghloj\1.1.2.1_0\ CHR - Extension: TooManyTabs f\u00FCr Chrome = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\amigcgbheognjmfkaieeeadoji ibgbdp\1.8.1_0\ CHR - Extension: Dragon Age Legends: Remix 01 = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkiinhllammkfejicmjmhnanlb ifccfj\3_0\ CHR - Extension: YouTube = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldk acnbeo\4.2.3_0\ CHR - Extension: Der Pate: Die F\u00FCnf Familien = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\edfkoljdeffeedleidebkmmame pgbnbl\1.0_0\ CHR - Extension: PanicButton = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\faminaibgiklngmfpfbhmokfmn glamcm\0.14.1_0\ CHR - Extension: Easy Youtube Video Downloader = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmknocfkgffdgekmfonabppnhd gmghem\4.1_0\ CHR - Extension: Stoppuhr / Timer = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggnidjbcahhbnleinchgobfnab opeioh\3.4_0\ CHR - Extension: AdBlock = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbi glidom\2.5.12_0\ CHR - Extension: Apple Shooter = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\ingecjekeggadjbbklelffkgep pklgnm\2.1_0\ CHR - Extension: Google +1-Schaltfl\u00E4che = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgoepmocgafhnchmokaimcmloj pnlkhp\1.1.2_0\ CHR - Extension: Dragons of Atlantis = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\manlnjcghdempjdpndlcmaaobb ighhcf\1.5_0\ CHR - Extension: Plants vs Zombies = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmcegpfdgcoclcdfkjahiimlik dpnina\1.0.5_0\ CHR - Extension: Mehr Leistung und Videoformate fr dein HTML5 video = C:\Users\*\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacok ifdkhm\2.1.2.145_0\ O1 HOSTS File: ([2011.10.09 23:48:34 \| 000,001,163 \| ---- \| M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 192.150.18.108 O1 - Hosts: 127.0.0.1 activate.adobe.com:443 O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (no name) - AutorunsDisabled - No CLSID value found. O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [BtTray] C:\Program Files\IVT Corporation\BlueSoleil\BtTray.exe (IVT Corporation) O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation) O4 - HKLM..\Run: [OODefragTray] C:\Programme\OO Software\Defrag\oodtray.exe (O&O Software GmbH) O4 - HKLM..\Run: [SAOB Monitor] C:\Programme\Acronis\TrueImageHome\OnlineBackupSta ndalone\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis) O4 - HKCU..\Run: [] File not found O4 - HKCU..\Run: [{886696EB-EE6E-00A3-53B6-1548D7F323BA}] C:\Users\*\AppData\Roaming\Tiyv\wyled.exe () O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [Pando Media Booster] C:\Programme\Pando Networks\Media Booster\PMB.exe () O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\Explorer: NoEncryptOnMove = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: ConsentPromptBehaviorUser = 3 () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\pol icies\System: EnableLinkedConnections = 1 O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\*\AppData\Roaming\DVDVideoSoftIEHelpe rs\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll () O9 - Extra 'Tools' menuitem : Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Programme\WinHTTrack\WinHTTrackIEBar.dll () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 10.0.0) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] (Java Plug-in 1.7.0) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren** ] (Java Plug-in 1.7.0) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfac es\{1B6C8F70-93AC-4AD2-AE6F-3E6BEDFD9E30}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\System32\skype4com.dll (Skype Technologies) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.ex e (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 \| 000,000,024 \| ---- \| M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2009.09.11 03:39:40 \| 000,000,049 \| R--- \| M] () - D:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{6b388340-d49b-11e0-8ed3-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{6b388340-d49b-11e0-8ed3-806e6f6e6963}\Shell\AutoRun\command - "" = K:\Installer.exe O33 - MountPoints2\{9c8d1f27-c756-11e0-9f07-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{9c8d1f27-c756-11e0-9f07-806e6f6e6963}\Shell\AutoRun\command - "" = D:\setup.exe -- [2009.09.11 03:39:38 \| 000,057,437 \| R--- \| M] () O34 - HKLM BootExecute: (autocheck autochk ) O34 - HKLM BootExecute: (OODBS) O35 - HKLM\..comfile [open] -- "%1" % O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.01.15 11:45:56 \| 000,584,192 \| ---- \| C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.01.15 11:37:43 \| 000,638,784 \| ---- \| C] (Sysinternals - [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]) -- C:\Users\*\Desktop\autoruns.exe [2012.01.14 17:17:20 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Mozilla Firefox [2012.01.14 17:03:49 \| 000,000,000 \| -HSD \| C] -- C:\Config.Msi [2012.01.14 16:54:44 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Microsoft\Windows\S tart Menu\Programs\MCEdit [2012.01.14 16:54:41 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Local\MCEdit [2012.01.14 16:23:26 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\Glass Onion for W7 [2012.01.12 16:24:27 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\Skyrim textures [2012.01.11 15:40:15 \| 000,067,072 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\packager.dll [2012.01.11 15:40:14 \| 001,328,128 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\quartz.dll [2012.01.11 15:40:14 \| 000,514,560 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\qdvd.dll [2012.01.09 16:25:58 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\architecture [2012.01.09 15:48:42 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Documents\Nexus Mod Manager [2012.01.09 15:48:41 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Local\Black_Tree_Gaming [2012.01.08 16:35:32 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Oqetu [2012.01.08 16:35:32 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Feemi [2012.01.08 16:33:33 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Wuewe [2012.01.08 16:33:33 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Tiyv [2012.01.08 16:27:56 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.01.08 16:24:28 \| 019,348,800 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll [2012.01.08 16:24:28 \| 017,498,432 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll [2012.01.08 16:24:28 \| 011,149,632 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys [2012.01.08 16:24:28 \| 005,868,352 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll [2012.01.08 16:24:28 \| 002,506,048 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll [2012.01.08 16:24:28 \| 002,206,016 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll [2012.01.08 16:24:28 \| 000,061,248 \| ---- \| C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll [2012.01.08 16:01:43 \| 002,106,216 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_43.dll [2012.01.08 16:01:42 \| 001,998,168 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_43.dll [2012.01.08 16:00:38 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Electronic Arts [2012.01.08 15:41:22 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Documents\Battlefield 3 [2012.01.07 23:46:41 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\UniversalThemePatcher_20090 409 [2012.01.04 15:55:10 \| 000,000,000 \| ---D \| C] -- C:\Program Files (x86) [2011.12.31 13:12:44 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Common Files\PX Storage Engine [2011.12.30 15:39:47 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\Saves [2011.12.30 00:43:14 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Local\Daedalic Entertainment [2011.12.30 00:35:05 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Daedalic Entertainment [2011.12.24 23:07:09 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Local\Skyrim [2011.12.24 22:18:26 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Documents\Bluetooth [2011.12.24 22:18:24 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Local\bluesoleil [2011.12.24 22:14:13 \| 000,000,000 \| ---D \| C] -- C:\Program Files\IVT Corporation [2011.12.24 19:13:53 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2011.12.24 19:13:51 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Steam [2011.12.23 12:24:32 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Babylon [2011.12.23 12:24:32 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Babylon [2011.12.22 22:44:20 \| 000,167,968 \| ---- \| C] (Acronis) -- C:\Windows\System32\drivers\afcdp.sys [2011.12.22 22:44:17 \| 000,752,128 \| ---- \| C] (Acronis) -- C:\Windows\System32\drivers\tdrpm273.sys [2011.12.22 22:44:15 \| 000,600,928 \| ---- \| C] (Acronis) -- C:\Windows\System32\drivers\timntr.sys [2011.12.22 22:44:08 \| 000,170,528 \| ---- \| C] (Acronis) -- C:\Windows\System32\drivers\snapman.sys [2011.12.22 22:44:00 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acronis [2011.12.22 22:43:47 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Acronis [2011.12.22 22:43:46 \| 000,000,000 \| ---D \| C] -- C:\Program Files\Common Files\Acronis [2011.12.22 22:42:21 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\Acronis [2011.12.22 22:42:21 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Acronis [2011.12.22 18:21:06 \| 000,000,000 \| ---D \| C] -- C:\Users\*\AppData\Roaming\.minecraft [2011.12.21 21:42:39 \| 000,758,784 \| ---- \| C] (NVIDIA Corporation) -- C:\Windows\System32\cohelper.dll [2011.12.21 21:30:21 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\VS [2011.12.21 21:11:36 \| 001,076,736 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2011.12.21 21:11:36 \| 000,739,840 \| ---- \| C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2011.12.20 15:32:47 \| 000,000,000 \| ---D \| C] -- C:\Users\*\Desktop\Neuer Ordner (2) [2011.12.19 15:07:55 \| 000,000,000 \| R--D \| C] -- C:\Users\**\Documents\Notes [2011.12.17 17:56:47 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft [2011.12.17 17:56:31 \| 000,000,000 \| ---D \| C] -- C:\ProgramData\Blizzard [2011.12.17 17:54:48 \| 000,000,000 \| ---D \| C] -- C:\Users\Public\Documents\Blizzard Entertainment [4 C:\Windows\System32\.tmp files -> C:\Windows\System32\.tmp -> ] [2 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] [1 C:\Users\***\Desktop\.tmp files -> C:\Users\****\Desktop\.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.01.15 11:45:59 \| 000,584,192 \| ---- \| M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe [2012.01.15 11:38:49 \| 000,014,608 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.01.15 11:38:49 \| 000,014,608 \| -H-- \| M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.01.15 11:31:54 \| 000,005,063 \| ---- \| M] () -- C:\Windows\System32\LOCALSERVICE.INI [2012.01.15 11:31:54 \| 000,000,920 \| ---- \| M] () -- C:\Windows\System32\bscs.ini [2012.01.15 11:31:54 \| 000,000,100 \| ---- \| M] () -- C:\Windows\System32\LOCALDEVICE.INI [2012.01.15 11:31:31 \| 000,067,584 \| --S- \| M] () -- C:\Windows\bootstat.dat [2012.01.15 11:31:30 \| 2414,731,264 \| -HS- \| M] () -- C:\hiberfil.sys [2012.01.15 11:31:29 \| 000,288,294 \| ---- \| M] () -- C:\Windows\System32\oodbs.lor [2012.01.14 17:23:00 \| 000,414,368 \| ---- \| M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2012.01.14 17:17:23 \| 000,001,096 \| ---- \| M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.01.14 16:54:44 \| 000,002,039 \| ---- \| M] () -- C:\Users\*\Desktop\MCEdit.lnk [2012.01.14 16:54:44 \| 000,000,000 \| ---- \| M] () -- C:\Users\*\Documents\mcedit.ini [2012.01.13 21:21:32 \| 000,000,227 \| ---- \| M] () -- C:\Windows\System32\REMOTEDEVICE.INI [2012.01.10 21:33:30 \| 000,719,350 \| ---- \| M] () -- C:\Windows\System32\perfh009.dat [2012.01.10 21:33:29 \| 000,764,032 \| ---- \| M] () -- C:\Windows\System32\perfh007.dat [2012.01.10 21:33:29 \| 000,173,318 \| ---- \| M] () -- C:\Windows\System32\perfc007.dat [2012.01.10 21:33:29 \| 000,146,272 \| ---- \| M] () -- C:\Windows\System32\perfc009.dat [2012.01.10 14:36:38 \| 000,638,784 \| ---- \| M] (Sysinternals - [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ]) -- C:\Users\*\Desktop\autoruns.exe [2012.01.09 18:27:18 \| 000,147,027 \| ---- \| M] () -- C:\Users\*\Desktop\h76hhhh6h7.jpg [2012.01.09 16:52:14 \| 000,001,743 \| ---- \| M] () -- C:\Users\*\Desktop\TESV - Verknüpfung.lnk [2012.01.07 23:31:13 \| 000,073,660 \| ---- \| M] () -- C:\Users\*\Desktop\md5.zip [2012.01.05 21:13:36 \| 006,220,854 \| ---- \| M] () -- C:\Users\*\Desktop\ScreenShot3.bmp [2012.01.01 23:48:19 \| 000,013,566 \| ---- \| M] () -- C:\Users\*\Desktop\StikyNot - Verknüpfung.lnk [2011.12.31 13:13:17 \| 000,001,585 \| ---- \| M] () -- C:\Users\*\Desktop\DivX Movies.lnk [2011.12.31 13:12:51 \| 000,001,082 \| ---- \| M] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2011.12.30 13:17:55 \| 038,691,769 \| ---- \| M] () -- C:\Users\*\Desktop\Skyrim - Main theme.mp4 [2011.12.28 13:22:16 \| 002,378,796 \| ---- \| M] () -- C:\Users\*\Documents\AutoRuns.arn [2011.12.25 11:02:17 \| 000,002,035 \| ---- \| M] () -- C:\Windows\System32\SHORTCUT.INI [2011.12.24 23:04:34 \| 000,000,232 \| ---- \| M] () -- C:\Users\*\Desktop\The Elder Scrolls V Skyrim.lnk [2011.12.24 22:16:01 \| 000,000,032 \| ---- \| M] () -- C:\Windows\0 [2011.12.24 22:16:00 \| 000,000,000 \| ---- \| M] () -- C:\Windows\System32\BSPRINT.INI [2011.12.24 22:14:48 \| 000,000,000 \| -H-- \| M] () -- C:\Windows\System32\drivers\Msft_Kernel_iBtFltCoex _01009.Wdf [2011.12.24 22:14:11 \| 000,000,000 \| ---- \| M] () -- C:\Windows\System32\0 [2011.12.24 19:13:54 \| 000,000,875 \| ---- \| M] () -- C:\Users\Public\Desktop\Steam.lnk [2011.12.23 12:25:06 \| 000,001,030 \| ---- \| M] () -- C:\Users\*\Desktop\Your Unin-staller!.lnk [2011.12.23 12:24:42 \| 000,000,059 \| ---- \| M] () -- C:\user.js [2011.12.22 22:44:21 \| 000,167,968 \| ---- \| M] (Acronis) -- C:\Windows\System32\drivers\afcdp.sys [2011.12.22 22:44:17 \| 000,752,128 \| ---- \| M] (Acronis) -- C:\Windows\System32\drivers\tdrpm273.sys [2011.12.22 22:44:16 \| 000,600,928 \| ---- \| M] (Acronis) -- C:\Windows\System32\drivers\timntr.sys [2011.12.22 22:44:08 \| 000,170,528 \| ---- \| M] (Acronis) -- C:\Windows\System32\drivers\snapman.sys [2011.12.22 22:44:01 \| 000,001,097 \| ---- \| M] () -- C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk [2011.12.22 22:44:00 \| 000,001,527 \| ---- \| M] () -- C:\Users\Public\Desktop\Acronis Online Backup.lnk [2011.12.22 18:21:49 \| 001,230,833 \| ---- \| M] () -- C:\Users\*\Desktop\mcpatcher-2.3.0_01.exe [2011.12.20 15:32:45 \| 000,001,356 \| ---- \| M] () -- C:\Users\*\Desktop\Free YouTube to MP3 Converter.lnk [2011.12.19 15:07:52 \| 000,004,544 \| ---- \| M] () -- C:\Users\*\Desktop\Neues Journal-Dokument.jnt [2011.12.19 15:05:04 \| 000,001,120 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-854002496-847148289-3843007148-1001UA.job [2011.12.19 15:05:04 \| 000,001,068 \| ---- \| M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-854002496-847148289-3843007148-1001Core.job [2011.12.17 23:38:47 \| 000,001,649 \| ---- \| M] () -- C:\Users\*\Desktop\World of Warcraft.lnk [2011.12.17 22:05:00 \| 019,348,800 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll [2011.12.17 22:05:00 \| 017,498,432 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll [2011.12.17 22:05:00 \| 014,863,680 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvd3dum.dll [2011.12.17 22:05:00 \| 011,149,632 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys [2011.12.17 22:05:00 \| 007,677,248 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvwgf2um.dll [2011.12.17 22:05:00 \| 005,868,352 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll [2011.12.17 22:05:00 \| 002,506,048 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll [2011.12.17 22:05:00 \| 002,206,016 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll [2011.12.17 22:05:00 \| 002,095,424 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll [2011.12.17 22:05:00 \| 000,988,992 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvdispco32.dll [2011.12.17 22:05:00 \| 000,878,400 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvgenco32.dll [2011.12.17 22:05:00 \| 000,061,248 \| ---- \| M] (Khronos Group) -- C:\Windows\System32\OpenCL.dll [2011.12.17 22:05:00 \| 000,004,632 \| ---- \| M] () -- C:\Windows\System32\nvinfo.pb [2011.12.17 20:41:11 \| 002,561,856 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvsvcr.dll [2011.12.17 20:41:11 \| 000,108,352 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvmctray.dll [2011.12.17 20:41:11 \| 000,062,272 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvshext.dll [2011.12.17 20:40:51 \| 002,671,936 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvsvc.dll [2011.12.17 20:40:33 \| 003,836,224 \| ---- \| M] (NVIDIA Corporation) -- C:\Windows\System32\nvcpl.dll [2011.12.17 19:52:08 \| 000,001,329 \| ---- \| M] () -- C:\Users\*\Desktop\World of Warcraft-Installationsprogramm.lnk [2011.12.17 12:43:40 \| 000,406,336 \| ---- \| M] () -- C:\Windows\System32\nvStreaming.exe [2011.12.16 17:19:07 \| 000,000,054 \| ---- \| M] () -- C:\Users\**\Desktop\Links.cmd [4 C:\Windows\System32\.tmp files -> C:\Windows\System32\.tmp -> ] [2 C:\Windows\.tmp files -> C:\Windows\.tmp -> ] [1 C:\Users\***\Desktop\.tmp files -> C:\Users\****\Desktop\.tmp -> ] ========== Files Created - No Company Name ========== [2012.01.14 17:17:23 \| 000,001,108 \| ---- \| C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2012.01.14 17:17:23 \| 000,001,096 \| ---- \| C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2012.01.14 16:54:44 \| 000,002,039 \| ---- \| C] () -- C:\Users\***\Desktop\MCEdit.lnk [2012.01.14 16:54:44 \| 000,000,000 \| ---- \| C] () -- C:\Users\*\Documents\mcedit.ini [2012.01.09 18:27:21 \| 000,147,027 \| ---- \| C] () -- C:\Users\*\Desktop\h76hhhh6h7.jpg [2012.01.09 16:52:14 \| 000,001,743 \| ---- \| C] () -- C:\Users\*\Desktop\TESV - Verknüpfung.lnk [2012.01.07 23:31:31 \| 000,049,152 \| ---- \| C] () -- C:\Users\*\Desktop\md5.exe [2012.01.07 23:31:19 \| 000,073,660 \| ---- \| C] () -- C:\Users\*\Desktop\md5.zip [2012.01.05 21:13:35 \| 006,220,854 \| ---- \| C] () -- C:\Users\*\Desktop\ScreenShot3.bmp [2012.01.01 23:48:19 \| 000,013,566 \| ---- \| C] () -- C:\Users\*\Desktop\StikyNot - Verknüpfung.lnk [2011.12.31 13:13:17 \| 000,001,585 \| ---- \| C] () -- C:\Users\*\Desktop\DivX Movies.lnk [2011.12.31 13:12:51 \| 000,001,082 \| ---- \| C] () -- C:\Users\Public\Desktop\DivX Plus Player.lnk [2011.12.30 13:16:03 \| 038,691,769 \| ---- \| C] () -- C:\Users\*\Desktop\Skyrim - Main theme.mp4 [2011.12.30 13:04:44 \| 000,023,795 \| ---- \| C] () -- C:\Users\*\Desktop\EasyYoutubeDownloader4.1.cr x [2011.12.28 13:22:15 \| 002,378,796 \| ---- \| C] () -- C:\Users\*\Documents\AutoRuns.arn [2011.12.25 09:57:06 \| 000,002,035 \| ---- \| C] () -- C:\Windows\System32\SHORTCUT.INI [2011.12.24 23:04:34 \| 000,000,232 \| ---- \| C] () -- C:\Users\*\Desktop\The Elder Scrolls V Skyrim.lnk [2011.12.24 22:18:52 \| 000,000,227 \| ---- \| C] () -- C:\Windows\System32\REMOTEDEVICE.INI [2011.12.24 22:18:12 \| 000,005,063 \| ---- \| C] () -- C:\Windows\System32\LOCALSERVICE.INI [2011.12.24 22:18:12 \| 000,000,100 \| ---- \| C] () -- C:\Windows\System32\LOCALDEVICE.INI [2011.12.24 22:16:00 \| 000,000,000 \| ---- \| C] () -- C:\Windows\System32\BSPRINT.INI [2011.12.24 22:14:48 \| 000,000,000 \| -H-- \| C] () -- C:\Windows\System32\drivers\Msft_Kernel_iBtFltCoex _01009.Wdf [2011.12.24 22:14:11 \| 000,000,032 \| ---- \| C] () -- C:\Windows\0 [2011.12.24 22:14:11 \| 000,000,000 \| ---- \| C] () -- C:\Windows\System32\0 [2011.12.24 19:13:54 \| 000,000,875 \| ---- \| C] () -- C:\Users\Public\Desktop\Steam.lnk [2011.12.23 12:24:42 \| 000,000,059 \| ---- \| C] () -- C:\user.js [2011.12.22 22:44:01 \| 000,001,097 \| ---- \| C] () -- C:\Users\Public\Desktop\Acronis True Image Home 2011.lnk [2011.12.22 22:44:00 \| 000,001,527 \| ---- \| C] () -- C:\Users\Public\Desktop\Acronis Online Backup.lnk [2011.12.22 18:24:21 \| 001,230,833 \| ---- \| C] () -- C:\Users\*\Desktop\mcpatcher-2.3.0_01.exe [2011.12.21 21:42:39 \| 000,011,164 \| ---- \| C] () -- C:\Windows\System32\drivers\nvphy.bin [2011.12.20 15:32:45 \| 000,001,356 \| ---- \| C] () -- C:\Users\*\Desktop\Free YouTube to MP3 Converter.lnk [2011.12.19 15:07:52 \| 000,004,544 \| ---- \| C] () -- C:\Users\*\Desktop\Neues Journal-Dokument.jnt [2011.12.17 23:38:47 \| 000,001,649 \| ---- \| C] () -- C:\Users\*\Desktop\World of Warcraft.lnk [2011.12.17 17:56:29 \| 000,001,329 \| ---- \| C] () -- C:\Users\*\Desktop\World of Warcraft-Installationsprogramm.lnk [2011.12.17 13:23:01 \| 000,103,622 \| ---- \| C] () -- C:\Users\*\Desktop\ZombieCraftLaunch.jar [2011.12.17 12:43:40 \| 000,406,336 \| ---- \| C] () -- C:\Windows\System32\nvStreaming.exe [2011.12.16 15:15:49 \| 000,000,054 \| ---- \| C] () -- C:\Users\*\Desktop\Links.cmd [2011.12.02 22:03:23 \| 000,281,760 \| ---- \| C] () -- C:\Windows\System32\drivers\atksgt.sys [2011.12.02 22:03:22 \| 000,025,888 \| ---- \| C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011.10.16 18:06:04 \| 000,113,152 \| -HS- \| C] () -- C:\Windows\System32\SCX.dll [2011.10.16 18:06:00 \| 000,157,184 \| -HS- \| C] () -- C:\Windows\System32\SCS.dll [2011.09.22 17:50:30 \| 000,000,363 \| ---- \| C] () -- C:\ProgramData\Setting.dat [2011.09.22 17:50:30 \| 000,000,022 \| ---- \| C] () -- C:\Users\*\AppData\Roaming\UserFlag.ini [2011.09.04 19:12:03 \| 000,000,017 \| ---- \| C] () -- C:\Users\*\AppData\Local\resmon.resmoncfg [2011.09.01 18:33:19 \| 000,000,040 \| -HS- \| C] () -- C:\ProgramData\.zreglib [2009.09.07 15:42:42 \| 000,000,920 \| ---- \| C] () -- C:\Windows\System32\bscs.ini [2009.09.02 09:39:46 \| 000,028,672 \| ---- \| C] () -- C:\Windows\System32\BsMobileCSps.dll [2009.08.26 11:18:16 \| 000,029,192 \| ---- \| C] () -- C:\Windows\System32\drivers\btnetBus.sys [2009.07.14 09:47:43 \| 000,764,032 \| ---- \| C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 09:47:43 \| 000,295,922 \| ---- \| C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 09:47:43 \| 000,173,318 \| ---- \| C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 09:47:43 \| 000,038,104 \| ---- \| C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 05:57:37 \| 000,067,584 \| --S- \| C] () -- C:\Windows\bootstat.dat [2009.07.14 05:33:53 \| 004,296,104 \| ---- \| C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 \| 000,719,350 \| ---- \| C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 \| 000,291,294 \| ---- \| C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 \| 000,146,272 \| ---- \| C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 \| 000,031,548 \| ---- \| C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 \| 000,000,741 \| ---- \| C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 \| 000,215,943 \| ---- \| C] () -- C:\Windows\System32\dssec.dat [2009.07.14 00:55:01 \| 000,043,131 \| ---- \| C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 \| 000,073,728 \| ---- \| C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 \| 000,064,000 \| ---- \| C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 \| 000,673,088 \| ---- \| C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2012.01.14 18:21:35 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\.minecraft [2011.10.22 09:14:29 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\3v [2011.12.29 01:57:04 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Acronis [2011.08.30 16:38:57 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\AnvSoft [2011.11.08 19:17:22 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\AppBooster [2011.08.25 16:07:23 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\AppWork GmbH [2011.12.23 12:24:32 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Babylon [2011.09.07 19:05:30 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Bump Technologies, Inc [2011.09.24 19:20:50 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\com.adobe.downloada ssistant.AdobeDownloadAssistant [2011.12.06 19:01:40 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\DAEMON Tools Lite [2011.12.20 15:32:51 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\DVDVideoSoft [2011.11.21 19:13:18 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\DVDVideoSoftIEHelpe rs [2012.01.08 16:35:32 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Feemi [2011.09.12 15:55:08 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\FreeHideIP [2011.11.26 02:36:10 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\GHISLER [2011.10.10 18:21:59 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Kingsoft [2011.08.15 18:42:14 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\LolClient [2011.11.26 02:36:10 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\MAXON [2011.10.30 00:17:24 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\NetSpeedMonitor [2011.12.01 16:33:58 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\OpenOffice.org [2012.01.08 16:35:32 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Oqetu [2011.09.04 19:19:15 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\PC Suite [2011.09.22 17:51:56 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\PlatinumHideIP [2011.10.22 09:22:54 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\RadarSync [2011.08.27 22:10:57 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Rovio [2011.09.09 21:49:07 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Sinvise Systems [2011.09.03 09:47:20 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\smc [2011.09.03 00:44:34 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Synthesia [2011.08.15 17:14:26 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Thunderbird [2012.01.08 16:35:46 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Tiyv [2011.09.17 18:44:36 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\TS3Client [2011.08.15 17:06:31 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\TuneUp Software [2011.12.09 23:17:10 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Ubisoft [2011.10.13 14:18:42 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Uniblue [2011.12.09 23:19:00 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\URSoft [2011.11.10 15:14:12 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\uTorrent [2012.01.15 11:37:54 \| 000,000,000 \| ---D \| M] -- C:\Users\*\AppData\Roaming\Wuewe [2012.01.14 11:52:31 \| 000,032,640 \| ---- \| M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 1153 bytes -> C:\Users\*\Documents\TuneUp.eml:OECustomProper ty @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:1CE11B51 < End of report > OTL Extras logfile created on: 15.01.2012 11:48:15 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\*\Desktop Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 \| Country: Deutschland \| Language: DEU \| Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory \| 1.79 Gb Available Physical Memory \| 59.67% Memory free 6.00 Gb Paging File \| 4.34 Gb Available in Paging File \| 72.36% Paging File free Paging file location(s): [Binary data over 100 bytes] %SystemDrive% = C: \| %SystemRoot% = C:\Windows \| %ProgramFiles% = C:\Program Files Drive C: \| 465.66 Gb Total Space \| 292.26 Gb Free Space \| 62.76% Space Free \| Partition Type: NTFS Drive D: \| 83.15 Mb Total Space \| 0.00 Mb Free Space \| 0.00% Space Free \| Partition Type: CDFS Drive F: \| 931.51 Gb Total Space \| 593.34 Gb Free Space \| 63.70% Space Free \| Partition Type: NTFS Computer Name: *-PC \| User Name: *** \| Logged in as Administrator. Boot Mode: Normal \| Scan Mode: Current user Company Name Whitelist: Off \| Skip Microsoft Files: Off \| No Company Name Whitelist: On \| File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" () Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [OneNote.Open] -- C:\PROGRA~1\MIF5BA~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation) Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" () Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = Reg Error: Unknown registry data type -- File not found "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\DomainPr ofile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\Standard Profile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\SharedAccess\Parameters\FirewallPolicy\PublicPr ofile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall] "{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU "{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86 "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis True Image Home 2011 "{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware "{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86 "{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended "{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer "{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help "{0E850E20-07C3-40E5-875B-9D7CC907D67A}" = Media Add-ons für Acronis True Image Home 2011 "{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86 "{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack "{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen "{1C2B3CEA-482E-4453-B3E2-C9731337828A}" = Microsoft SQL Server 2008 Native Client "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions "{24CD85A3-6562-4C24-8257-27826C7CF7FE}" = O&O Defrag Professional "{25887983-54F3-4F55-A7C5-91229AD67C16}" = Bluesoleil 5.4.277.0 "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22 "{26A24AE4-039D-4CA4-87B4-2F83217000FF}" = Java(TM) 7 "{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0 "{2CAB55FA-A147-4215-81A6-E9A9038B7970}" = Plus Pack für Acronis True Image Home 2011 "{2F8B731A-5F2D-3EA8-8B25-C3E5E43F4BDB}" = Microsoft Visual C++ Compilers 2010 Standard - enu - x86 "{32A3A4F4-B792-11D6-A78A-00B0D0170000}" = Java(TM) SE Development Kit 7 "{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery "{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver "{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{41A01180-D9FD-3428-9FD6-749F4C637CBF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) "{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3 "{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared "{48561B98-C7F7-4AE2-A06B-84D2187ADA93}_is1" = Battlefield 3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files "{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser "{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack "{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client "{55EB7967-5BB1-4EA2-8AFF-B2F9E487E553}" = PC Connectivity Solution "{57BB52B7-6B7B-31F3-89F4-4EE8FE5CEF6D}" = Microsoft Help Viewer 1.1 "{5AB7D739-1735-3A9E-BE73-C43507CB4E6F}" = Microsoft Visual Studio 2010 Service Pack 1 "{5BD39911-A12F-4562-98BA-A6E03E3370B1}" = Microsoft SQL Server 2008 Database Engine Services "{5D5509EA-B85A-411E-AB75-59069A411876}" = COMPUTERBILD SPIELE Game-Center "{5D9ED403-94DE-3BA0-B1D6-71F4BDA412E6}" = Microsoft Visual C++ 2010 x86 Runtime - 10.0.40219 "{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM "{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools "{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86 "{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2 "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{793A260C-CDBF-499C-ABBA-B51E8E076867}_is1" = Uniblue PowerSuite "{7EE873AF-46BB-4B5D-BA6F-CFE4B0566E22}" = TuneUp Utilities Language Pack (de-DE) "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform "{84C176F9-1DAE-803C-5993-CF8703AE5841}" = Adobe Download Assistant "{86501894-E722-4385-A792-B7C2F28FAE7B}" = NetSpeedMonitor 2.5.4.0 x86 "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A0516415-ED61-419A-981D-93596DA74165}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{26454C26-D259-4543-AA60-3189E09C5F76}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = 2007 Microsoft Office Suite Service Pack 2 (SP2) "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{918A9082-6287-4D25-9002-5E5D5E4971CB}" = League of Legends "{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86 "{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker "{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195 "{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting "{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX "{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9ED9D728-9D4A-46D8-AF73-264CB0090AEA}" = AxCrypt 1.7.2687.0 "{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common "{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5 "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.2) - Deutsch "{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86 "{AF88496B-4BBA-4922-97E9-2582D3A28358}" = Nokia Connectivity Cable Driver "{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 290.53 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 290.53 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 290.53 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 290.36 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.11.1107 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.6.24 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services "{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974 "{C05BC4CD-C001-37E7-939C-3392604DFBEF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU "{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common "{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1" = Uniblue DriverScanner "{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant "{C668416A-9213-4058-B7F2-01A42D85559D}" = Microsoft SQL Server System CLR Types "{C83CD843-260E-3BD0-86BC-4E613BFDDE0A}" = Microsoft Help Viewer 1.1 Language Pack - DEU "{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack "{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program "{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU "{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform "{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU "{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack "{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer "{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86 "{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}" = TuneUp Utilities "{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform "{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86 "{DB24A9E5-A068-43DD-88D0-B51BED3C0B99}" = Nokia Suite "{DC6B4110-394D-45B9-A677-BA495D84CA63}" = Shutdown Timer "{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player "{DEEB5FE3-40F5-3C5B-8F85-5306EF3C08F4}" = Microsoft Visual C++ 2010 Express - DEU "{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10 "{E3B64CC5-C011-40C0-92BC-7316CD5E5688}" = Microsoft_VC100_CRT_SP1_x86 "{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker "{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1" = Uniblue SpeedUpMyPC "{E63E34A7-E552-412B-9E40-FD6FC5227ABA}_is1" = Uniblue RegistryBooster "{E9089B6A-1FDE-47F3-8D29-175F5B7A0722}" = Microsoft SQL Server 2008 R2 Management Objects "{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU] "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared "{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials "{FDB3B167-F4FA-461D-976F-286304A57B2A}" = Adobe AIR "{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files "504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0) "5513-1208-7298-9440" = JDownloader 0.9 "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.6 "chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE. 1" = Adobe Community Help "Cheat Engine 6.1_is1" = Cheat Engine 6.1 "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485 DF8CE.1" = Adobe Media Player "com.adobe.downloadassistant.AdobeDownloadAssistan t" = Adobe Download Assistant "DAEMON Tools Lite" = DAEMON Tools Lite "DivX Setup" = DivX-Setup "Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.14.1206 "FreeHideIP" = Free Hide IP "Genius Physik" = Genius Physik (remove only) "Harvey" = Harveys Neue Augen "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "LOLReplay" = LOLReplay "mc_AppBooster20_is1" = mobile concepts AppBooster 2.0 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack "Microsoft Help Viewer 1.1" = Microsoft Help Viewer 1.1 "Microsoft Help Viewer 1.1 Language Pack - DEU" = Microsoft Help Viewer 1.1 Language Pack - DEU "Microsoft Security Client" = Microsoft Security Essentials "Microsoft SQL Server 10" = Microsoft SQL Server 2008 "Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 "Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU "Microsoft Visual C++ 2010 Express - DEU" = Microsoft Visual C++ 2010 Express - DEU "Microsoft Visual Studio 2010 Service Pack 1" = Microsoft Visual Studio 2010 Service Pack 1 "Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) "Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU "Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de) "Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0) "nbi-glassfish-mod-3.1.1.12.0" = GlassFish Server Open Source Edition 3.1.1 "nbi-tomcat-7.0.14.0.0" = Apache Tomcat 7.0.14 "Nokia Suite" = Nokia Suite "NVIDIA Drivers" = NVIDIA Drivers "NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Patrimonium_is1" = Patrimonium "Pflanzen gegen Zombies" = Pflanzen gegen Zombies "ResourceHacker_is1" = Resource Hacker Version 3.6.0 "Steam App 72850" = The Elder Scrolls V: Skyrim "Totalcmd" = Total Commander (Remove or Repair) "TuneUp Utilities" = TuneUp Utilities "Unlocker" = Unlocker 1.9.1 "VLC media player" = VLC media player 1.1.11 "WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1 "WinLiveSuite" = Windows Live Essentials "WinRAR archiver" = WinRAR 4.01 (32-Bit) "World of Warcraft" = World of Warcraft "YU2010_is1" = Your Uninstaller! 7 ========== HKEY_CURRENT_USER Uninstall List ========== [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Uninstall] "Google Chrome" = Google Chrome ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 08.01.2012 12:03:41 \| Computer Name = ***-PC \| Source = Application Hang \| ID = 1002 Des*ion = Programm LolClient.exe, Version 2.0.2.12610 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 3ab4 Startzeit: 01ccce1efce67c30 Endzeit: 48 Anwendungspfad: C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0. 0.116\deploy\LolClient.exe Berichts-ID: 4da27bb1-3a12-11e1-8a9f-0024818514d0 Error - 09.01.2012 13:27:29 \| Computer Name = *-PC \| Source = Application Hang \| ID = 1002 Des*ion = Programm thunderbird.exe, Version 8.0.0.4326 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1630 Startzeit: 01cccedc3d68c890 Endzeit: 181 Anwendungspfad: C:\Program Files\Mozilla Thunderbird\thunderbird.exe Berichts-ID: 314ad43d-3ae7-11e1-9567-0024818514d0 Error - 09.01.2012 14:25:45 \| Computer Name = *-PC \| Source = SideBySide \| ID = 16842824 Des*ion = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\microsoft security client\MSESysprep.dll" in Zeile 10. Das imaging-Element wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements angezeigt, das von dieser Windows-Version nicht unterstützt wird. Error - 09.01.2012 14:25:54 \| Computer Name = *-PC \| Source = SideBySide \| ID = 16842785 Des**ion = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Microsoft Visual Studio 10.0\Common7\Packages\Debugger\X64\msvsmon.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="",processorArchitecture=" amd64",publicKeyToken="6595b64144ccf1df",type="win 32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 09.01.2012 14:27:43 \| Computer Name = ***-PC \| Source = SideBySide \| ID = 16842787 Des*ion = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Uniblue\driverscanner\DriverInstaller64.exe" . Fehler in Manifest- oder Richtliniendatei "c:\program files\Uniblue\driverscanner\Microsoft.VC90.CRT.MAN IFEST" in Zeile 11. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="amd64",p ublicKeyToken="1fc8b3b9a1e18e3b",type="win32",vers ion="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",pub licKeyToken="1fc8b3b9a1e18e3b",type="win32",versio n="9.0.21022.8". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 11.01.2012 15:46:42 \| Computer Name = *-PC \| Source = Application Hang \| ID = 1002 Des*ion = Programm TESV.exe, Version 1.3.10.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 117c Startzeit: 01ccd099b2ed3ec0 Endzeit: 86 Anwendungspfad: c:\program files\steam\steamapps\common\skyrim\TESV.exe Berichts-ID: f34843e9-3c8c-11e1-b0af-0024818514d0 Error - 13.01.2012 15:20:20 \| Computer Name = *-PC \| Source = SideBySide \| ID = 16842824 Des*ion = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\microsoft security client\MSESysprep.dll". Fehler in Manifest- oder Richtliniendatei "c:\program files\microsoft security client\MSESysprep.dll" in Zeile 10. Das imaging-Element wird als untergeordnetes Element des urn:schemas-microsoft-com:asm.v1^assembly-Elements angezeigt, das von dieser Windows-Version nicht unterstützt wird. Error - 13.01.2012 15:20:48 \| Computer Name = *-PC \| Source = SideBySide \| ID = 16842785 Des**ion = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Microsoft Visual Studio 10.0\Common7\Packages\Debugger\X64\msvsmon.exe". Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="",processorArchitecture=" amd64",publicKeyToken="6595b64144ccf1df",type="win 32",version="6.0.0.0"" konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe". Error - 13.01.2012 15:22:51 \| Computer Name = ***-PC \| Source = SideBySide \| ID = 16842787 Des*ion = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Uniblue\driverscanner\DriverInstaller64.exe" . Fehler in Manifest- oder Richtliniendatei "c:\program files\Uniblue\driverscanner\Microsoft.VC90.CRT.MAN IFEST" in Zeile 11. Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein. Verweis: Microsoft.VC90.CRT,processorArchitecture="amd64",p ublicKeyToken="1fc8b3b9a1e18e3b",type="win32",vers ion="9.0.21022.8". Definition: Microsoft.VC90.CRT,processorArchitecture="x86",pub licKeyToken="1fc8b3b9a1e18e3b",type="win32",versio n="9.0.21022.8". Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose. Error - 14.01.2012 12:19:06 \| Computer Name = *-PC \| Source = Application Hang \| ID = 1002 Des*ion = Programm firefox.exe, Version 9.0.1.4371 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1d3c Startzeit: 01ccd2d8052ace10 Endzeit: 94 Anwendungspfad: C:\Program Files\Mozilla Firefox\firefox.exe Berichts-ID: 79184759-3ecb-11e1-8a34-0024818514d0 [ OSession Events ] Error - 04.12.2011 13:18:37 \| Computer Name = *-PC \| Source = Microsoft Office 12 Sessions \| ID = 7001 Des*ion = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2140 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 08.01.2012 10:39:46 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 08.01.2012 10:39:47 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 08.01.2012 10:39:47 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 08.01.2012 10:39:48 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 09.01.2012 10:22:08 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 09.01.2012 10:22:08 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 09.01.2012 10:22:09 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 09.01.2012 10:22:09 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 09.01.2012 10:22:10 \| Computer Name = *-PC \| Source = Disk \| ID = 262155 Des*ion = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden. Error - 13.01.2012 12:58:42 \| Computer Name = *-PC \| Source = volsnap \| ID = 393252 Des***ion = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. < End of report >

14.01.12, 21:11	#2
mKey89 Malware Spezialist Registriert seit: Oct 2010 Ort: Germany Beiträge: 129 Bedankt: 767	Hallo, poste ein OTL-Log: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] und ein Malwarebytes-Log: [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] Am bestem im SPOILER. Lösche vorerst nichts. __________________ Gruß mkey89

14.01.12, 21:17	#3
ckjthedogmaster Chuck Norris sein Vater Registriert seit: Aug 2009 Beiträge: 5.172 Bedankt: 3.131	Nu, du versuchst wahrscheinlich, den Worm im normalen Modus zu löschen. -Das ist nicht möglich - Solltest du mit folgender Anweisung kein Erfolg haben, rate ich dir dein System zu sichern und eine Neuinstallation vorzunehmen. 1- Lade dir [ Link nur für registrierte Mitglieder sichtbar. Bitte einloggen oder neu registrieren ] runter Starte den Pc im abgesicherten Modus und starte cureit. Scane deine Festplatte (dauert bis 60 Min) und drücke im Anschluß Cure. Sollte das bei einigen Treffern nicht möglich sein, wähle Quarantine oder Löschen. Starte danach neu im normalen Modus und scanne deiine Platte mit nem vernünftigen Virenscanner, es sollte clean sein. Zudem kannst du dann auch mal Malwarebytes drüber laufen lassen und das Ergebnis posten und beobachten, ob die Infektion noch da ist.. Mfg

14.01.12, 21:19	#4
wolfgang1502 Erfahrenes Mitglied Registriert seit: Jul 2011 Beiträge: 658 Bedankt: 688	Autostart einträge checken, und jeden Träger USBSticks und co genauso

15.01.12, 15:56

mKey89

Malware Spezialist

Registriert seit: Oct 2010

Ort: Germany

Beiträge: 129

Bedankt: 767

mKey89 ist schon ein Name im Untergrund. | 630 Respekt Punkte

MBAM-Log nicht vergessen
Desweiteren auch den Ort und Dateiname des Fundes posten z.B. C:\Windows\xy.exe

Malware:

Zitat:

C:\Users\*****\AppData\Roaming\Tiyv\wyled.exe

__________________
Gruß
mkey89

« Vorheriges Thema | Nächstes Thema »

Forumregeln
Du kannst keine neue Themen eröffnen Du kannst keine Antworten verfassen Du kannst keine Anhänge posten Du kannst nicht deine Beiträge editieren BB code is An Smileys sind An. [IMG] Code ist An. HTML-Code ist Aus. Forum Rules

Gehe zu

Alle Zeitangaben in WEZ +1. Es ist jetzt 07:39 Uhr.

().