Home » Viren, Trojaner & Malware Forum » Virenbefall: Licensevalidator » Themenansicht

Firefox Tipp: Instantfox - Quick Search Add-On!

Seite(n): 1 2 3

Antworten

Virenbefall: Licensevalidator

08.05.2012, 20:49

janinio

Member

Themenstarter

Beiträge: 18

#16 An sich garnichts da halt nur der prozess startet...und dann den ie aufrufen geht auch nich wirklich...

08.05.2012, 22:21

Swisstreasure

Moderator

Beiträge: 5694

#17 Downloade Dir bitte Dial a Fix von einem der folgenden Downloadspiegeln
• http://djlizard.net.nyud.net:8080/software/Dial-a-fix-v0.60.0.24.zip
• http://djlizard.net/software/Dial-a-fix-v0.60.0.24.zip
• Entpacke den Inhalt auf dem Desktop
• Starte die Dial-a-Fix.exe
Vista und Win7 User mit Rechtsklick "als Administrator starten"• Klicke auf

• Entferne die Hacken hier

• Danach klicke auf

• Dial-a-fix arbeitet nun einige Aufgaben ab, warte bis es komplett fertig ist (Ready).
• Wenn Dial-a-Fix fertig ist, klicke auf das Log-Symbol (rechts neben dem Hammer),
klicke auf Save und speichere das Log als Dial-a-fix.log auf dem Desktop.
• Poste das Log hier in den Thread.
• Klicke auf Exit und starte den Rechner neu.

09.05.2012, 16:37

janinio

Member

Themenstarter

Beiträge: 18

#18 ich hab den ordner nun auf den destop entpackt aber wenn ich die exe im ordner starte sagt er mir das das programm nicht für vista geeignet ist...

ich habe ausserdem mal wild gegooglet und alles deutet wohl darauf hin das das ein bankingtrojaner ist...hilft das weiter oder wusstest du das schon?

10.05.2012, 12:06

janinio

Member

Themenstarter

Beiträge: 18

#19 hm mir ist noch was aufgefallen...im Ordner C:\Users\Los jetzt\AppData\Roaming\TeamViewer befindet sich eine textdatei in einem unterordner und in einem anderen unterordner eine UpgradeChecker.exe ... gehört die vieleicht mit zu schadware?
weil iwas mit dem namen teamviewer hab ich nie installiert...

10.05.2012, 14:49

Swisstreasure

Moderator

Beiträge: 5694

#20 Ich dachte mir ESET hat dies bereits bereinigt. Aber du hast ja die Funde nicht löschen gelassen, mein Fehler. Und das Teamviewer ist ein gebräuchliches Fernwartungsprogramm welches nicht auffällt in einem Log

Fixen mit OTL

• Starte bitte die OTL.exe.
Vista-User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die

Textbox.

Code

:OTL
:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
UpgradeChecker"=-
:Files
c:\users\Los jetzt\AppData\Roaming\TeamViewer
C:\Users\Los jetzt\AppData\Roaming\Identities
:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Run Fix Button.
• Klick auf

.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument.
Kopiere nun den Inhalt hier in Code-Tags in Deinen Thread

10.05.2012, 16:00

janinio

Member

Themenstarter

Beiträge: 18

#21

Code

All processes killed
========== OTL ==========
========== REGISTRY ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\UpgradeChecker" not found.
========== FILES ==========
c:\users\Los jetzt\AppData\Roaming\TeamViewer\{B5062427-6FD0-45D1-AE6E-D6BD262CF08E} folder moved successfully.
c:\users\Los jetzt\AppData\Roaming\TeamViewer\{4EE0C053-C823-4E6E-9C76-22BE8C562F96} folder moved successfully.
c:\users\Los jetzt\AppData\Roaming\TeamViewer folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{FA39A96C-692E-4D2A-AF1F-F7A7E69D6BD2} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{E76A1A0C-A110-4340-8F45-41C2CDA668F1} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{E0B8A0C6-0390-460F-93CD-7C840606FDB2} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{DA1DDB26-FC81-49EB-8CB2-3867E6C8655F} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{CE949BDE-26CF-4E40-B7F9-AFA8F841A98E} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{CB34BB07-6A3F-4059-8ABC-D9DA7876B804} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{C6706BC1-FF53-48BD-B672-206BC5535031} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{C5BBA840-55D8-4F25-9501-66391E5DEC09} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{C5AB978A-EDC1-4206-92AB-F05798B9286B} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{BCEE0F10-358D-414E-B17A-438F32568F6C} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{B401F07E-E80C-499D-88AF-5C90DAD9A33C} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{A9BD184D-76D5-48ED-90B5-09D6905E24B3} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{9EA69473-25A0-4D17-A43C-DA0BFC5C2251} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{98E5ADE5-F2A6-4598-AF29-289557AFDA7B} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{974F38A7-0000-459C-A83F-EB2EED0650A5} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{96768CEF-8D1E-4C7E-86D8-53A50062F862} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{75DDBBCF-16F2-4DB8-B047-D2E6FA5E110F} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{5EAB9B32-7693-4570-9D62-06B4306DB1DD} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{5CF5E213-EF76-42A2-B1A9-F5EAD23241DF} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{5369677E-ECD5-4B0C-A185-18324A8323C1} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{4E3E53D7-544F-45D1-B014-B2EE13A93242} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{42E3E906-7AF1-459B-AD80-F2BE17F2054C} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{31A31DDE-40FB-437B-8B89-DE76E62EE2A0} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{2605D72F-5511-4585-A9D1-8D015A8EDAD8} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{22C141CF-1198-4845-A205-DDDFE9B54E04} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities\{01DB2DEE-7627-49B3-82A5-679CAF19283D} folder moved successfully.
C:\Users\Los jetzt\AppData\Roaming\Identities folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: AppData
->Temp folder emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Los jetzt
->Temp folder emptied: 2407216 bytes
->Temporary Internet Files folder emptied: 3770255 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 698813996 bytes
->Google Chrome cache emptied: 8655959 bytes
->Flash cache emptied: 18750 bytes
 
User: Public
->Temp folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 97788695 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 335992 bytes
 
Total Files Cleaned = 774,00 mb
 
 
OTL by OldTimer - Version 3.2.42.2 log created on 05102012_155153

Files\Folders moved on Reboot...
C:\Users\Los jetzt\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Los jetzt\AppData\Local\Temp\~DF1F41.tmp not found!
File\Folder C:\Users\Los jetzt\AppData\Local\Temp\~DF1F49.tmp not found!
C:\Users\Los jetzt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
File\Folder C:\Windows\temp\WFV3B83.tmp not found!

Registry entries deleted on Reboot...

ie ist bis jetz noch nicht gestartet

10.05.2012, 16:26

Swisstreasure

Moderator

Beiträge: 5694

#22 Tönt doch gut. Andere Probleme noch?

10.05.2012, 16:35

janinio

Member

Themenstarter

Beiträge: 18

#23 noch nicht...ich werd mir das noch mal genauer angucken die ruhe hier und dann meld ich mich noch mal

10.05.2012, 16:46

Swisstreasure

Moderator

Beiträge: 5694

#24

Ok mach das. Melde dich auf jedenfall. Dann kommen wir zum Abschluss.

12.05.2012, 11:04

janinio

Member

Themenstarter

Beiträge: 18

#25 großartig was aufgefallen ist mir nichts mehr
ie startet weiterhin nicht mehr
nur ein kleines problem noch...
wennn ich über systemsteuerung gehe um die autostartprogramme zu ändern, bekomme ich ne fehlermeldung: http://www.abload.de/image.php?img=unbenannovdql.jpg

13.05.2012, 19:59

Swisstreasure

Moderator

Beiträge: 5694

#26 Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
• Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die

Textbox.

Code

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

14.05.2012, 17:26

janinio

Member

Themenstarter

Beiträge: 18

#27 hier die otl.txt:

Code

OTL logfile created on: 14.05.2012 16:44:16 - Run 2
OTL by OldTimer - Version 3.2.42.2     Folder = C:\Users\Los jetzt\Desktop
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 47,85% Memory free
8,22 Gb Paging File | 6,40 Gb Available in Paging File | 77,86% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 78,12 Gb Total Space | 17,67 Gb Free Space | 22,61% Space Free | Partition Type: NTFS
Drive D: | 97,66 Gb Total Space | 77,83 Gb Free Space | 79,69% Space Free | Partition Type: NTFS
Drive E: | 146,48 Gb Total Space | 44,04 Gb Free Space | 30,06% Space Free | Partition Type: NTFS
Drive F: | 143,49 Gb Total Space | 75,08 Gb Free Space | 52,32% Space Free | Partition Type: NTFS
Drive G: | 5,12 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive I: | 1,91 Gb Total Space | 1,91 Gb Free Space | 99,90% Space Free | Partition Type: FAT
 
Computer Name: JANS-PC | User Name: Los jetzt | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2012.05.03 19:12:51 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Los jetzt\Desktop\OTL.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- D:\malewarebytes\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.02.28 18:38:56 | 001,987,976 | ---- | M] (LogMeIn Inc.) -- D:\hamachi\hamachi-2-ui.exe
PRC - [2011.04.02 19:01:51 | 000,075,136 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2010.09.13 15:56:02 | 000,168,960 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
PRC - [2010.06.02 16:58:20 | 000,246,520 | ---- | M] () -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.01.15 14:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.06.10 06:33:00 | 000,232,960 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWOW64\nvSCPAPISvr.exe
PRC - [2009.04.29 11:02:01 | 000,270,336 | R--- | M] (LG Electronics) -- C:\Users\Los jetzt\Bluebirds\BlueBirds.exe
PRC - [2008.12.12 19:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
PRC - [2008.12.12 19:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe
PRC - [2008.08.29 15:20:56 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2008.05.22 20:50:00 | 000,054,608 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe
PRC - [2007.10.25 10:05:40 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\naPrdMgr.exe
PRC - [2007.10.25 10:04:56 | 000,136,512 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe
PRC - [2007.10.25 10:03:28 | 000,103,744 | ---- | M] (McAfee, Inc.) -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2010.03.15 16:57:20 | 000,067,872 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2008.12.12 19:11:26 | 000,148,480 | ---- | M] () -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
MOD - [2008.12.12 19:11:26 | 000,097,280 | ---- | M] () -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\CFireWallCOM.dll
MOD - [2007.10.25 10:06:14 | 000,120,128 | ---- | M] () -- C:\Program Files (x86)\McAfee\Common Framework\naXML2_71.dll
 
 
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - [2009.10.08 21:35:18 | 000,842,056 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)
SRV:[b]64bit:[/b] - [2009.10.08 21:35:10 | 000,506,696 | ---- | M] (TuneUp Software) [On_Demand | Running] -- C:\Windows\SysNative\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV:[b]64bit:[/b] - [2009.07.15 11:48:20 | 000,035,144 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysNative\uxtuneup.dll -- (UxTuneUp)
SRV:[b]64bit:[/b] - [2008.01.19 10:00:52 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.05.11 18:30:52 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.04 21:44:09 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\malewarebytes\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.28 18:38:54 | 002,343,816 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.02.11 11:55:13 | 000,481,064 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.02 19:01:51 | 000,075,136 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2010.06.02 16:58:20 | 000,246,520 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.05.03 19:01:00 | 003,658,096 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GameMon.des -- (npggsvc)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.01.15 14:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.07.15 11:48:20 | 000,029,000 | ---- | M] (TuneUp Software) [Auto | Running] -- C:\Windows\SysWOW64\uxtuneup.dll -- (UxTuneUp)
SRV - [2009.06.10 06:33:00 | 000,232,960 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Windows\SysWOW64\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2009.05.21 21:35:32 | 000,923,136 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2009.03.29 21:42:16 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.12.12 19:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
SRV - [2008.08.29 15:20:56 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2008.05.22 20:50:00 | 000,154,432 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mcshield.exe -- (McShield)
SRV - [2008.05.22 20:50:00 | 000,054,608 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\vstskmgr.exe -- (McTaskManager)
SRV - [2007.10.25 10:03:28 | 000,103,744 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files (x86)\McAfee\Common Framework\FrameworkService.exe -- (McAfeeFramework)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2012.02.29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011.02.18 17:36:58 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:[b]64bit:[/b] - [2009.10.08 21:48:22 | 000,871,408 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:[b]64bit:[/b] - [2009.10.01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:[b]64bit:[/b] - [2009.08.05 06:18:34 | 000,057,856 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\L1E60x64.sys -- (L1E)
DRV:[b]64bit:[/b] - [2009.05.18 13:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:[b]64bit:[/b] - [2009.05.08 13:24:58 | 001,196,032 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:[b]64bit:[/b] - [2009.05.08 01:02:30 | 000,888,832 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\netr28ux.sys -- (netr28ux)
DRV:[b]64bit:[/b] - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\hamachi.sys -- (hamachi)
DRV:[b]64bit:[/b] - [2009.01.19 20:32:22 | 000,334,344 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:[b]64bit:[/b] - [2008.12.12 19:05:18 | 000,033,072 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\purendis.sys -- (purendis)
DRV:[b]64bit:[/b] - [2008.12.12 19:05:18 | 000,031,536 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\pnarp.sys -- (pnarp)
DRV:[b]64bit:[/b] - [2008.05.22 20:50:00 | 000,256,456 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfehidk.sys -- (mfehidk)
DRV:[b]64bit:[/b] - [2008.05.22 20:50:00 | 000,093,384 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeavfk.sys -- (mfeavfk)
DRV:[b]64bit:[/b] - [2008.05.22 20:50:00 | 000,080,200 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mfeapfk.sys -- (mfeapfk)
DRV:[b]64bit:[/b] - [2008.05.22 20:50:00 | 000,066,888 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\mfetdik.sys -- (mfetdik)
DRV:[b]64bit:[/b] - [2008.01.19 09:09:56 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\serscan.sys -- (StillCam)
DRV:[b]64bit:[/b] - [2006.11.04 09:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV - [2008.05.22 20:50:00 | 000,038,344 | ---- | M] (McAfee, Inc.) [Kernel | System | Stopped] -- C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\mferkdk.sys -- (mferkdk)
DRV - [2006.12.24 05:15:18 | 000,027,904 | ---- | M] (Compuware Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\xPADFL02.sys -- (XPADFL02)
DRV - [2005.03.09 20:50:16 | 000,033,792 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\libusb0.sys -- (libusb0)
DRV - [2005.01.04 11:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\npptNT2.sys -- (NPPTNT2)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?barid={9D445CF8-DD9B-42E3-B1D1-412584439934}
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files (x86)\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1351351
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={9D445CF8-DD9B-42E3-B1D1-412584439934}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?barid={9D445CF8-DD9B-42E3-B1D1-412584439934}
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files (x86)\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={9D445CF8-DD9B-42E3-B1D1-412584439934}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.defaultthis.engineName: "InnoGames Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.de/"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.67.0
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.1.1
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2682599&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2682599&SearchSource=3&q={searchTerms}"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.startup.homepage: "http://www.google.de/"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
 
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_235.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\itunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.08.25 20:07:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.05.11 18:30:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.05.02 19:10:47 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2011.08.25 20:07:15 | 000,000,000 | ---D | M]
 
[2009.10.08 21:31:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Extensions
[2012.05.10 16:37:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions
[2011.11.12 18:02:43 | 000,000,000 | ---D | M] (Complitly - Speed up your search with your personal search suggestions tool) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{33e0daa6-3af3-d8b5-6752-10e949c61516}
[2012.05.02 19:11:25 | 000,000,000 | ---D | M] (Winload) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2011.10.16 13:55:42 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2010.05.21 15:28:26 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.05.01 18:26:51 | 000,000,000 | ---D | M] (InnoGames Community Toolbar) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{c7478d43-2bd5-4844-98b8-c2a6aa9ed677}
[2010.02.06 15:59:41 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2011.10.16 13:55:26 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2011.04.01 15:33:19 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\battlefieldheroespatcher@ea.com
[2012.03.21 19:52:21 | 000,000,000 | ---D | M] (userAgentUpdater) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\jid1-aPwS0JCl36iLkQ@jetpack
[2011.11.12 18:02:06 | 000,000,000 | ---D | M] (Yontoo Layers) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\plugin@yontoo.com
[2010.08.23 12:21:04 | 000,000,000 | ---D | M] (RadioBar Toolbar) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\radiobar@toolbar
[2012.05.02 19:12:05 | 000,000,000 | ---D | M] (loadtbs) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\software@loadtubes.com
[2010.09.25 15:36:51 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Users\Los jetzt\AppData\Roaming\mozilla\Firefox\Profiles\rn1j5q49.default\extensions\vshare@toolbar
[2011.09.27 13:53:54 | 000,000,921 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\conduit.xml
[2010.10.24 16:06:12 | 000,000,694 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icq-search.xml
[2010.11.27 15:35:37 | 000,000,961 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icqplugin-1.xml
[2011.02.17 18:00:22 | 000,000,961 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icqplugin-2.xml
[2011.03.08 17:58:32 | 000,000,961 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icqplugin-3.xml
[2011.04.16 11:30:27 | 000,000,961 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icqplugin-4.xml
[2010.10.31 12:42:21 | 000,000,961 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\icqplugin.xml
[2011.12.25 16:04:32 | 000,003,974 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\sweetim.xml
[2010.08.23 12:21:17 | 000,001,598 | ---- | M] () -- C:\Users\Los jetzt\AppData\Roaming\Mozilla\Firefox\Profiles\rn1j5q49.default\searchplugins\web-search.xml
[2012.04.13 17:15:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011.10.22 12:21:36 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\LOS JETZT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RN1J5Q49.DEFAULT\EXTENSIONS\{46551EC9-40F0-4E47-8E18-8E5CF550CFB8}.XPI
() (No name found) -- C:\USERS\LOS JETZT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RN1J5Q49.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI
() (No name found) -- C:\USERS\LOS JETZT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RN1J5Q49.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\LOS JETZT\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\RN1J5Q49.DEFAULT\EXTENSIONS\UACONTROL@QZ.TSUGUMI.ORG.XPI
[2012.05.11 18:30:52 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.03.17 14:20:54 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.05.02 19:12:00 | 000,378,880 | ---- | M] (InfiniAd GmbH) -- C:\Program Files (x86)\mozilla firefox\plugins\npmieze.dll
[2011.10.05 16:21:18 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.05 16:21:18 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011.10.05 16:21:18 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.05 16:21:18 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.05 16:21:18 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.05 16:21:18 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
[color=#E56717]========== Chrome  ==========[/color]
 
CHR - default_search_provider: SweetIM Search (Enabled)
CHR - default_search_provider: search_url = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={9D445CF8-DD9B-42E3-B1D1-412584439934}
CHR - default_search_provider: suggest_url = 
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\18.0.1025.168\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.290.11 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U29 (Enabled) = C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: iTunes Application Detector (Enabled) = D:\itunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: PriceGong = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok\5.5.0_0\
CHR - Extension: YouTube = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.2_0\
CHR - Extension: Google-Suche = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0\
CHR - Extension: Complitly plugin for chrome = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda\1.1_0\
CHR - Extension: Skype Click to Call = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: Google Mail = C:\Users\Los jetzt\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0\
 
O1 HOSTS File: ([2012.05.06 20:14:20 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2:[b]64bit:[/b] - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\Los jetzt\AppData\Roaming\Complitly\64\Complitly64.dll (SimplyGen)
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Complitly) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\Los jetzt\AppData\Roaming\Complitly\Complitly.dll (SimplyGen)
O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\McAfee\VirusScan Enterprise\scriptcl.dll (McAfee, Inc.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files (x86)\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files (x86)\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (loadtbs) - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - C:\Users\Los jetzt\AppData\Roaming\loadtbs\toolbar.dll (InfiniAd GmbH)
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winload Toolbar) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - C:\Program Files (x86)\Winload\prxtbWin0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVD0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Softonic Deutsch Toolbar) - {8DBB6D8E-E4A6-4E3B-9753-AF78B226441C} - C:\Program Files (x86)\Softonic_Deutsch\tbSoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4:[b]64bit:[/b] - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files (x86)\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\malewarebytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [McAfeeUpdaterUI] C:\Program Files (x86)\McAfee\Common Framework\UdaterUI.exe (McAfee, Inc.)
O4 - HKLM..\Run: [nmctxth] C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
O4 - HKLM..\Run: [ShStatEXE] C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\SHSTAT.EXE (McAfee, Inc.)
O4 - HKCU..\Run: [bluebirds] C:\Users\Los jetzt\Bluebirds\BlueBirds.exe (LG Electronics)
O4 - HKCU..\Run: [Steam] F:\skyrim\Steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Los jetzt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk = E:\Xfire\Xfire.exe (Xfire Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:[b]64bit:[/b] - Extra context menu item: Download Video by Free YouTuBe Utility - D:\Free YouTuBe Utility\IEydown.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Los jetzt\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8:[b]64bit:[/b] - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O8 - Extra context menu item: Download Video by Free YouTuBe Utility - D:\Free YouTuBe Utility\IEydown.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Los jetzt\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - D:\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Web-Suche - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - D:\ICQ\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3CECD8E9-2C86-4522-BB03-5A2C31F1177D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{964B77C3-D6F3-4F26-AC45-DE0CB0B954CF}: DhcpNameServer = 192.168.2.1
O18:[b]64bit:[/b] - Protocol\Handler\cdo - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)
O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.06.10 15:32:42 | 000,000,044 | R--- | M] () - G:\Autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = ComFile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
ActiveX:[b]64bit:[/b] {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX:[b]64bit:[/b] {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:[b]64bit:[/b] {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:[b]64bit:[/b] {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:[b]64bit:[/b] {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:[b]64bit:[/b] {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX:[b]64bit:[/b] {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:[b]64bit:[/b] {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:[b]64bit:[/b] {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:[b]64bit:[/b] {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:[b]64bit:[/b] {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:[b]64bit:[/b] {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:[b]64bit:[/b] {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:[b]64bit:[/b] {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:[b]64bit:[/b] {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:[b]64bit:[/b] {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:[b]64bit:[/b] {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:[b]64bit:[/b] {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:[b]64bit:[/b] {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:[b]64bit:[/b] {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:[b]64bit:[/b] {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:[b]64bit:[/b] {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:[b]64bit:[/b] {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:[b]64bit:[/b] >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:[b]64bit:[/b] >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:[b]64bit:[/b] >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:[b]64bit:[/b] UxTuneUp - C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
NetSvcs:[b]64bit:[/b] AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: [b]4StoryPrePatch[/b] - hkey= - key= - E:\4story\4Story\PrePatch.exe (Zamiinc)
MsConfig:64bit - StartUpReg: [b]LicenseValidator[/b] - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: [b]LogMeIn Hamachi Ui[/b] - hkey= - key= - D:\hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
MsConfig:64bit - StartUpReg: [b]Malwarebytes' Anti-Malware[/b] - hkey= - key= - D:\malewarebytes\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
MsConfig:64bit - StartUpReg: [b]SweetIM[/b] - hkey= - key= - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (SweetIM Technologies Ltd.)
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2012.05.13 20:05:17 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Users\Los jetzt\Desktop\TFC.exe
[2012.05.11 18:30:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.05.11 18:30:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.05.09 16:35:03 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\Desktop\Dial-a-fix-v0.60.0.24
[2012.05.07 16:28:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.05.06 19:59:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.05.06 19:59:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.05.06 19:59:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.05.06 19:59:40 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.05.06 19:58:59 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.05.06 19:58:02 | 004,485,787 | R--- | C] (Swearware) -- C:\Users\Los jetzt\Desktop\ComboFix.exe
[2012.05.05 18:58:47 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\Desktop\Archiv
[2012.05.04 16:15:59 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2012.05.04 13:25:59 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.05.03 19:12:49 | 000,595,456 | ---- | C] (OldTimer Tools) -- C:\Users\Los jetzt\Desktop\OTL.exe
[2012.05.02 19:22:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Sophos
[2012.05.02 19:11:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winload
[2012.05.02 19:10:45 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\AppData\Roaming\loadtbs
[2012.04.25 19:36:35 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\AppData\Roaming\Opera
[2012.04.22 10:31:50 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan
[2012.04.22 10:31:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
[2012.04.20 14:10:20 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\AppData\Local\Conduit
[2012.04.16 17:58:28 | 000,000,000 | ---D | C] -- C:\Users\Los jetzt\AppData\Roaming\Mumble
[2012.04.16 17:46:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mumble
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2012.05.14 16:49:21 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.05.14 16:44:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.05.14 16:32:57 | 000,000,534 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job
[2012.05.14 16:30:05 | 000,075,715 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2012.05.14 16:30:04 | 000,075,715 | ---- | M] () -- C:\ProgramData\nvModes.001
[2012.05.14 16:29:52 | 000,003,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.05.14 16:29:52 | 000,003,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.05.14 16:29:51 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.05.14 16:29:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.05.14 16:29:41 | 4294,107,136 | -HS- | M] () -- C:\hiberfil.sys
[2012.05.13 20:05:18 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Users\Los jetzt\Desktop\TFC.exe
[2012.05.12 11:03:20 | 000,047,759 | ---- | M] () -- C:\Users\Los jetzt\Desktop\Unbenann.jpg
[2012.05.12 10:22:36 | 000,291,136 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.05.11 19:28:05 | 001,596,794 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.05.11 19:28:05 | 000,676,262 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.05.11 19:28:05 | 000,636,296 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.05.11 19:28:05 | 000,146,934 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.05.11 19:28:05 | 000,120,724 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.05.08 14:42:55 | 000,000,565 | ---- | M] () -- C:\Users\Public\Desktop\World of Warcraft - Stormblade.lnk
[2012.05.06 20:14:20 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2012.05.06 19:58:34 | 004,485,787 | R--- | M] (Swearware) -- C:\Users\Los jetzt\Desktop\ComboFix.exe
[2012.05.06 11:05:29 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001119.LCS
[2012.05.04 16:42:17 | 001,192,234 | ---- | M] () -- C:\Users\Los jetzt\Desktop\Rezension Die abenteuer von Aragorn.odt
[2012.05.03 19:12:51 | 000,595,456 | ---- | M] (OldTimer Tools) -- C:\Users\Los jetzt\Desktop\OTL.exe
[2012.05.02 16:48:08 | 000,002,025 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2012.04.22 10:10:55 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.04.22 10:10:55 | 000,280,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.04.22 10:10:07 | 000,215,128 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2012.04.16 18:00:38 | 000,002,386 | ---- | M] () -- C:\Users\Los jetzt\Documents\MumbleAutomaticCertificateBackup.p12
[2012.04.16 17:46:47 | 000,000,487 | ---- | M] () -- C:\Users\Public\Desktop\Mumble.lnk
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2012.05.12 11:03:20 | 000,047,759 | ---- | C] () -- C:\Users\Los jetzt\Desktop\Unbenann.jpg
[2012.05.08 14:42:55 | 000,000,565 | ---- | C] () -- C:\Users\Public\Desktop\World of Warcraft - Stormblade.lnk
[2012.05.06 19:59:45 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.05.06 19:59:45 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.05.06 19:59:45 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.05.06 19:59:45 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.05.06 19:59:45 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.05.03 18:32:20 | 001,192,234 | ---- | C] () -- C:\Users\Los jetzt\Desktop\Rezension Die abenteuer von Aragorn.odt
[2012.04.16 18:00:38 | 000,002,386 | ---- | C] () -- C:\Users\Los jetzt\Documents\MumbleAutomaticCertificateBackup.p12
[2012.04.16 17:46:47 | 000,000,487 | ---- | C] () -- C:\Users\Public\Desktop\Mumble.lnk
[2012.02.11 12:40:45 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2011.12.15 20:07:11 | 000,000,244 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.11.09 19:07:03 | 001,552,696 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2011.08.25 20:16:43 | 000,000,418 | ---- | C] () -- C:\Windows\hpwmdl28.dat.temp
[2011.08.25 19:49:16 | 000,241,149 | ---- | C] () -- C:\Windows\hpwins28.dat
[2011.08.05 12:38:29 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2011.07.09 15:39:25 | 000,000,510 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011.06.21 16:13:09 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.03.30 18:51:59 | 000,162,393 | ---- | C] () -- C:\Windows\Star Heritage - The Black Cobra Uninstaller.exe
[2011.02.19 15:16:30 | 000,000,000 | ---- | C] () -- C:\Users\Los jetzt\AppData\Roaming\8v@h
[2011.02.17 13:32:49 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2010.11.27 16:20:52 | 002,427,248 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_heroes.exe
[2010.10.17 10:49:52 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini
[2010.10.16 18:11:39 | 000,280,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2010.10.16 18:11:37 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2010.10.16 18:11:37 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2010.09.26 16:39:08 | 000,000,680 | ---- | C] () -- C:\Users\Los jetzt\AppData\Local\d3d9caps.dat
[2010.09.06 15:23:25 | 000,033,792 | ---- | C] () -- C:\Windows\SysWow64\drivers\libusb0.sys
[2010.08.31 16:21:43 | 000,021,840 | ---- | C] () -- C:\Windows\SysWow64\SIntfNT.dll
[2010.08.31 16:21:43 | 000,017,212 | ---- | C] () -- C:\Windows\SysWow64\SIntf32.dll
[2010.08.31 16:21:43 | 000,012,067 | ---- | C] () -- C:\Windows\SysWow64\SIntf16.dll
[2010.08.31 16:17:50 | 000,000,245 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010.07.22 11:20:26 | 000,069,632 | R--- | C] () -- C:\Windows\SysWow64\xmltok.dll
[2010.07.22 11:20:26 | 000,036,864 | R--- | C] () -- C:\Windows\SysWow64\xmlparse.dll
[2010.07.01 11:21:44 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\apache.dll
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2012.04.20 15:01:34 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\.minecraft
[2010.09.29 19:39:58 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\ACD Systems
[2009.10.09 20:32:59 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Activision
[2009.10.24 13:42:17 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Atari
[2012.01.03 21:15:04 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Audacity
[2011.10.09 17:44:32 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Baba
[2012.03.27 16:34:23 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\CadSoft
[2011.11.12 18:06:27 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Complitly
[2009.10.08 21:54:23 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\DAEMON Tools Lite
[2010.07.21 17:23:34 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Dev-Cpp
[2010.05.21 15:28:26 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\DVDVideoSoftIEHelpers
[2010.04.17 16:43:50 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\DynaGeo
[2011.03.31 15:53:06 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Feuerwache
[2011.07.15 14:39:15 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\go
[2011.02.22 16:34:01 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Hunspell
[2011.10.16 13:55:52 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\ICQ
[2009.10.09 20:54:19 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\JewelMatch2
[2009.10.19 12:04:30 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Leadertech
[2012.05.02 19:12:05 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\loadtbs
[2010.08.06 14:15:11 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
[2011.06.18 14:16:55 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2012.05.02 18:35:39 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Mumble
[2011.03.09 21:44:01 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Ohsa
[2010.06.29 18:46:24 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\OpenOffice.org
[2012.04.25 19:36:35 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Opera
[2010.06.13 10:38:11 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Playrix Entertainment
[2011.08.01 16:46:26 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\ProtectDisc
[2010.09.18 16:10:56 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Sierra Entertainment
[2010.07.19 19:12:59 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Stardock
[2012.02.06 18:49:37 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\TS3Client
[2009.10.08 21:35:09 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\TuneUp Software
[2011.10.15 11:34:28 | 000,000,000 | ---D | M] -- C:\Users\Los jetzt\AppData\Roaming\Zyexi
[2012.05.14 16:32:57 | 000,000,534 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job
[2012.05.13 22:39:05 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Custom Scans ==========[/color]
 
[color=#A23BEC]< %SYSTEMDRIVE%\*. >[/color]
[2012.05.07 16:28:21 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009.10.10 03:19:22 | 000,000,000 | ---D | M] -- C:\Boot
[2012.05.11 19:30:40 | 000,000,000 | ---D | M] -- C:\Config.Msi
[2006.11.02 17:41:02 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.10.08 17:57:53 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.03.06 13:34:06 | 000,000,000 | ---D | M] -- C:\Games
[2009.10.08 18:05:49 | 000,000,000 | ---D | M] -- C:\Intel
[2009.10.10 01:45:57 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.03.05 21:43:21 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.05.11 18:30:54 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.05.11 18:30:54 | 000,000,000 | ---D | M] -- C:\ProgramData
[2009.10.08 17:57:53 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.12.11 12:12:02 | 000,000,000 | ---D | M] -- C:\PWRD
[2012.05.06 20:27:44 | 000,000,000 | ---D | M] -- C:\Qoobox
[2012.05.08 14:35:28 | 000,000,000 | ---D | M] -- C:\QUARANTINE
[2012.05.08 14:43:14 | 000,000,000 | ---D | M] -- C:\Stormblade
[2012.05.14 16:46:31 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.02.04 14:44:20 | 000,000,000 | ---D | M] -- C:\Users
[2012.05.06 20:15:17 | 000,000,000 | ---D | M] -- C:\Windows
[2012.05.04 13:25:59 | 000,000,000 | ---D | M] -- C:\_OTL
 
[color=#A23BEC]< %PROGRAMFILES%\*.exe >[/color]
 
[color=#A23BEC]< %LOCALAPPDATA%\*.exe >[/color]
 
[color=#A23BEC]< %systemroot%\*. /mp /s >[/color]
 
[color=#A23BEC]< MD5 for: EXPLORER.EXE  >[/color]
[2009.10.08 19:16:13 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2009.10.08 19:16:12 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2009.10.08 19:16:13 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2009.10.08 19:16:12 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2006.11.02 13:15:52 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=5D768BEB711FF67ADC8FAD4E2F6ABB02 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_ab9c809a352ecf21\explorer.exe
[2009.04.11 00:10:18 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\ERDNT\cache86\explorer.exe
[2009.04.11 00:10:18 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\explorer.exe
[2009.04.11 00:10:18 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2009.10.08 19:15:33 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_b61f6f46696c67ab\explorer.exe
[2009.10.08 19:16:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2009.10.08 19:15:32 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=819D88EC82C2C44B556DC32ED22044DE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_ac3dc19d4e3a6405\explorer.exe
[2009.10.08 19:16:12 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009.10.08 19:15:32 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_b6926bef829b2600\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.10 23:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2009.10.08 19:16:12 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2009.10.08 19:16:12 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.19 10:00:15 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2009.10.08 19:15:33 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=FCBF8AC1855EF986CDEC2387760F71C6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_abcac4f4350ba5b0\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_b5f12aec698f911c\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
[color=#A23BEC]< MD5 for: REGEDIT.EXE  >[/color]
[2006.11.02 13:16:04 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=272D4789B7BAAEDDE73E85A380A670DD -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_4e168eec974b06f9\regedit.exe
[2008.01.19 10:00:30 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\SysWOW64\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_5aa1fb3ac896d9c8\regedit.exe
[2008.01.19 10:00:30 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=5DFBCE56E689D90AE9E2FB278F80058E -- C:\Windows\ERDNT\cache86\regedit.exe
[2008.01.19 10:00:30 | 000,161,792 | ---- | M] (Microsoft Corporation) MD5=5DFBCE56E689D90AE9E2FB278F80058E -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_504d50e8943617cd\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_586b393ecbabc8f4\regedit.exe
 
[color=#A23BEC]< MD5 for: USERINIT.EXE  >[/color]
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\ERDNT\cache86\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
[2006.11.02 13:16:15 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=46D5B6B80E4A5997F508F938F96B7628 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_3610939d8d22586d\userinit.exe
[2008.01.19 10:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\ERDNT\cache64\userinit.exe
[2008.01.19 10:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\SysNative\userinit.exe
[2008.01.19 10:00:41 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
[color=#A23BEC]< MD5 for: WININIT.EXE  >[/color]
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\ERDNT\cache86\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\SysWOW64\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2008.01.19 10:00:45 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\ERDNT\cache64\wininit.exe
[2008.01.19 10:00:45 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\SysNative\wininit.exe
[2008.01.19 10:00:45 | 000,123,904 | ---- | M] (Microsoft Corporation) MD5=117EA87DF785CA1B9D821F6F213DCE07 -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_8d115452bcae17d8\wininit.exe
[2006.11.02 13:16:20 | 000,122,368 | ---- | M] (Microsoft Corporation) MD5=6F92CE5B50283B0C0A7A539ED552039A -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_8ada9256bfc30704\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
[color=#A23BEC]< MD5 for: WINLOGON.EXE  >[/color]
[2009.04.11 00:11:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\ERDNT\cache64\winlogon.exe
[2009.04.11 00:11:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\SysNative\winlogon.exe
[2009.04.11 00:11:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.19 10:00:45 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.10 23:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 13:16:20 | 000,397,312 | ---- | M] (Microsoft Corporation) MD5=9642EED809219A2F914DD8E40A09C48B -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_c9aada9e9063dc57\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
[color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >[/color]
 
[color=#A23BEC]< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >[/color]

< End of report >

ne extra.txt kam dieses mal nicht...kp warum

15.05.2012, 14:18

Swisstreasure

Moderator

Beiträge: 5694

#28 Kommt die Meldung nach dem TFC Clean immernoch?

15.05.2012, 17:46

janinio

Member

Themenstarter

Beiträge: 18

#29 ne alles super...scheint alles zu funktionieren

hier schon mal ein großes dankeschön

15.05.2012, 21:43

Swisstreasure

Moderator

Beiträge: 5694

#30 Tool-Bereinigung mit OTL

Wir werden nun die CleanUp!-Funktion von OTL nutzen, um die meisten Programme, die wir zur Bereinigung installiert haben, wieder von Deinem System zu löschen.

• Bitte lade Dir (falls noch nicht vorhanden) OTL von OldTimer herunter.
• Speichere es auf Deinem Desktop.
• Doppelklick auf OTL.exe um das Programm auszuführen.
• Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
• Klicke auf den Button "Bereinigung"
• OTL fragt eventuell nach einem Neustart.

Sollte es dies tun, so lasse dies bitte zu.

Anmerkung: Nach dem Neustart werden OTL und andere Helferprogramme, die Du im Laufe der
Bereinigung heruntergeladen hast, nicht mehr vorhanden sein. Sie wurden entfernt. Es ist daher Ok, wenn diese Programme nicht mehr vorhanden sind. Sollten noch welche übrig geblieben sein, lösche sie manuell.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
• Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
• Windows Updates
• Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
• Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
• Gehe sicher das die automatischen Updates aktiviert sind.
• Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software
• Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz
• MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
• WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen
• SpywareBlaster
Eine kurze Einführung findest du Hier
• MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
• WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
• Opera
• Mozilla Firefox.

Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
• NoScript
Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.

• AdblockPlus
Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts
• Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
• verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
• Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
• Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Freiwillige Spende

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren:

Seite(n): 1 2 3