![[HaBo]](/styles/default/logoklein.png)
Windows 7 aus Sicherheitsgründen blockiert 50€ für Freischaltung zahlen HILFE
- Themenstarter macphercy
- Beginndatum
- Status
OTL logfile created on: 2/26/2012 12:12:33 PM - Run 1
OTL by OldTimer - Version 3.2.33.2 Folder = C:\Users\Marco\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2.93 Gb Total Physical Memory | 2.03 Gb Available Physical Memory | 69.06% Memory free
5.86 Gb Paging File | 5.07 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 177.91 Gb Total Space | 130.89 Gb Free Space | 73.57% Space Free | Partition Type: NTFS
Drive D: | 100.08 Gb Total Space | 2.57 Gb Free Space | 2.57% Space Free | Partition Type: NTFS
Computer Name: MARCO-PC | User Name: Marco | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/02/26 11:54:57 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
PRC - [2012/02/19 16:09:23 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/08/01 22:51:02 | 000,484,008 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avscan.exe
PRC - [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2012/02/19 16:09:23 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/05/21 17:28:49 | 006,271,136 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2010/06/17 14:27:02 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
========== Win32 Services (SafeList) ==========
SRV - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/08/01 22:51:00 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/06/14 00:10:50 | 000,332,272 | ---- | M] (Google Inc.) [On_Demand | Stopped] -- C:\ProgramData\Partner\Partner.exe -- (Partner Service)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - [2011/10/01 08:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 08:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 08:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 08:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/08/01 22:51:07 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/08/01 22:51:07 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/26 00:50:17 | 000,015,656 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rtport.sys -- (rtport)
DRV - [2010/06/17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/12/14 21:44:42 | 001,245,696 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Facemoods Search
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/19 16:09:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
[2011/05/21 17:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Extensions
[2012/02/13 16:40:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions
[2012/01/26 21:18:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/02/13 16:40:03 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/11/12 15:10:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012/02/19 16:09:23 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/06 08:25:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/02/06 08:25:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/06 08:25:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/21 20:55:07 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/02/06 08:24:59 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/06 08:24:59 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/06 08:24:59 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [{F1FF546D-77C1-11DF-9425-806E6F6E6963}] C:\Users\Marco\AppData\Roaming\Microsoft\torrent.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Marco\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A01204E6-3498-4762-BE85-5AE5592765BC}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B7770039-0302-455A-9976-A8FA47182CD1}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/02/26 11:54:52 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
[2012/02/26 11:51:11 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\Avira
[2012/02/24 18:28:51 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\musikkkk
[2012/02/21 16:21:10 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\musik
[2012/02/16 12:06:14 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/02/09 13:45:01 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\verkaufbilder tds
[2012/02/03 14:42:10 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\City Interactive
[2012/02/01 11:01:53 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\lustige pics
[2012/01/28 20:32:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III
[2012/01/28 20:32:28 | 000,000,000 | ---D | C] -- C:\Program Files\Warcraft III
[2012/01/28 20:32:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Blizzard Entertainment
[2012/01/28 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Marco\Warcraft III 1.21b ROC Installer deDE
[2012/01/28 16:04:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III Demo
[2012/01/28 15:56:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012/01/28 15:56:33 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
========== Files - Modified Within 30 Days ==========
[2012/02/26 11:54:57 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
[2012/02/26 11:50:41 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/02/26 11:50:36 | 3150,561,280 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/26 11:49:58 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 11:49:58 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 11:44:28 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/25 22:31:00 | 000,001,098 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/24 18:18:05 | 000,654,610 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/02/24 18:18:05 | 000,616,452 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/02/24 18:18:05 | 000,130,192 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/02/24 18:18:05 | 000,106,574 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/02/19 22:31:03 | 000,072,591 | ---- | M] () -- C:\Users\Marco\Desktop\selbstbeherrschung.jpg
[2012/02/16 23:33:53 | 000,157,665 | ---- | M] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.jpg
[2012/02/16 23:25:45 | 000,236,515 | ---- | M] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.png
[2012/02/16 14:42:34 | 000,277,656 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/02/15 16:15:09 | 000,064,544 | ---- | M] () -- C:\Users\Marco\Desktop\cocaine.jpg
[2012/02/14 11:58:59 | 000,026,264 | ---- | M] () -- C:\Users\Marco\Desktop\379080_255728911164272_100001814955717_650468_191624065_n.jpg
[2012/02/08 10:52:57 | 000,023,961 | ---- | M] () -- C:\Users\Marco\Desktop\wetter.jpg
[2012/02/08 10:52:27 | 000,069,276 | ---- | M] () -- C:\Users\Marco\Desktop\schänderinnen.jpg
[2012/02/08 10:52:01 | 000,041,012 | ---- | M] () -- C:\Users\Marco\Desktop\alkohol.jpg
[2012/02/02 10:42:45 | 000,084,253 | ---- | M] () -- C:\Users\Marco\Desktop\2010-09-17-Titanic.jpg
[2012/02/02 10:38:22 | 000,104,050 | ---- | M] () -- C:\Users\Marco\Desktop\2010-06-23-To go.jpg
[2012/02/02 10:35:39 | 000,074,044 | ---- | M] () -- C:\Users\Marco\Desktop\2010-03-30-2010-30-03-Verdammt!.jpg
[2012/02/02 10:15:18 | 000,096,739 | ---- | M] () -- C:\Users\Marco\Desktop\2011-03-03-Papa Schlumpf.jpg
[2012/02/02 10:13:33 | 000,098,570 | ---- | M] () -- C:\Users\Marco\Desktop\2011-04-22-Clap your hands.jpg
[2012/02/01 10:32:07 | 000,030,830 | ---- | M] () -- C:\Users\Marco\Desktop\Kontoauszug_339164__Nr.001_vom_01.02.2012_20120201103157.pdf
[2012/01/31 15:06:06 | 000,000,458 | ---- | M] () -- C:\Users\Marco\Desktop\deutsche sprüche.rtf
[2012/01/29 22:18:01 | 000,098,744 | ---- | M] () -- C:\Users\Marco\Desktop\fahrschule gruss.jpg
[2012/01/28 20:32:55 | 000,001,037 | ---- | M] () -- C:\Users\Marco\Desktop\Warcraft III.lnk
[2012/01/28 15:54:50 | 000,488,848 | ---- | M] () -- C:\Users\Marco\Desktop\installer_warcraft_iii_the_frozen_throne.exe
[2012/01/28 09:44:44 | 000,041,056 | ---- | M] () -- C:\Users\Marco\Desktop\Auftrag_51044045.pdf
========== Files Created - No Company Name ==========
[2012/02/19 22:31:02 | 000,072,591 | ---- | C] () -- C:\Users\Marco\Desktop\selbstbeherrschung.jpg
[2012/02/16 23:33:52 | 000,157,665 | ---- | C] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.jpg
[2012/02/16 23:25:44 | 000,236,515 | ---- | C] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.png
[2012/02/15 16:15:08 | 000,064,544 | ---- | C] () -- C:\Users\Marco\Desktop\cocaine.jpg
[2012/02/14 11:58:57 | 000,026,264 | ---- | C] () -- C:\Users\Marco\Desktop\379080_255728911164272_100001814955717_650468_191624065_n.jpg
[2012/02/08 10:52:56 | 000,023,961 | ---- | C] () -- C:\Users\Marco\Desktop\wetter.jpg
[2012/02/08 10:52:27 | 000,069,276 | ---- | C] () -- C:\Users\Marco\Desktop\schänderinnen.jpg
[2012/02/08 10:52:01 | 000,041,012 | ---- | C] () -- C:\Users\Marco\Desktop\alkohol.jpg
[2012/02/02 10:42:44 | 000,084,253 | ---- | C] () -- C:\Users\Marco\Desktop\2010-09-17-Titanic.jpg
[2012/02/02 10:38:22 | 000,104,050 | ---- | C] () -- C:\Users\Marco\Desktop\2010-06-23-To go.jpg
[2012/02/02 10:35:39 | 000,074,044 | ---- | C] () -- C:\Users\Marco\Desktop\2010-03-30-2010-30-03-Verdammt!.jpg
[2012/02/02 10:15:17 | 000,096,739 | ---- | C] () -- C:\Users\Marco\Desktop\2011-03-03-Papa Schlumpf.jpg
[2012/02/02 10:13:31 | 000,098,570 | ---- | C] () -- C:\Users\Marco\Desktop\2011-04-22-Clap your hands.jpg
[2012/02/01 10:32:06 | 000,030,830 | ---- | C] () -- C:\Users\Marco\Desktop\Kontoauszug_339164__Nr.001_vom_01.02.2012_20120201103157.pdf
[2012/01/31 15:06:06 | 000,000,458 | ---- | C] () -- C:\Users\Marco\Desktop\deutsche sprüche.rtf
[2012/01/29 22:17:58 | 000,098,744 | ---- | C] () -- C:\Users\Marco\Desktop\fahrschule gruss.jpg
[2012/01/28 20:32:28 | 000,001,037 | ---- | C] () -- C:\Users\Marco\Desktop\Warcraft III.lnk
[2012/01/28 15:54:49 | 000,488,848 | ---- | C] () -- C:\Users\Marco\Desktop\installer_warcraft_iii_the_frozen_throne.exe
[2012/01/28 09:44:41 | 000,041,056 | ---- | C] () -- C:\Users\Marco\Desktop\Auftrag_51044045.pdf
[2011/12/28 19:27:08 | 000,021,840 | ---- | C] () -- C:\windows\System32\SIntfNT.dll
[2011/12/28 19:27:08 | 000,017,212 | ---- | C] () -- C:\windows\System32\SIntf32.dll
[2011/12/28 19:27:08 | 000,012,067 | ---- | C] () -- C:\windows\System32\SIntf16.dll
[2011/12/28 19:13:43 | 000,034,919 | ---- | C] () -- C:\windows\DIIUnin.dat
[2011/11/19 19:38:07 | 000,000,017 | ---- | C] () -- C:\Users\Marco\AppData\Local\resmon.resmoncfg
[2011/09/01 20:33:50 | 000,000,264 | ---- | C] () -- C:\windows\ODBC.INI
[2011/09/01 20:33:21 | 000,001,288 | ---- | C] () -- C:\windows\ODBCINST.INI
[2011/09/01 20:32:46 | 000,284,160 | ---- | C] () -- C:\windows\unin0407.exe
[2011/05/21 17:46:26 | 000,000,118 | ---- | C] () -- C:\windows\asym.ini
[2011/05/21 16:30:12 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010/06/14 00:33:19 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2010/06/14 00:10:58 | 000,000,832 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/06/13 02:47:23 | 000,654,610 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2010/06/13 02:47:23 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2010/06/13 02:47:23 | 000,130,192 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2010/06/13 02:47:23 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2010/06/13 02:26:14 | 000,004,608 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll
[2010/06/13 02:26:13 | 000,982,220 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2010/06/13 02:26:13 | 000,134,592 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2010/06/13 02:26:13 | 000,092,216 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2010/06/13 02:26:12 | 000,439,300 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
========== LOP Check ==========
[2012/01/26 21:18:48 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\DVDVideoSoft
[2012/01/26 21:18:24 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/12/01 23:39:09 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\gtk-2.0
[2012/01/13 12:35:28 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Kalypso Media
[2012/02/11 16:52:56 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\SoftGrid Client
[2011/05/22 09:14:35 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\TP
[2011/11/18 10:29:58 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\wargaming.net
[2012/01/12 16:32:11 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
OTL by OldTimer - Version 3.2.33.2 Folder = C:\Users\Marco\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2.93 Gb Total Physical Memory | 2.03 Gb Available Physical Memory | 69.06% Memory free
5.86 Gb Paging File | 5.07 Gb Available in Paging File | 86.48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 177.91 Gb Total Space | 130.89 Gb Free Space | 73.57% Space Free | Partition Type: NTFS
Drive D: | 100.08 Gb Total Space | 2.57 Gb Free Space | 2.57% Space Free | Partition Type: NTFS
Computer Name: MARCO-PC | User Name: Marco | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2012/02/26 11:54:57 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
PRC - [2012/02/19 16:09:23 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/08/01 22:51:02 | 000,484,008 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avscan.exe
PRC - [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2012/02/19 16:09:23 | 001,911,768 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/05/21 17:28:49 | 006,271,136 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2010/06/17 14:27:02 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
========== Win32 Services (SafeList) ==========
SRV - [2011/10/01 08:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 08:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/08/01 22:51:00 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/03/28 15:15:04 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/06/14 00:10:50 | 000,332,272 | ---- | M] (Google Inc.) [On_Demand | Stopped] -- C:\ProgramData\Partner\Partner.exe -- (Partner Service)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - [2011/10/01 08:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 08:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 08:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 08:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/08/01 22:51:07 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/08/01 22:51:07 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/09/26 00:50:17 | 000,015,656 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rtport.sys -- (rtport)
DRV - [2010/06/17 14:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/12/14 21:44:42 | 001,245,696 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Facemoods Search
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/02/19 16:09:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
[2011/05/21 17:10:35 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Extensions
[2012/02/13 16:40:03 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions
[2012/01/26 21:18:25 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/02/13 16:40:03 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Marco\AppData\Roaming\mozilla\Firefox\Profiles\rctgkbmj.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/11/12 15:10:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012/02/19 16:09:23 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/02/06 08:25:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/02/06 08:25:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/02/06 08:25:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/05/21 20:55:07 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2012/02/06 08:24:59 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/02/06 08:24:59 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/02/06 08:24:59 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Partner BHO Class) - {83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4} - C:\ProgramData\Partner\Partner.dll (Google Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [{F1FF546D-77C1-11DF-9425-806E6F6E6963}] C:\Users\Marco\AppData\Roaming\Microsoft\torrent.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Marco\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A01204E6-3498-4762-BE85-5AE5592765BC}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B7770039-0302-455A-9976-A8FA47182CD1}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2012/02/26 11:54:52 | 000,583,680 | ---- | C] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
[2012/02/26 11:51:11 | 000,000,000 | ---D | C] -- C:\Users\Marco\AppData\Roaming\Avira
[2012/02/24 18:28:51 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\musikkkk
[2012/02/21 16:21:10 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\musik
[2012/02/16 12:06:14 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012/02/09 13:45:01 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\verkaufbilder tds
[2012/02/03 14:42:10 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\City Interactive
[2012/02/01 11:01:53 | 000,000,000 | ---D | C] -- C:\Users\Marco\Desktop\lustige pics
[2012/01/28 20:32:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III
[2012/01/28 20:32:28 | 000,000,000 | ---D | C] -- C:\Program Files\Warcraft III
[2012/01/28 20:32:27 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Blizzard Entertainment
[2012/01/28 20:08:10 | 000,000,000 | ---D | C] -- C:\Users\Marco\Warcraft III 1.21b ROC Installer deDE
[2012/01/28 16:04:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Warcraft III Demo
[2012/01/28 15:56:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012/01/28 15:56:33 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
========== Files - Modified Within 30 Days ==========
[2012/02/26 11:54:57 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Marco\Desktop\OTL.exe
[2012/02/26 11:50:41 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/02/26 11:50:36 | 3150,561,280 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/26 11:49:58 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 11:49:58 | 000,014,512 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/02/26 11:44:28 | 000,001,094 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/02/25 22:31:00 | 000,001,098 | ---- | M] () -- C:\windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/02/24 18:18:05 | 000,654,610 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/02/24 18:18:05 | 000,616,452 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/02/24 18:18:05 | 000,130,192 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/02/24 18:18:05 | 000,106,574 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/02/19 22:31:03 | 000,072,591 | ---- | M] () -- C:\Users\Marco\Desktop\selbstbeherrschung.jpg
[2012/02/16 23:33:53 | 000,157,665 | ---- | M] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.jpg
[2012/02/16 23:25:45 | 000,236,515 | ---- | M] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.png
[2012/02/16 14:42:34 | 000,277,656 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/02/15 16:15:09 | 000,064,544 | ---- | M] () -- C:\Users\Marco\Desktop\cocaine.jpg
[2012/02/14 11:58:59 | 000,026,264 | ---- | M] () -- C:\Users\Marco\Desktop\379080_255728911164272_100001814955717_650468_191624065_n.jpg
[2012/02/08 10:52:57 | 000,023,961 | ---- | M] () -- C:\Users\Marco\Desktop\wetter.jpg
[2012/02/08 10:52:27 | 000,069,276 | ---- | M] () -- C:\Users\Marco\Desktop\schänderinnen.jpg
[2012/02/08 10:52:01 | 000,041,012 | ---- | M] () -- C:\Users\Marco\Desktop\alkohol.jpg
[2012/02/02 10:42:45 | 000,084,253 | ---- | M] () -- C:\Users\Marco\Desktop\2010-09-17-Titanic.jpg
[2012/02/02 10:38:22 | 000,104,050 | ---- | M] () -- C:\Users\Marco\Desktop\2010-06-23-To go.jpg
[2012/02/02 10:35:39 | 000,074,044 | ---- | M] () -- C:\Users\Marco\Desktop\2010-03-30-2010-30-03-Verdammt!.jpg
[2012/02/02 10:15:18 | 000,096,739 | ---- | M] () -- C:\Users\Marco\Desktop\2011-03-03-Papa Schlumpf.jpg
[2012/02/02 10:13:33 | 000,098,570 | ---- | M] () -- C:\Users\Marco\Desktop\2011-04-22-Clap your hands.jpg
[2012/02/01 10:32:07 | 000,030,830 | ---- | M] () -- C:\Users\Marco\Desktop\Kontoauszug_339164__Nr.001_vom_01.02.2012_20120201103157.pdf
[2012/01/31 15:06:06 | 000,000,458 | ---- | M] () -- C:\Users\Marco\Desktop\deutsche sprüche.rtf
[2012/01/29 22:18:01 | 000,098,744 | ---- | M] () -- C:\Users\Marco\Desktop\fahrschule gruss.jpg
[2012/01/28 20:32:55 | 000,001,037 | ---- | M] () -- C:\Users\Marco\Desktop\Warcraft III.lnk
[2012/01/28 15:54:50 | 000,488,848 | ---- | M] () -- C:\Users\Marco\Desktop\installer_warcraft_iii_the_frozen_throne.exe
[2012/01/28 09:44:44 | 000,041,056 | ---- | M] () -- C:\Users\Marco\Desktop\Auftrag_51044045.pdf
========== Files Created - No Company Name ==========
[2012/02/19 22:31:02 | 000,072,591 | ---- | C] () -- C:\Users\Marco\Desktop\selbstbeherrschung.jpg
[2012/02/16 23:33:52 | 000,157,665 | ---- | C] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.jpg
[2012/02/16 23:25:44 | 000,236,515 | ---- | C] () -- C:\Users\Marco\Desktop\überweisung 16.02.12.png
[2012/02/15 16:15:08 | 000,064,544 | ---- | C] () -- C:\Users\Marco\Desktop\cocaine.jpg
[2012/02/14 11:58:57 | 000,026,264 | ---- | C] () -- C:\Users\Marco\Desktop\379080_255728911164272_100001814955717_650468_191624065_n.jpg
[2012/02/08 10:52:56 | 000,023,961 | ---- | C] () -- C:\Users\Marco\Desktop\wetter.jpg
[2012/02/08 10:52:27 | 000,069,276 | ---- | C] () -- C:\Users\Marco\Desktop\schänderinnen.jpg
[2012/02/08 10:52:01 | 000,041,012 | ---- | C] () -- C:\Users\Marco\Desktop\alkohol.jpg
[2012/02/02 10:42:44 | 000,084,253 | ---- | C] () -- C:\Users\Marco\Desktop\2010-09-17-Titanic.jpg
[2012/02/02 10:38:22 | 000,104,050 | ---- | C] () -- C:\Users\Marco\Desktop\2010-06-23-To go.jpg
[2012/02/02 10:35:39 | 000,074,044 | ---- | C] () -- C:\Users\Marco\Desktop\2010-03-30-2010-30-03-Verdammt!.jpg
[2012/02/02 10:15:17 | 000,096,739 | ---- | C] () -- C:\Users\Marco\Desktop\2011-03-03-Papa Schlumpf.jpg
[2012/02/02 10:13:31 | 000,098,570 | ---- | C] () -- C:\Users\Marco\Desktop\2011-04-22-Clap your hands.jpg
[2012/02/01 10:32:06 | 000,030,830 | ---- | C] () -- C:\Users\Marco\Desktop\Kontoauszug_339164__Nr.001_vom_01.02.2012_20120201103157.pdf
[2012/01/31 15:06:06 | 000,000,458 | ---- | C] () -- C:\Users\Marco\Desktop\deutsche sprüche.rtf
[2012/01/29 22:17:58 | 000,098,744 | ---- | C] () -- C:\Users\Marco\Desktop\fahrschule gruss.jpg
[2012/01/28 20:32:28 | 000,001,037 | ---- | C] () -- C:\Users\Marco\Desktop\Warcraft III.lnk
[2012/01/28 15:54:49 | 000,488,848 | ---- | C] () -- C:\Users\Marco\Desktop\installer_warcraft_iii_the_frozen_throne.exe
[2012/01/28 09:44:41 | 000,041,056 | ---- | C] () -- C:\Users\Marco\Desktop\Auftrag_51044045.pdf
[2011/12/28 19:27:08 | 000,021,840 | ---- | C] () -- C:\windows\System32\SIntfNT.dll
[2011/12/28 19:27:08 | 000,017,212 | ---- | C] () -- C:\windows\System32\SIntf32.dll
[2011/12/28 19:27:08 | 000,012,067 | ---- | C] () -- C:\windows\System32\SIntf16.dll
[2011/12/28 19:13:43 | 000,034,919 | ---- | C] () -- C:\windows\DIIUnin.dat
[2011/11/19 19:38:07 | 000,000,017 | ---- | C] () -- C:\Users\Marco\AppData\Local\resmon.resmoncfg
[2011/09/01 20:33:50 | 000,000,264 | ---- | C] () -- C:\windows\ODBC.INI
[2011/09/01 20:33:21 | 000,001,288 | ---- | C] () -- C:\windows\ODBCINST.INI
[2011/09/01 20:32:46 | 000,284,160 | ---- | C] () -- C:\windows\unin0407.exe
[2011/05/21 17:46:26 | 000,000,118 | ---- | C] () -- C:\windows\asym.ini
[2011/05/21 16:30:12 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010/06/14 00:33:19 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2010/06/14 00:10:58 | 000,000,832 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/06/13 02:47:23 | 000,654,610 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2010/06/13 02:47:23 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2010/06/13 02:47:23 | 000,130,192 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2010/06/13 02:47:23 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2010/06/13 02:26:14 | 000,004,608 | ---- | C] () -- C:\windows\System32\HdmiCoin.dll
[2010/06/13 02:26:13 | 000,982,220 | ---- | C] () -- C:\windows\System32\igkrng500.bin
[2010/06/13 02:26:13 | 000,134,592 | ---- | C] () -- C:\windows\System32\igfcg500.bin
[2010/06/13 02:26:13 | 000,092,216 | ---- | C] () -- C:\windows\System32\igfcg500m.bin
[2010/06/13 02:26:12 | 000,439,300 | ---- | C] () -- C:\windows\System32\igcompkrng500.bin
========== LOP Check ==========
[2012/01/26 21:18:48 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\DVDVideoSoft
[2012/01/26 21:18:24 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\DVDVideoSoftIEHelpers
[2011/12/01 23:39:09 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\gtk-2.0
[2012/01/13 12:35:28 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\Kalypso Media
[2012/02/11 16:52:56 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\SoftGrid Client
[2011/05/22 09:14:35 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\TP
[2011/11/18 10:29:58 | 000,000,000 | ---D | M] -- C:\Users\Marco\AppData\Roaming\wargaming.net
[2012/01/12 16:32:11 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
chr0n0s
0
hallo,
Du solltest Deinen Rechner lieber neu aufsetzen, dazu gibt es auch einen Thread hier im Forum, daher auch bitte vorher mal die Board-SuFu verwenden:
http://www.hackerboard.de/virenschu...n-blockiert-50-fuer-freischaltung-zahlen.html
Grüße
chr0n0s
Du solltest Deinen Rechner lieber neu aufsetzen, dazu gibt es auch einen Thread hier im Forum, daher auch bitte vorher mal die Board-SuFu verwenden:
http://www.hackerboard.de/virenschu...n-blockiert-50-fuer-freischaltung-zahlen.html
Grüße
chr0n0s
Ist das zufällig der "Gema" oder auch "BKA" Trojaner? Diesen bekommt man recht einfach weg
Je nach Meldung kann man den auch in der Registry relativ leicht finden, einfach den Rechner normal hochfahren ohne Internet (Kabel ziehen) dann kommt die Meldung nicht und man kann schauen was es genau ist.
Zuletzt habe ich den entfernt als der als Firefox.exe getarnt war. In der Registry hatte der sich eingetragen mit den kommentar "Rape" etc.
Steht allerdings meine ich nicht direkt unter den Autostart einträgen am besten Rechner hochfahren und mit Process Explorer von Sysinternals schauen was gestartet wird und von wo es gestartet wird.
Vor allem auch die Temp Internet Dateien bzw. Temp Dateien generell löschen da versteckt sich nämlich auch ein Teil der ihn wieder herstellt wenn man einfach nur die Datei entfernt so wie den Eintrag.
Generell gilt aber auch hier Rechner neuaufsetzen ist die beste Methode!
Zuletzt habe ich den entfernt als der als Firefox.exe getarnt war. In der Registry hatte der sich eingetragen mit den kommentar "Rape" etc.
Steht allerdings meine ich nicht direkt unter den Autostart einträgen am besten Rechner hochfahren und mit Process Explorer von Sysinternals schauen was gestartet wird und von wo es gestartet wird.
Vor allem auch die Temp Internet Dateien bzw. Temp Dateien generell löschen da versteckt sich nämlich auch ein Teil der ihn wieder herstellt wenn man einfach nur die Datei entfernt so wie den Eintrag.
Generell gilt aber auch hier Rechner neuaufsetzen ist die beste Methode!
chr0n0s
0
Den PC neu aufsetzen ist relativ sicher, da man nicht genau weiß, was noch infiziert wurde, da dieser sich auch recht gut (Ohne Kenntnisse) verstecken kann.
Also lieber Daten einmal sichern, das Laufwerk entsprechend an einen sauberen PC hängen und noch einmal alles abscannen lassen, damit die Maleware nicht auf den neuen PC wieder drauf ist.
Also lieber Daten einmal sichern, das Laufwerk entsprechend an einen sauberen PC hängen und noch einmal alles abscannen lassen, damit die Maleware nicht auf den neuen PC wieder drauf ist.
- Starte die OTL.exe bitte erneut
- Kopiere nun das Folgende in die Textbox.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.
falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden
Öffne nun C:, suche den Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
So wird eine Movedfiles.zip Datei in _OTL erstellt
Schicke mir diese Datei bitte per PN
Die Datei bitte keinesfalls hochladen! Sie kann einen Virus enthalten!
Wie hier schon oft richtig erwähnt wird, sollte der Rechner aber dennoch schnellstmöglich neu aufgesetzt werden. Diese Anleitung hilft lediglich, um zumindest kurzfristig wieder arbeitsfähig zu sein.
Ich hatte den Virus auch mal, habe ne menge Zeit investiert.
Aber im Enteffekt sehr easy 1. PC vom Netz nehmen
dann lädst du dir anderweitig Regrun runter
dann dein PC starten ganz am anfang bevor die Nachricht erscheint gema.exe Prozess killen [mit Taskmanager] dann Regrun installieren, drüberlaufen lassen gema entfernen
dann noch mal ccleaner und fertsch
Aber im Enteffekt sehr easy 1. PC vom Netz nehmen
dann lädst du dir anderweitig Regrun runter dann dein PC starten ganz am anfang bevor die Nachricht erscheint gema.exe Prozess killen [mit Taskmanager] dann Regrun installieren, drüberlaufen lassen gema entfernen
dann noch mal ccleaner und fertsch
- Status